# Flog Txt Version 1 # Analyzer Version: 3.1.2 # Analyzer Build Date: Oct 28 2019 11:51:53 # Log Creation Date: 05.01.2020 06:56:47.838 Process: id = "1" image_name = "%localappdata%sample.exe.exe" filename = "c:\\users\\fd1hvy\\desktop\\%localappdata%sample.exe.exe" page_root = "0xe627000" os_pid = "0xf94" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xf8c [0066.792] LocalAlloc (uFlags=0x0, uBytes=0xa8) returned 0xd30368 [0066.801] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0066.878] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77bb0000 [0066.887] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x19ff14 | out: Wow64Process=0x19ff14) returned 1 [0067.850] GetModuleFileNameW (in: hModule=0x400000, lpFilename=0x19fb08, nSize=0xfe | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\%localappdata%sample.exe.exe")) returned 0x34 [0067.904] NtOpenFile (in: FileHandle=0x19fabc, DesiredAccess=0x80100080, ObjectAttributes=0x19fa80*(Length=0x30, RootDirectory=0x0, ObjectName="\\??\\C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe", Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x19faac, ShareAccess=0x3, OpenOptions=0x60 | out: FileHandle=0x19fabc*=0x1d4, IoStatusBlock=0x19faac*(Status=0x0, Pointer=0x20100000000, Information=0x1)) returned 0x0 [0067.907] NtCreateSection (in: SectionHandle=0x19fab8, DesiredAccess=0x4, ObjectAttributes=0x19fa90*(Length=0x30, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), MaximumSize=0x0, SectionPageProtection=0x2, AllocationAttributes=0x8000000, FileHandle=0x1d4 | out: SectionHandle=0x19fab8*=0x1d8) returned 0x0 [0067.908] NtMapViewOfSection (in: SectionHandle=0x1d8, ProcessHandle=0xffffffffffffffff, BaseAddress=0x19faac*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x19fdbc00000000, ViewSize=0x19faa4*=0x0, InheritDisposition=0x100000000, AllocationType=0x0, AccessProtection=0x0 | out: BaseAddress=0x19faac*=0x0, SectionOffset=0x19fdbc00000000, ViewSize=0x19faa4*=0x0) returned 0xc00000f6 [0067.908] NtClose (Handle=0x1d8) returned 0x0 [0067.908] NtClose (Handle=0x1d4) returned 0x0 [0067.909] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x19fac0*=0x40e000, NumberOfBytesToProtect=0x19fab8, NewAccessProtection=0x40, OldAccessProtection=0x19fde8 | out: BaseAddress=0x19fac0*=0x40e000, NumberOfBytesToProtect=0x19fab8, OldAccessProtection=0x19fde8*=0x20) returned 0x0 [0067.925] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x19fac0*=0x433000, NumberOfBytesToProtect=0x19fab8, NewAccessProtection=0x4, OldAccessProtection=0x19fde8 | out: BaseAddress=0x19fac0*=0x433000, NumberOfBytesToProtect=0x19fab8, OldAccessProtection=0x19fde8*=0x80) returned 0x0 [0067.926] LocalAlloc (uFlags=0x0, uBytes=0x3e6c) returned 0xd3eba0 [0069.357] LocalFree (hMem=0xd3eba0) returned 0x0 [0069.358] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x75e90000 [0069.368] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77bb0000 [0069.369] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77bb0000 [0069.369] GetModuleHandleA (lpModuleName="ADVAPI32.dll") returned 0x761b0000 [0069.371] GetModuleHandleA (lpModuleName="SHELL32.dll") returned 0x76480000 [0069.372] GetModuleHandleA (lpModuleName="SHLWAPI.dll") returned 0x75f60000 [0069.373] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77bb0000 [0069.375] GetModuleHandleA (lpModuleName="WTSAPI32.dll") returned 0x73180000 [0069.375] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x75e90000 [0069.382] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77bb0000 [0069.382] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77bb0000 [0069.546] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77bb0000 [0069.547] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77bb0000 [0069.556] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77bb0000 [0069.559] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77bb0000 [0069.560] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77bb0000 [0069.562] GetModuleHandleA (lpModuleName="USER32.dll") returned 0x74b70000 [0069.564] NtQueryVirtualMemory (in: ProcessHandle=0xffffffffffffffff, Address=0xd30368, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x19fa94, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0x19fa94, ResultLength=0x0) returned 0x80000002 [0069.565] NtQueryVirtualMemory (in: ProcessHandle=0xffffffffffffffff, Address=0xb81000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x19fa94, Length=0x30, ResultLength=0x0 | out: VirtualMemoryInformation=0x19fa94, ResultLength=0x0) returned 0x80000002 [0069.653] GetProcessAffinityMask (in: hProcess=0xffffffff, lpProcessAffinityMask=0x19fe9c, lpSystemAffinityMask=0x19fedc | out: lpProcessAffinityMask=0x19fe9c, lpSystemAffinityMask=0x19fedc) returned 1 [0069.654] SetThreadAffinityMask (hThread=0xfffffffe, dwThreadAffinityMask=0x1) returned 0x1 [0069.655] Sleep (dwMilliseconds=0x0) [0069.706] SetThreadAffinityMask (hThread=0xfffffffe, dwThreadAffinityMask=0x1) returned 0x1 [0069.707] SetThreadAffinityMask (hThread=0xfffffffe, dwThreadAffinityMask=0x2) returned 0x0 [0069.707] Sleep (dwMilliseconds=0x0) [0069.787] SetThreadAffinityMask (hThread=0xfffffffe, dwThreadAffinityMask=0x0) returned 0x0 [0069.787] SetThreadAffinityMask (hThread=0xfffffffe, dwThreadAffinityMask=0x4) returned 0x0 [0069.788] Sleep (dwMilliseconds=0x0) [0069.892] SetThreadAffinityMask (hThread=0xfffffffe, dwThreadAffinityMask=0x0) returned 0x0 [0069.893] SetThreadAffinityMask (hThread=0xfffffffe, dwThreadAffinityMask=0x8) returned 0x0 [0069.893] Sleep (dwMilliseconds=0x0) [0070.102] SetThreadAffinityMask (hThread=0xfffffffe, dwThreadAffinityMask=0x0) returned 0x0 [0070.106] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19f9c8 | out: lpSystemTimeAsFileTime=0x19f9c8*(dwLowDateTime=0x7647a6fa, dwHighDateTime=0x1d5c395)) [0070.106] GetCurrentProcessId () returned 0xf94 [0070.106] GetCurrentThreadId () returned 0xf8c [0070.106] GetTickCount () returned 0x1151c8d [0070.107] QueryPerformanceCounter (in: lpPerformanceCount=0x19f9c0 | out: lpPerformanceCount=0x19f9c0*=16081147080) returned 1 [0070.107] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2790000 [0070.109] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0070.109] GetProcAddress (hModule=0x75e90000, lpProcName="FlsAlloc") returned 0x75ea4ae0 [0070.110] GetProcAddress (hModule=0x75e90000, lpProcName="FlsGetValue") returned 0x75ea4b20 [0070.110] GetProcAddress (hModule=0x75e90000, lpProcName="FlsSetValue") returned 0x75ea4b40 [0070.110] GetProcAddress (hModule=0x75e90000, lpProcName="FlsFree") returned 0x75ea4b00 [0070.110] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0070.111] GetProcAddress (hModule=0x75e90000, lpProcName="EncodePointer") returned 0x77c129e0 [0070.111] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0070.111] GetProcAddress (hModule=0x75e90000, lpProcName="EncodePointer") returned 0x77c129e0 [0070.111] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0070.112] GetProcAddress (hModule=0x75e90000, lpProcName="EncodePointer") returned 0x77c129e0 [0070.112] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0070.112] GetProcAddress (hModule=0x75e90000, lpProcName="EncodePointer") returned 0x77c129e0 [0070.112] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0070.112] GetProcAddress (hModule=0x75e90000, lpProcName="EncodePointer") returned 0x77c129e0 [0070.112] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0070.113] GetProcAddress (hModule=0x75e90000, lpProcName="EncodePointer") returned 0x77c129e0 [0070.113] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0070.113] GetProcAddress (hModule=0x75e90000, lpProcName="EncodePointer") returned 0x77c129e0 [0070.114] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0070.114] GetProcAddress (hModule=0x75e90000, lpProcName="DecodePointer") returned 0x77c11ec0 [0070.115] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x214) returned 0x27905a8 [0070.115] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0070.115] GetProcAddress (hModule=0x75e90000, lpProcName="DecodePointer") returned 0x77c11ec0 [0070.115] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0070.116] GetProcAddress (hModule=0x75e90000, lpProcName="EncodePointer") returned 0x77c129e0 [0070.116] GetProcAddress (hModule=0x75e90000, lpProcName="DecodePointer") returned 0x77c11ec0 [0070.117] GetCurrentThreadId () returned 0xf8c [0070.117] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe\" " [0070.117] GetEnvironmentStringsW () returned 0xd3d3f0* [0070.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0070.131] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x0, Size=0x565) returned 0x27907c8 [0070.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x27907c8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0070.131] FreeEnvironmentStringsW (penv=0xd3d3f0) returned 1 [0070.132] GetStartupInfoA (in: lpStartupInfo=0x19f918 | out: lpStartupInfo=0x19f918*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0070.132] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x800) returned 0x2790d38 [0070.183] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0070.183] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0070.183] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0070.183] SetHandleCount (uNumber=0x20) returned 0x20 [0070.183] GetLastError () returned 0x0 [0070.184] SetLastError (dwErrCode=0x0) [0070.184] GetLastError () returned 0x0 [0070.184] SetLastError (dwErrCode=0x0) [0070.184] GetLastError () returned 0x0 [0070.184] SetLastError (dwErrCode=0x0) [0070.184] GetACP () returned 0x4e4 [0070.184] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x0, Size=0x220) returned 0x2791540 [0070.184] GetLastError () returned 0x0 [0070.185] SetLastError (dwErrCode=0x0) [0070.185] IsValidCodePage (CodePage=0x4e4) returned 1 [0070.185] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f8f8 | out: lpCPInfo=0x19f8f8) returned 1 [0070.185] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f3c4 | out: lpCPInfo=0x19f3c4) returned 1 [0070.185] GetLastError () returned 0x0 [0070.185] SetLastError (dwErrCode=0x0) [0070.185] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x19f354 | out: lpCharType=0x19f354) returned 1 [0070.185] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19f7d8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0070.186] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19f7d8, cbMultiByte=256, lpWideCharStr=0x19f148, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0070.186] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x19f3d8 | out: lpCharType=0x19f3d8) returned 1 [0070.186] GetLastError () returned 0x0 [0070.186] SetLastError (dwErrCode=0x0) [0070.186] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0070.186] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19f7d8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0070.186] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19f7d8, cbMultiByte=256, lpWideCharStr=0x19f108, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0070.186] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0070.186] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19eef8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0070.187] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x19f6d8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿíU\x1cÈ\x10ù\x19", lpUsedDefaultChar=0x0) returned 256 [0070.187] GetLastError () returned 0x0 [0070.187] SetLastError (dwErrCode=0x0) [0070.187] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19f7d8, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0070.187] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19f7d8, cbMultiByte=256, lpWideCharStr=0x19f128, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0070.187] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0070.187] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19ef18, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0070.187] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x19f5d8, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿíU\x1cÈ\x10ù\x19", lpUsedDefaultChar=0x0) returned 256 [0070.188] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x436528, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\%localappdata%sample.exe.exe")) returned 0x34 [0070.188] GetLastError () returned 0x0 [0070.188] SetLastError (dwErrCode=0x0) [0070.188] GetLastError () returned 0x0 [0070.189] SetLastError (dwErrCode=0x0) [0070.189] GetLastError () returned 0x0 [0070.189] SetLastError (dwErrCode=0x0) [0070.189] GetLastError () returned 0x0 [0070.189] SetLastError (dwErrCode=0x0) [0070.189] GetLastError () returned 0x0 [0070.189] SetLastError (dwErrCode=0x0) [0070.189] GetLastError () returned 0x0 [0070.189] SetLastError (dwErrCode=0x0) [0070.189] GetLastError () returned 0x0 [0070.190] SetLastError (dwErrCode=0x0) [0070.190] GetLastError () returned 0x0 [0070.190] SetLastError (dwErrCode=0x0) [0070.190] GetLastError () returned 0x0 [0070.190] SetLastError (dwErrCode=0x0) [0070.190] GetLastError () returned 0x0 [0070.190] SetLastError (dwErrCode=0x0) [0070.190] GetLastError () returned 0x0 [0070.190] SetLastError (dwErrCode=0x0) [0070.190] GetLastError () returned 0x0 [0070.190] SetLastError (dwErrCode=0x0) [0070.190] GetLastError () returned 0x0 [0070.191] SetLastError (dwErrCode=0x0) [0070.191] GetLastError () returned 0x0 [0070.191] SetLastError (dwErrCode=0x0) [0070.191] GetLastError () returned 0x0 [0070.191] SetLastError (dwErrCode=0x0) [0070.191] GetLastError () returned 0x0 [0070.191] SetLastError (dwErrCode=0x0) [0070.191] GetLastError () returned 0x0 [0070.191] SetLastError (dwErrCode=0x0) [0070.191] GetLastError () returned 0x0 [0070.192] SetLastError (dwErrCode=0x0) [0070.192] GetLastError () returned 0x0 [0070.192] SetLastError (dwErrCode=0x0) [0070.192] GetLastError () returned 0x0 [0070.192] SetLastError (dwErrCode=0x0) [0070.192] GetLastError () returned 0x0 [0070.192] SetLastError (dwErrCode=0x0) [0070.192] GetLastError () returned 0x0 [0070.192] SetLastError (dwErrCode=0x0) [0070.192] GetLastError () returned 0x0 [0070.192] SetLastError (dwErrCode=0x0) [0070.192] GetLastError () returned 0x0 [0070.193] SetLastError (dwErrCode=0x0) [0070.193] GetLastError () returned 0x0 [0070.193] SetLastError (dwErrCode=0x0) [0070.193] GetLastError () returned 0x0 [0070.193] SetLastError (dwErrCode=0x0) [0070.193] GetLastError () returned 0x0 [0070.193] SetLastError (dwErrCode=0x0) [0070.193] GetLastError () returned 0x0 [0070.193] SetLastError (dwErrCode=0x0) [0070.193] GetLastError () returned 0x0 [0070.194] SetLastError (dwErrCode=0x0) [0070.194] GetLastError () returned 0x0 [0070.194] SetLastError (dwErrCode=0x0) [0070.194] GetLastError () returned 0x0 [0070.194] SetLastError (dwErrCode=0x0) [0070.194] GetLastError () returned 0x0 [0070.194] SetLastError (dwErrCode=0x0) [0070.194] GetLastError () returned 0x0 [0070.194] SetLastError (dwErrCode=0x0) [0070.194] GetLastError () returned 0x0 [0070.194] SetLastError (dwErrCode=0x0) [0070.195] GetLastError () returned 0x0 [0070.195] SetLastError (dwErrCode=0x0) [0070.195] GetLastError () returned 0x0 [0070.195] SetLastError (dwErrCode=0x0) [0070.342] GetLastError () returned 0x0 [0070.342] SetLastError (dwErrCode=0x0) [0070.342] GetLastError () returned 0x0 [0070.342] SetLastError (dwErrCode=0x0) [0070.342] GetLastError () returned 0x0 [0070.342] SetLastError (dwErrCode=0x0) [0070.342] GetLastError () returned 0x0 [0070.342] SetLastError (dwErrCode=0x0) [0070.342] GetLastError () returned 0x0 [0070.342] SetLastError (dwErrCode=0x0) [0070.342] GetLastError () returned 0x0 [0070.343] SetLastError (dwErrCode=0x0) [0070.343] GetLastError () returned 0x0 [0070.343] SetLastError (dwErrCode=0x0) [0070.343] GetLastError () returned 0x0 [0070.343] SetLastError (dwErrCode=0x0) [0070.343] GetLastError () returned 0x0 [0070.343] SetLastError (dwErrCode=0x0) [0070.343] GetLastError () returned 0x0 [0070.343] SetLastError (dwErrCode=0x0) [0070.343] GetLastError () returned 0x0 [0070.343] SetLastError (dwErrCode=0x0) [0070.343] GetLastError () returned 0x0 [0070.343] SetLastError (dwErrCode=0x0) [0070.344] GetLastError () returned 0x0 [0070.344] SetLastError (dwErrCode=0x0) [0070.344] GetLastError () returned 0x0 [0070.344] SetLastError (dwErrCode=0x0) [0070.344] GetLastError () returned 0x0 [0070.344] SetLastError (dwErrCode=0x0) [0070.344] GetLastError () returned 0x0 [0070.344] SetLastError (dwErrCode=0x0) [0070.344] GetLastError () returned 0x0 [0070.344] SetLastError (dwErrCode=0x0) [0070.344] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x0, Size=0x3d) returned 0x2791768 [0070.344] GetLastError () returned 0x0 [0070.344] SetLastError (dwErrCode=0x0) [0070.345] GetLastError () returned 0x0 [0070.345] SetLastError (dwErrCode=0x0) [0070.345] GetLastError () returned 0x0 [0070.345] SetLastError (dwErrCode=0x0) [0070.345] GetLastError () returned 0x0 [0070.345] SetLastError (dwErrCode=0x0) [0070.345] GetLastError () returned 0x0 [0070.345] SetLastError (dwErrCode=0x0) [0070.345] GetLastError () returned 0x0 [0070.345] SetLastError (dwErrCode=0x0) [0070.345] GetLastError () returned 0x0 [0070.345] SetLastError (dwErrCode=0x0) [0070.345] GetLastError () returned 0x0 [0070.346] SetLastError (dwErrCode=0x0) [0070.346] GetLastError () returned 0x0 [0070.346] SetLastError (dwErrCode=0x0) [0070.346] GetLastError () returned 0x0 [0070.346] SetLastError (dwErrCode=0x0) [0070.346] GetLastError () returned 0x0 [0070.346] SetLastError (dwErrCode=0x0) [0070.346] GetLastError () returned 0x0 [0070.346] SetLastError (dwErrCode=0x0) [0070.346] GetLastError () returned 0x0 [0070.346] SetLastError (dwErrCode=0x0) [0070.346] GetLastError () returned 0x0 [0070.347] SetLastError (dwErrCode=0x0) [0070.347] GetLastError () returned 0x0 [0070.347] SetLastError (dwErrCode=0x0) [0070.347] GetLastError () returned 0x0 [0070.347] SetLastError (dwErrCode=0x0) [0070.347] GetLastError () returned 0x0 [0070.347] SetLastError (dwErrCode=0x0) [0070.347] GetLastError () returned 0x0 [0070.347] SetLastError (dwErrCode=0x0) [0070.347] GetLastError () returned 0x0 [0070.347] SetLastError (dwErrCode=0x0) [0070.347] GetLastError () returned 0x0 [0070.348] SetLastError (dwErrCode=0x0) [0070.348] GetLastError () returned 0x0 [0070.349] SetLastError (dwErrCode=0x0) [0070.349] GetLastError () returned 0x0 [0070.349] SetLastError (dwErrCode=0x0) [0070.349] GetLastError () returned 0x0 [0070.350] SetLastError (dwErrCode=0x0) [0070.350] GetLastError () returned 0x0 [0070.350] SetLastError (dwErrCode=0x0) [0070.350] GetLastError () returned 0x0 [0070.350] SetLastError (dwErrCode=0x0) [0070.350] GetLastError () returned 0x0 [0070.350] SetLastError (dwErrCode=0x0) [0070.350] GetLastError () returned 0x0 [0070.350] SetLastError (dwErrCode=0x0) [0070.350] GetLastError () returned 0x0 [0070.350] SetLastError (dwErrCode=0x0) [0070.350] GetLastError () returned 0x0 [0070.351] SetLastError (dwErrCode=0x0) [0070.351] GetLastError () returned 0x0 [0070.351] SetLastError (dwErrCode=0x0) [0070.351] GetLastError () returned 0x0 [0070.351] SetLastError (dwErrCode=0x0) [0070.351] GetLastError () returned 0x0 [0070.351] SetLastError (dwErrCode=0x0) [0070.351] GetLastError () returned 0x0 [0070.351] SetLastError (dwErrCode=0x0) [0070.351] GetLastError () returned 0x0 [0070.351] SetLastError (dwErrCode=0x0) [0070.351] GetLastError () returned 0x0 [0070.351] SetLastError (dwErrCode=0x0) [0070.352] GetLastError () returned 0x0 [0070.352] SetLastError (dwErrCode=0x0) [0070.352] GetLastError () returned 0x0 [0070.352] SetLastError (dwErrCode=0x0) [0070.352] GetLastError () returned 0x0 [0070.352] SetLastError (dwErrCode=0x0) [0070.352] GetLastError () returned 0x0 [0070.352] SetLastError (dwErrCode=0x0) [0070.352] GetLastError () returned 0x0 [0070.352] SetLastError (dwErrCode=0x0) [0070.352] GetLastError () returned 0x0 [0070.352] SetLastError (dwErrCode=0x0) [0070.352] GetLastError () returned 0x0 [0070.353] SetLastError (dwErrCode=0x0) [0070.353] GetLastError () returned 0x0 [0070.353] SetLastError (dwErrCode=0x0) [0070.353] GetLastError () returned 0x0 [0070.353] SetLastError (dwErrCode=0x0) [0070.353] GetLastError () returned 0x0 [0070.353] SetLastError (dwErrCode=0x0) [0070.353] GetLastError () returned 0x0 [0070.353] SetLastError (dwErrCode=0x0) [0070.353] GetLastError () returned 0x0 [0070.353] SetLastError (dwErrCode=0x0) [0070.353] GetLastError () returned 0x0 [0070.353] SetLastError (dwErrCode=0x0) [0070.354] GetLastError () returned 0x0 [0070.354] SetLastError (dwErrCode=0x0) [0070.354] GetLastError () returned 0x0 [0070.354] SetLastError (dwErrCode=0x0) [0070.354] GetLastError () returned 0x0 [0070.354] SetLastError (dwErrCode=0x0) [0070.354] GetLastError () returned 0x0 [0070.354] SetLastError (dwErrCode=0x0) [0070.354] GetLastError () returned 0x0 [0070.354] SetLastError (dwErrCode=0x0) [0070.354] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x94) returned 0x27917b0 [0070.354] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x1f) returned 0x2791850 [0070.354] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x28) returned 0x2791878 [0070.354] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x37) returned 0x27918a8 [0070.354] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x3c) returned 0x27918e8 [0070.355] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x31) returned 0x2791930 [0070.355] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x14) returned 0x2791970 [0070.355] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x24) returned 0x2791990 [0070.355] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0xd) returned 0x27919c0 [0070.355] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x17) returned 0x27919d8 [0070.355] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x2b) returned 0x27919f8 [0070.355] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x15) returned 0x2791a30 [0070.355] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x17) returned 0x2791a50 [0070.355] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x22) returned 0x2791a70 [0070.355] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0xe) returned 0x2791aa0 [0070.355] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0xc1) returned 0x2791ab8 [0070.355] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x3e) returned 0x2791b88 [0070.355] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x1b) returned 0x2791bd0 [0070.355] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x1d) returned 0x2791bf8 [0070.355] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x48) returned 0x2791c20 [0070.355] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x12) returned 0x2791c70 [0070.355] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x18) returned 0x2791c90 [0070.355] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x1b) returned 0x2791cb0 [0070.355] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x24) returned 0x2791cd8 [0070.355] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x29) returned 0x2791d08 [0070.355] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x1e) returned 0x2791d40 [0070.355] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x6b) returned 0x2791d68 [0070.355] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x17) returned 0x2791de0 [0070.356] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0xf) returned 0x2791e00 [0070.356] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x16) returned 0x2791e18 [0070.356] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x28) returned 0x2791e38 [0070.356] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x27) returned 0x2791e68 [0070.356] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x12) returned 0x2791e98 [0070.356] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x21) returned 0x2791eb8 [0070.356] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x10) returned 0x2791ee8 [0070.356] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x1c) returned 0x2791f00 [0070.356] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x12) returned 0x2791f28 [0070.356] HeapFree (in: hHeap=0x2790000, dwFlags=0x0, lpMem=0x27907c8 | out: hHeap=0x2790000) returned 1 [0070.358] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x80) returned 0x2791f48 [0070.358] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x8, Size=0x800) returned 0x2791fd0 [0070.359] RtlSizeHeap (HeapHandle=0x2790000, Flags=0x0, MemoryPointer=0x2791f48) returned 0x80 [0070.367] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x0, Size=0x50) returned 0x27907c8 [0070.368] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x0, Size=0x2c) returned 0x2790820 [0070.369] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x0, Size=0x100) returned 0x2790858 [0070.369] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x0, Size=0x1c) returned 0x2790960 [0070.370] CreateToolhelp32Snapshot (dwFlags=0x4, th32ProcessID=0x0) returned 0x1d4 [0070.483] Thread32First (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.484] GetCurrentProcessId () returned 0xf94 [0070.484] GetCurrentThreadId () returned 0xf8c [0070.484] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.485] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.486] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.486] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.487] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.488] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.488] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.489] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.490] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.490] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.491] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.491] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.492] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.493] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.493] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.494] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.495] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.495] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.496] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.497] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.518] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.519] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.519] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.520] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.520] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.521] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.522] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.522] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.523] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.523] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.524] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.525] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.525] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.526] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.526] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.527] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.528] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.529] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.530] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.530] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.531] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.532] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.532] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.533] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.534] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.534] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.535] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.536] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.536] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.538] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.538] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.539] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.540] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.540] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.541] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.542] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.542] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.543] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.544] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.544] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.545] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.546] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.546] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.547] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.548] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.548] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.549] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.549] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.550] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.550] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.551] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.552] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.552] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.553] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.553] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.554] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.554] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.555] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.556] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.556] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.557] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.558] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.558] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.559] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.580] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.581] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.581] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.582] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.583] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.583] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.584] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.584] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.585] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.586] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.586] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.587] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.588] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.588] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.589] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.589] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.590] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.592] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.592] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.593] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.594] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.594] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.595] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.596] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.596] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.597] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.598] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.598] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.599] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.599] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.600] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.601] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.601] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.602] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.603] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.603] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.604] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.605] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.605] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.606] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.608] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.608] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.609] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.610] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.610] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.611] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.612] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.613] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.613] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.614] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.615] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.616] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.616] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.617] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.618] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.618] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.619] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.620] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.620] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.621] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.622] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.657] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.658] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.659] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.660] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.660] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.661] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.662] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.662] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.663] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.664] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.665] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.665] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.666] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.667] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.667] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.668] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.669] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.670] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.670] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.671] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.672] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.673] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.673] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.674] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.675] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.675] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.676] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.677] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.677] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.678] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.679] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.679] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.680] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.681] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.681] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.682] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.683] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.683] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.684] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.685] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.686] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.686] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.687] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.687] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.688] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.689] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.689] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.690] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.690] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.691] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.692] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.692] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.693] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.693] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.694] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.695] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.695] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.696] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.697] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.697] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.698] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.698] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.699] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.700] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.737] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.737] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.738] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.739] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.739] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.740] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.741] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.741] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.742] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.742] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.743] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.744] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.744] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.745] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.746] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.746] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.747] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.748] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.748] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.749] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.749] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.750] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.751] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.751] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.752] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.752] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.753] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.754] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.754] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.755] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.755] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.756] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.757] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.757] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.758] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.758] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.759] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.760] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.760] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0070.761] Thread32Next (hSnapshot=0x1d4, lpte=0x19f834) returned 1 [0071.402] OpenThread (dwDesiredAccess=0x2, bInheritHandle=0, dwThreadId=0x2d0) returned 0x1d8 [0071.402] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x0, Size=0x4) returned 0x2790988 [0071.403] CloseHandle (hObject=0x1d4) returned 1 [0071.480] SuspendThread (hThread=0x1d8) returned 0x0 [0071.482] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x0, Size=0xc) returned 0x2790998 [0071.482] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x0, Size=0xa) returned 0x27909b0 [0071.483] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77bb0000 [0071.484] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x0, Size=0xc) returned 0x27909c8 [0071.484] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x0, Size=0x17) returned 0x27909e0 [0071.487] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x0, Size=0x10) returned 0x2790a00 [0071.487] GetSystemInfo (in: lpSystemInfo=0x19f338 | out: lpSystemInfo=0x19f338*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0071.488] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0x1d0000 [0071.489] GetCurrentProcess () returned 0xffffffff [0071.489] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0x1d0005, lpBuffer=0x19f31c*, nSize=0x5, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x19f31c*, lpNumberOfBytesWritten=0x0) returned 1 [0071.490] GetCurrentProcess () returned 0xffffffff [0071.491] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0x1d000f, lpBuffer=0x19f320*, nSize=0x6, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x19f320*, lpNumberOfBytesWritten=0x0) returned 1 [0071.491] GetCurrentProcess () returned 0xffffffff [0071.492] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0x77c22210, lpBuffer=0x19f31c*, nSize=0x5, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x19f31c*, lpNumberOfBytesWritten=0x0) returned 1 [0071.493] GetCurrentProcess () returned 0xffffffff [0071.494] VirtualProtect (in: lpAddress=0x1d0000, dwSize=0x1000, flNewProtect=0x20, lpflOldProtect=0x19f35c | out: lpflOldProtect=0x19f35c*=0x40) returned 1 [0071.494] GetCurrentProcess () returned 0xffffffff [0071.495] RtlAllocateHeap (HeapHandle=0x2790000, Flags=0x0, Size=0x4) returned 0x2790a18 [0071.495] ResumeThread (hThread=0x1d8) returned 0x1 [0071.496] CloseHandle (hObject=0x1d8) returned 1 [0071.496] HeapFree (in: hHeap=0x2790000, dwFlags=0x0, lpMem=0x2790988 | out: hHeap=0x2790000) returned 1 [0071.500] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x19fac0*=0x40e000, NumberOfBytesToProtect=0x19fab8, NewAccessProtection=0x20, OldAccessProtection=0x19fe00 | out: BaseAddress=0x19fac0*=0x40e000, NumberOfBytesToProtect=0x19fab8, OldAccessProtection=0x19fe00*=0x40) returned 0x0 [0071.500] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x19fac0*=0x433000, NumberOfBytesToProtect=0x19fab8, NewAccessProtection=0x4, OldAccessProtection=0x19fe00 | out: BaseAddress=0x19fac0*=0x433000, NumberOfBytesToProtect=0x19fab8, OldAccessProtection=0x19fe00*=0x20) returned 0x0 [0071.501] GetProcessHeap () returned 0xd20000 [0071.501] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd31750 [0071.501] GetProcessHeap () returned 0xd20000 [0071.501] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0071.511] GetProcessHeap () returned 0xd20000 [0071.511] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31750 | out: hHeap=0xd20000) returned 1 [0071.511] GetProcessHeap () returned 0xd20000 [0071.511] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0071.511] GetProcessHeap () returned 0xd20000 [0071.511] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd2ad40 [0071.511] GetProcessHeap () returned 0xd20000 [0071.511] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1000) returned 0xd3eba0 [0071.511] GetProcessHeap () returned 0xd20000 [0071.511] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x9b4) returned 0xd3d3f0 [0071.512] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xd3eba0, nSize=0x800 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\%localappdata%sample.exe.exe")) returned 0x34 [0071.512] GetProcessHeap () returned 0xd20000 [0071.512] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd31750 [0071.512] GetProcessHeap () returned 0xd20000 [0071.512] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0071.599] GetProcessHeap () returned 0xd20000 [0071.599] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31750 | out: hHeap=0xd20000) returned 1 [0071.599] GetProcessHeap () returned 0xd20000 [0071.599] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0071.599] GetProcessHeap () returned 0xd20000 [0071.599] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd31750 [0071.600] GetProcessHeap () returned 0xd20000 [0071.600] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0071.611] GetProcessHeap () returned 0xd20000 [0071.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31750 | out: hHeap=0xd20000) returned 1 [0071.611] GetProcessHeap () returned 0xd20000 [0071.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0071.611] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0x4017b8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 24 [0071.611] GetProcessHeap () returned 0xd20000 [0071.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x30) returned 0xd3fe78 [0071.611] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0x4017b8, cbMultiByte=-1, lpWideCharStr=0xd3fe78, cchWideChar=24 | out: lpWideCharStr=".[ponce.lorena@aol.com]") returned 24 [0071.611] GetProcessHeap () returned 0xd20000 [0071.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd31750 [0071.611] GetProcessHeap () returned 0xd20000 [0071.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0071.691] GetProcessHeap () returned 0xd20000 [0071.691] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31750 | out: hHeap=0xd20000) returned 1 [0071.691] GetProcessHeap () returned 0xd20000 [0071.692] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0071.692] lstrlenA (lpString="Windows,Microsoft,Microsoft Help,Windows App Certification Kit,Windows Defender,ESET,COMODO,Windows NT,Windows Kits,Windows Mail,Windows Media Player,Windows Multimedia Platform,Windows Phone Kits,Windows Phone Silverlight Kits,Windows Photo Viewer,Windows Portable Devices,Windows Sidebar,WindowsPowerShell,NVIDIA Corporation,Microsoft.NET,Internet Explorer,Kaspersky Lab,McAfee,Avira,spytech software,sysconfig,Avast,Dr.Web,Symantec,Symantec_Client_Security,system volume information,AVG,Microsoft Shared,Common Files,Outlook Express,Movie Maker,Chrome,Mozilla Firefox,Opera,YandexBrowser,ntldr,Wsus,ProgramData") returned 613 [0071.692] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0xd10000 [0071.693] RtlAllocateHeap (HeapHandle=0xd10000, Flags=0x0, Size=0xac) returned 0xd105a8 [0071.693] GetProcessHeap () returned 0xd20000 [0071.693] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd31750 [0071.693] GetProcessHeap () returned 0xd20000 [0071.693] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0071.703] GetProcessHeap () returned 0xd20000 [0071.703] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31750 | out: hHeap=0xd20000) returned 1 [0071.703] GetProcessHeap () returned 0xd20000 [0071.704] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0071.704] lstrlenA (lpString=".[ponce.lorena@aol.com],.dll,.ini,.inc") returned 38 [0071.704] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2a00000 [0071.705] RtlAllocateHeap (HeapHandle=0x2a00000, Flags=0x0, Size=0x10) returned 0x2a005a8 [0071.705] GetProcessHeap () returned 0xd20000 [0071.705] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1000) returned 0xd403b0 [0071.705] GetEnvironmentVariableW (in: lpName="LOCALAPPDATA", lpBuffer=0xd403b0, nSize=0x800 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x1d [0071.705] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\AppData\\Local" | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Local\\") returned="" [0071.791] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0071.791] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData\\Local\\", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\Local\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="C:\\Users\\FD1HVy\\AppData\\Local\\%LOCALAPPDATA%SAMPLE.EXE.exe" [0071.791] lstrcmpiW (lpString1="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe", lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0071.865] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\%LOCALAPPDATA%SAMPLE.EXE.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\%localappdata%sample.exe.exe")) returned 0xffffffff [0071.865] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\%localappdata%sample.exe.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\%LOCALAPPDATA%SAMPLE.EXE.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\%localappdata%sample.exe.exe"), bFailIfExists=0) returned 1 [0071.875] GetCurrentProcess () returned 0xffffffff [0071.876] GetCurrentProcess () returned 0xffffffff [0071.883] GetCurrentProcess () returned 0xffffffff [0072.211] GetCurrentProcess () returned 0xffffffff [0072.212] GetCurrentProcess () returned 0xffffffff [0072.213] GetCurrentProcess () returned 0xffffffff [0072.223] GetCurrentProcess () returned 0xffffffff [0072.243] GetCurrentProcess () returned 0xffffffff [0072.244] GetCurrentProcess () returned 0xffffffff [0074.261] _alloca_probe () returned 0x40961a [0074.261] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ef60 | out: phkResult=0x19ef60*=0x1dc) returned 0x0 [0074.262] RegQueryValueExW (in: hKey=0x1dc, lpValueName="BrowserUpdateCheck", lpReserved=0x0, lpType=0x0, lpData=0x19ef68, lpcbData=0x19ef64*=0x800 | out: lpType=0x0, lpData=0x19ef68*=0x0, lpcbData=0x19ef64*=0x800) returned 0x2 [0074.263] lstrcmpiW (lpString1="", lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned -1 [0074.263] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", Reserved=0x0, lpClass=0x0, dwOptions=0x1, samDesired=0x20006, lpSecurityAttributes=0x0, phkResult=0x19ef60, lpdwDisposition=0x0 | out: phkResult=0x19ef60*=0x200, lpdwDisposition=0x0) returned 0x0 [0074.264] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Local\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned 58 [0074.264] RegSetValueExW (in: hKey=0x200, lpValueName="BrowserUpdateCheck", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\%LOCALAPPDATA%SAMPLE.EXE.exe", cbData=0x74 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned 0x0 [0074.265] RegCloseKey (hKey=0x200) returned 0x0 [0074.266] GetProcessHeap () returned 0xd20000 [0074.266] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1000) returned 0xd413b8 [0074.266] GetEnvironmentVariableW (in: lpName="public", lpBuffer=0xd413b8, nSize=0x800 | out: lpBuffer="C:\\Users\\Public") returned 0xf [0074.266] GetProcessHeap () returned 0xd20000 [0074.266] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x98) returned 0xd31d90 [0074.266] GetProcessHeap () returned 0xd20000 [0074.266] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd326e0 [0074.266] GetProcessHeap () returned 0xd20000 [0074.266] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x42) returned 0xd26f40 [0074.266] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xd26f40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0074.266] GetProcessHeap () returned 0xd20000 [0074.266] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x82) returned 0xd31290 [0074.266] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xd26f40, cbMultiByte=-1, lpWideCharStr=0xd31290, cchWideChar=65 | out: lpWideCharStr="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 65 [0074.266] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0x4017e8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0074.266] GetProcessHeap () returned 0xd20000 [0074.266] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x22) returned 0xd34d08 [0074.266] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0x4017e8, cbMultiByte=-1, lpWideCharStr=0xd34d08, cchWideChar=17 | out: lpWideCharStr="HOW_RECOVER.html") returned 17 [0074.267] lstrcpyW (in: lpString1=0xd31d90, lpString2="HOW_RECOVER.html" | out: lpString1="HOW_RECOVER.html") returned="HOW_RECOVER.html" [0074.267] GetProcessHeap () returned 0xd20000 [0074.267] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1000) returned 0xd42bc8 [0074.267] lstrcpyW (in: lpString1=0xd42bc8, lpString2="C:\\Users\\Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0074.267] PathAddBackslashW (in: pszPath="C:\\Users\\Public" | out: pszPath="C:\\Users\\Public\\") returned="" [0074.267] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474" | out: lpString1="C:\\Users\\Public\\F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned="C:\\Users\\Public\\F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474" [0074.267] CreateFileW (lpFileName="C:\\Users\\Public\\F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474" (normalized: "c:\\users\\public\\f4b9e43e8b778fbd0715cce57f573ae11f3e1ba40b1ca4265c360a3997b1a474"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x200 [0074.272] GetLastError () returned 0x0 [0074.272] GetProcessHeap () returned 0xd20000 [0074.272] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x400) returned 0xd3cb98 [0074.273] lstrlenA (lpString="rsa_genkey") returned 10 [0074.273] CryptAcquireContextW (in: phProv=0x19f848, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x19f848*=0xd26760) returned 1 [0074.290] GetCurrentProcess () returned 0xffffffff [0074.498] GetCurrentProcess () returned 0xffffffff [0074.499] GetCurrentProcess () returned 0xffffffff [0074.500] GetCurrentProcess () returned 0xffffffff [0074.502] GetCurrentProcess () returned 0xffffffff [0074.504] GetCurrentProcess () returned 0xffffffff [0074.505] GetCurrentProcess () returned 0xffffffff [0074.528] GetCurrentProcess () returned 0xffffffff [0074.785] GetCurrentProcess () returned 0xffffffff [0074.786] GetCurrentProcess () returned 0xffffffff [0074.789] GetCurrentProcess () returned 0xffffffff [0074.806] GetCurrentProcess () returned 0xffffffff [0074.976] GetCurrentProcess () returned 0xffffffff [0074.977] GetCurrentProcess () returned 0xffffffff [0074.977] GetCurrentProcess () returned 0xffffffff [0074.979] GetCurrentProcess () returned 0xffffffff [0074.980] GetCurrentProcess () returned 0xffffffff [0074.988] GetCurrentProcess () returned 0xffffffff [0074.989] GetCurrentProcess () returned 0xffffffff [0074.990] CryptGenRandom (in: hProv=0xd26760, dwLen=0x80, pbBuffer=0x19f860 | out: pbBuffer=0x19f860) returned 1 [0074.990] CryptReleaseContext (hProv=0xd26760, dwFlags=0x0) returned 1 [0074.991] GetProcessHeap () returned 0xd20000 [0074.991] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd386a0 [0074.991] GetProcessHeap () returned 0xd20000 [0074.991] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x40) returned 0xd324e8 [0074.991] GetProcessHeap () returned 0xd20000 [0074.991] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x40) returned 0xd32770 [0074.991] GetProcessHeap () returned 0xd20000 [0074.991] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x40) returned 0xd32380 [0074.991] GetProcessHeap () returned 0xd20000 [0074.991] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x40) returned 0xd32218 [0074.991] GetProcessHeap () returned 0xd20000 [0074.991] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd44378 [0074.991] GetProcessHeap () returned 0xd20000 [0074.991] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd32218 | out: hHeap=0xd20000) returned 1 [0074.992] GetProcessHeap () returned 0xd20000 [0074.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd43fb8 [0074.992] GetProcessHeap () returned 0xd20000 [0074.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd30f70 [0074.992] GetProcessHeap () returned 0xd20000 [0074.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd386f0 [0074.992] GetProcessHeap () returned 0xd20000 [0074.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd328d8 [0074.992] GetProcessHeap () returned 0xd20000 [0074.992] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0074.992] GetProcessHeap () returned 0xd20000 [0074.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd31810 [0074.992] GetProcessHeap () returned 0xd20000 [0074.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x40) returned 0xd32218 [0074.992] GetProcessHeap () returned 0xd20000 [0074.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8c) returned 0xd2e688 [0074.993] GetProcessHeap () returned 0xd20000 [0074.993] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0074.993] GetProcessHeap () returned 0xd20000 [0074.993] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd3caf0 [0074.993] GetProcessHeap () returned 0xd20000 [0074.993] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd44058 [0074.993] GetProcessHeap () returned 0xd20000 [0074.993] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd32218 | out: hHeap=0xd20000) returned 1 [0074.993] GetProcessHeap () returned 0xd20000 [0074.993] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd31fe8 [0074.993] GetProcessHeap () returned 0xd20000 [0074.993] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44058 | out: hHeap=0xd20000) returned 1 [0074.993] GetProcessHeap () returned 0xd20000 [0074.993] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0074.993] GetProcessHeap () returned 0xd20000 [0074.993] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd3cb08 [0074.993] GetProcessHeap () returned 0xd20000 [0074.994] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0074.994] GetProcessHeap () returned 0xd20000 [0074.994] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0074.994] GetProcessHeap () returned 0xd20000 [0074.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0074.994] GetProcessHeap () returned 0xd20000 [0074.994] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0074.994] GetProcessHeap () returned 0xd20000 [0074.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x48) returned 0xd44198 [0074.994] GetProcessHeap () returned 0xd20000 [0074.994] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cb08 | out: hHeap=0xd20000) returned 1 [0074.994] GetProcessHeap () returned 0xd20000 [0074.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd31b00 [0074.994] GetProcessHeap () returned 0xd20000 [0074.994] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44198 | out: hHeap=0xd20000) returned 1 [0074.994] GetProcessHeap () returned 0xd20000 [0074.995] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0074.995] GetProcessHeap () returned 0xd20000 [0074.995] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0074.995] GetProcessHeap () returned 0xd20000 [0074.995] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0074.995] GetProcessHeap () returned 0xd20000 [0074.995] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0074.995] GetProcessHeap () returned 0xd20000 [0074.995] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0074.995] GetProcessHeap () returned 0xd20000 [0074.995] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0074.995] GetProcessHeap () returned 0xd20000 [0074.995] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0074.995] GetProcessHeap () returned 0xd20000 [0074.995] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0074.995] GetProcessHeap () returned 0xd20000 [0074.996] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0074.996] GetProcessHeap () returned 0xd20000 [0074.996] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0074.996] GetProcessHeap () returned 0xd20000 [0074.996] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0074.996] GetProcessHeap () returned 0xd20000 [0074.996] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0074.996] GetProcessHeap () returned 0xd20000 [0074.996] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0074.996] GetProcessHeap () returned 0xd20000 [0074.996] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0074.996] GetProcessHeap () returned 0xd20000 [0074.996] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0074.996] GetProcessHeap () returned 0xd20000 [0074.996] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0074.996] GetProcessHeap () returned 0xd20000 [0074.997] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0074.997] GetProcessHeap () returned 0xd20000 [0074.997] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0074.997] GetProcessHeap () returned 0xd20000 [0074.997] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0074.997] GetProcessHeap () returned 0xd20000 [0074.997] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0074.997] GetProcessHeap () returned 0xd20000 [0074.997] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0074.997] GetProcessHeap () returned 0xd20000 [0074.997] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0074.997] GetProcessHeap () returned 0xd20000 [0074.997] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0074.997] GetProcessHeap () returned 0xd20000 [0074.997] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0074.997] GetProcessHeap () returned 0xd20000 [0074.997] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0074.998] GetProcessHeap () returned 0xd20000 [0074.998] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0074.998] GetProcessHeap () returned 0xd20000 [0074.998] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0074.998] GetProcessHeap () returned 0xd20000 [0074.998] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0074.998] GetProcessHeap () returned 0xd20000 [0074.998] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0074.998] GetProcessHeap () returned 0xd20000 [0074.998] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0074.998] GetProcessHeap () returned 0xd20000 [0074.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0074.999] GetProcessHeap () returned 0xd20000 [0074.999] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0074.999] GetProcessHeap () returned 0xd20000 [0074.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0074.999] GetProcessHeap () returned 0xd20000 [0074.999] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0074.999] GetProcessHeap () returned 0xd20000 [0074.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.000] GetProcessHeap () returned 0xd20000 [0075.000] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.000] GetProcessHeap () returned 0xd20000 [0075.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.000] GetProcessHeap () returned 0xd20000 [0075.000] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.000] GetProcessHeap () returned 0xd20000 [0075.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.000] GetProcessHeap () returned 0xd20000 [0075.000] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.000] GetProcessHeap () returned 0xd20000 [0075.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.000] GetProcessHeap () returned 0xd20000 [0075.000] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.000] GetProcessHeap () returned 0xd20000 [0075.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.000] GetProcessHeap () returned 0xd20000 [0075.001] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.001] GetProcessHeap () returned 0xd20000 [0075.001] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.001] GetProcessHeap () returned 0xd20000 [0075.001] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.001] GetProcessHeap () returned 0xd20000 [0075.001] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31810 | out: hHeap=0xd20000) returned 1 [0075.001] GetProcessHeap () returned 0xd20000 [0075.001] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31fe8 | out: hHeap=0xd20000) returned 1 [0075.001] GetProcessHeap () returned 0xd20000 [0075.001] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2e688 | out: hHeap=0xd20000) returned 1 [0075.001] GetProcessHeap () returned 0xd20000 [0075.001] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31b00 | out: hHeap=0xd20000) returned 1 [0075.001] GetProcessHeap () returned 0xd20000 [0075.001] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3caf0 | out: hHeap=0xd20000) returned 1 [0075.001] GetProcessHeap () returned 0xd20000 [0075.001] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd440f8 [0075.001] GetProcessHeap () returned 0xd20000 [0075.001] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd44288 [0075.002] GetProcessHeap () returned 0xd20000 [0075.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd43d88 [0075.002] GetProcessHeap () returned 0xd20000 [0075.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd43bf8 [0075.002] GetProcessHeap () returned 0xd20000 [0075.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd441e8 [0075.002] GetProcessHeap () returned 0xd20000 [0075.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd43ec8 [0075.002] GetProcessHeap () returned 0xd20000 [0075.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd43f18 [0075.002] GetProcessHeap () returned 0xd20000 [0075.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd44058 [0075.002] GetProcessHeap () returned 0xd20000 [0075.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd442d8 [0075.002] GetProcessHeap () returned 0xd20000 [0075.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd43dd8 [0075.002] GetProcessHeap () returned 0xd20000 [0075.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd44198 [0075.002] GetProcessHeap () returned 0xd20000 [0075.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd44328 [0075.003] GetProcessHeap () returned 0xd20000 [0075.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd440a8 [0075.003] GetProcessHeap () returned 0xd20000 [0075.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd43ce8 [0075.003] GetProcessHeap () returned 0xd20000 [0075.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd43e28 [0075.003] GetProcessHeap () returned 0xd20000 [0075.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd44148 [0075.004] GetProcessHeap () returned 0xd20000 [0075.004] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd440f8 | out: hHeap=0xd20000) returned 1 [0075.004] GetProcessHeap () returned 0xd20000 [0075.004] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44288 | out: hHeap=0xd20000) returned 1 [0075.004] GetProcessHeap () returned 0xd20000 [0075.004] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43d88 | out: hHeap=0xd20000) returned 1 [0075.004] GetProcessHeap () returned 0xd20000 [0075.004] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43bf8 | out: hHeap=0xd20000) returned 1 [0075.004] GetProcessHeap () returned 0xd20000 [0075.004] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd441e8 | out: hHeap=0xd20000) returned 1 [0075.004] GetProcessHeap () returned 0xd20000 [0075.004] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43ec8 | out: hHeap=0xd20000) returned 1 [0075.004] GetProcessHeap () returned 0xd20000 [0075.004] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43f18 | out: hHeap=0xd20000) returned 1 [0075.004] GetProcessHeap () returned 0xd20000 [0075.004] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44058 | out: hHeap=0xd20000) returned 1 [0075.005] GetProcessHeap () returned 0xd20000 [0075.005] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd442d8 | out: hHeap=0xd20000) returned 1 [0075.005] GetProcessHeap () returned 0xd20000 [0075.005] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43dd8 | out: hHeap=0xd20000) returned 1 [0075.005] GetProcessHeap () returned 0xd20000 [0075.005] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44198 | out: hHeap=0xd20000) returned 1 [0075.005] GetProcessHeap () returned 0xd20000 [0075.005] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44328 | out: hHeap=0xd20000) returned 1 [0075.005] GetProcessHeap () returned 0xd20000 [0075.005] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd440a8 | out: hHeap=0xd20000) returned 1 [0075.005] GetProcessHeap () returned 0xd20000 [0075.005] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43ce8 | out: hHeap=0xd20000) returned 1 [0075.005] GetProcessHeap () returned 0xd20000 [0075.005] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43e28 | out: hHeap=0xd20000) returned 1 [0075.005] GetProcessHeap () returned 0xd20000 [0075.005] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44148 | out: hHeap=0xd20000) returned 1 [0075.005] GetProcessHeap () returned 0xd20000 [0075.005] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43fb8 | out: hHeap=0xd20000) returned 1 [0075.005] GetProcessHeap () returned 0xd20000 [0075.005] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd30f70 | out: hHeap=0xd20000) returned 1 [0075.006] GetProcessHeap () returned 0xd20000 [0075.006] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0075.006] GetProcessHeap () returned 0xd20000 [0075.006] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd30f70 [0075.006] GetProcessHeap () returned 0xd20000 [0075.006] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x40) returned 0xd32338 [0075.006] GetProcessHeap () returned 0xd20000 [0075.006] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd31810 [0075.006] GetProcessHeap () returned 0xd20000 [0075.006] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.006] GetProcessHeap () returned 0xd20000 [0075.006] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd3caf0 [0075.006] GetProcessHeap () returned 0xd20000 [0075.006] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd2e688 [0075.006] GetProcessHeap () returned 0xd20000 [0075.006] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd30f70 | out: hHeap=0xd20000) returned 1 [0075.006] GetProcessHeap () returned 0xd20000 [0075.006] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd44008 [0075.006] GetProcessHeap () returned 0xd20000 [0075.006] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd32338 | out: hHeap=0xd20000) returned 1 [0075.007] GetProcessHeap () returned 0xd20000 [0075.007] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd30f70 [0075.007] GetProcessHeap () returned 0xd20000 [0075.007] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44008 | out: hHeap=0xd20000) returned 1 [0075.007] GetProcessHeap () returned 0xd20000 [0075.007] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.007] GetProcessHeap () returned 0xd20000 [0075.007] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd3cb08 [0075.007] GetProcessHeap () returned 0xd20000 [0075.007] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.007] GetProcessHeap () returned 0xd20000 [0075.007] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.007] GetProcessHeap () returned 0xd20000 [0075.007] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x48) returned 0xd43c48 [0075.007] GetProcessHeap () returned 0xd20000 [0075.007] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cb08 | out: hHeap=0xd20000) returned 1 [0075.007] GetProcessHeap () returned 0xd20000 [0075.007] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd31b00 [0075.008] GetProcessHeap () returned 0xd20000 [0075.008] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43c48 | out: hHeap=0xd20000) returned 1 [0075.008] GetProcessHeap () returned 0xd20000 [0075.008] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.008] GetProcessHeap () returned 0xd20000 [0075.008] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.008] GetProcessHeap () returned 0xd20000 [0075.008] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.008] GetProcessHeap () returned 0xd20000 [0075.008] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.008] GetProcessHeap () returned 0xd20000 [0075.008] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.008] GetProcessHeap () returned 0xd20000 [0075.008] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.008] GetProcessHeap () returned 0xd20000 [0075.008] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.008] GetProcessHeap () returned 0xd20000 [0075.009] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.009] GetProcessHeap () returned 0xd20000 [0075.009] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.009] GetProcessHeap () returned 0xd20000 [0075.009] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.009] GetProcessHeap () returned 0xd20000 [0075.009] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.009] GetProcessHeap () returned 0xd20000 [0075.009] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.009] GetProcessHeap () returned 0xd20000 [0075.009] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.009] GetProcessHeap () returned 0xd20000 [0075.009] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.009] GetProcessHeap () returned 0xd20000 [0075.009] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.009] GetProcessHeap () returned 0xd20000 [0075.009] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.009] GetProcessHeap () returned 0xd20000 [0075.009] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.010] GetProcessHeap () returned 0xd20000 [0075.010] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.010] GetProcessHeap () returned 0xd20000 [0075.010] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.010] GetProcessHeap () returned 0xd20000 [0075.010] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.010] GetProcessHeap () returned 0xd20000 [0075.010] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.010] GetProcessHeap () returned 0xd20000 [0075.010] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.010] GetProcessHeap () returned 0xd20000 [0075.010] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.010] GetProcessHeap () returned 0xd20000 [0075.010] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.010] GetProcessHeap () returned 0xd20000 [0075.010] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.010] GetProcessHeap () returned 0xd20000 [0075.011] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.011] GetProcessHeap () returned 0xd20000 [0075.011] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.011] GetProcessHeap () returned 0xd20000 [0075.011] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.011] GetProcessHeap () returned 0xd20000 [0075.011] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.011] GetProcessHeap () returned 0xd20000 [0075.011] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.011] GetProcessHeap () returned 0xd20000 [0075.011] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.011] GetProcessHeap () returned 0xd20000 [0075.011] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.011] GetProcessHeap () returned 0xd20000 [0075.011] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.011] GetProcessHeap () returned 0xd20000 [0075.011] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.012] GetProcessHeap () returned 0xd20000 [0075.012] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.012] GetProcessHeap () returned 0xd20000 [0075.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.012] GetProcessHeap () returned 0xd20000 [0075.012] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.012] GetProcessHeap () returned 0xd20000 [0075.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.012] GetProcessHeap () returned 0xd20000 [0075.012] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.012] GetProcessHeap () returned 0xd20000 [0075.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.012] GetProcessHeap () returned 0xd20000 [0075.012] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.012] GetProcessHeap () returned 0xd20000 [0075.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.012] GetProcessHeap () returned 0xd20000 [0075.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2e688 | out: hHeap=0xd20000) returned 1 [0075.012] GetProcessHeap () returned 0xd20000 [0075.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd30f70 | out: hHeap=0xd20000) returned 1 [0075.013] GetProcessHeap () returned 0xd20000 [0075.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31810 | out: hHeap=0xd20000) returned 1 [0075.013] GetProcessHeap () returned 0xd20000 [0075.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31b00 | out: hHeap=0xd20000) returned 1 [0075.013] GetProcessHeap () returned 0xd20000 [0075.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3caf0 | out: hHeap=0xd20000) returned 1 [0075.013] GetProcessHeap () returned 0xd20000 [0075.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd32770 | out: hHeap=0xd20000) returned 1 [0075.013] GetProcessHeap () returned 0xd20000 [0075.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd32380 | out: hHeap=0xd20000) returned 1 [0075.013] GetProcessHeap () returned 0xd20000 [0075.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0075.013] GetProcessHeap () returned 0xd20000 [0075.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44378 | out: hHeap=0xd20000) returned 1 [0075.013] GetProcessHeap () returned 0xd20000 [0075.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd328d8 | out: hHeap=0xd20000) returned 1 [0075.013] GetProcessHeap () returned 0xd20000 [0075.013] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x40) returned 0xd32530 [0075.013] GetProcessHeap () returned 0xd20000 [0075.014] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x40) returned 0xd322a8 [0075.014] GetProcessHeap () returned 0xd20000 [0075.014] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x40) returned 0xd32770 [0075.077] GetProcessHeap () returned 0xd20000 [0075.077] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd43ce8 [0075.078] GetProcessHeap () returned 0xd20000 [0075.078] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd32770 | out: hHeap=0xd20000) returned 1 [0075.078] GetProcessHeap () returned 0xd20000 [0075.078] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd44058 [0075.078] GetProcessHeap () returned 0xd20000 [0075.078] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd30f70 [0075.078] GetProcessHeap () returned 0xd20000 [0075.078] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd386f0 [0075.078] GetProcessHeap () returned 0xd20000 [0075.078] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd328d8 [0075.078] GetProcessHeap () returned 0xd20000 [0075.078] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.078] GetProcessHeap () returned 0xd20000 [0075.078] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd31810 [0075.078] GetProcessHeap () returned 0xd20000 [0075.078] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x40) returned 0xd32770 [0075.078] GetProcessHeap () returned 0xd20000 [0075.078] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8c) returned 0xd2e688 [0075.078] GetProcessHeap () returned 0xd20000 [0075.078] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.079] GetProcessHeap () returned 0xd20000 [0075.079] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd3caf0 [0075.079] GetProcessHeap () returned 0xd20000 [0075.079] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd441e8 [0075.079] GetProcessHeap () returned 0xd20000 [0075.079] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd32770 | out: hHeap=0xd20000) returned 1 [0075.079] GetProcessHeap () returned 0xd20000 [0075.079] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd31b00 [0075.079] GetProcessHeap () returned 0xd20000 [0075.079] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd441e8 | out: hHeap=0xd20000) returned 1 [0075.079] GetProcessHeap () returned 0xd20000 [0075.079] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.079] GetProcessHeap () returned 0xd20000 [0075.079] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd3cb08 [0075.079] GetProcessHeap () returned 0xd20000 [0075.079] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.079] GetProcessHeap () returned 0xd20000 [0075.079] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.079] GetProcessHeap () returned 0xd20000 [0075.080] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.080] GetProcessHeap () returned 0xd20000 [0075.080] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.080] GetProcessHeap () returned 0xd20000 [0075.080] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x48) returned 0xd442d8 [0075.080] GetProcessHeap () returned 0xd20000 [0075.080] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cb08 | out: hHeap=0xd20000) returned 1 [0075.080] GetProcessHeap () returned 0xd20000 [0075.080] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd31fe8 [0075.080] GetProcessHeap () returned 0xd20000 [0075.080] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd442d8 | out: hHeap=0xd20000) returned 1 [0075.080] GetProcessHeap () returned 0xd20000 [0075.080] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.080] GetProcessHeap () returned 0xd20000 [0075.080] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.080] GetProcessHeap () returned 0xd20000 [0075.080] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.080] GetProcessHeap () returned 0xd20000 [0075.080] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.081] GetProcessHeap () returned 0xd20000 [0075.081] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.081] GetProcessHeap () returned 0xd20000 [0075.081] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.081] GetProcessHeap () returned 0xd20000 [0075.081] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.081] GetProcessHeap () returned 0xd20000 [0075.081] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.081] GetProcessHeap () returned 0xd20000 [0075.081] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.081] GetProcessHeap () returned 0xd20000 [0075.081] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.081] GetProcessHeap () returned 0xd20000 [0075.081] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.081] GetProcessHeap () returned 0xd20000 [0075.081] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.082] GetProcessHeap () returned 0xd20000 [0075.082] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.082] GetProcessHeap () returned 0xd20000 [0075.082] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.082] GetProcessHeap () returned 0xd20000 [0075.082] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.082] GetProcessHeap () returned 0xd20000 [0075.082] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.082] GetProcessHeap () returned 0xd20000 [0075.082] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.082] GetProcessHeap () returned 0xd20000 [0075.082] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.082] GetProcessHeap () returned 0xd20000 [0075.082] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.082] GetProcessHeap () returned 0xd20000 [0075.082] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.082] GetProcessHeap () returned 0xd20000 [0075.083] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.083] GetProcessHeap () returned 0xd20000 [0075.083] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.083] GetProcessHeap () returned 0xd20000 [0075.083] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.083] GetProcessHeap () returned 0xd20000 [0075.083] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.083] GetProcessHeap () returned 0xd20000 [0075.083] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.083] GetProcessHeap () returned 0xd20000 [0075.083] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.083] GetProcessHeap () returned 0xd20000 [0075.083] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.083] GetProcessHeap () returned 0xd20000 [0075.083] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.083] GetProcessHeap () returned 0xd20000 [0075.083] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.084] GetProcessHeap () returned 0xd20000 [0075.084] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.084] GetProcessHeap () returned 0xd20000 [0075.084] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.084] GetProcessHeap () returned 0xd20000 [0075.084] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.084] GetProcessHeap () returned 0xd20000 [0075.084] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.084] GetProcessHeap () returned 0xd20000 [0075.084] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.084] GetProcessHeap () returned 0xd20000 [0075.084] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.084] GetProcessHeap () returned 0xd20000 [0075.084] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.084] GetProcessHeap () returned 0xd20000 [0075.084] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.084] GetProcessHeap () returned 0xd20000 [0075.084] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.084] GetProcessHeap () returned 0xd20000 [0075.085] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.085] GetProcessHeap () returned 0xd20000 [0075.085] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.085] GetProcessHeap () returned 0xd20000 [0075.085] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.085] GetProcessHeap () returned 0xd20000 [0075.085] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.085] GetProcessHeap () returned 0xd20000 [0075.085] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.085] GetProcessHeap () returned 0xd20000 [0075.085] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.085] GetProcessHeap () returned 0xd20000 [0075.085] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.085] GetProcessHeap () returned 0xd20000 [0075.085] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.085] GetProcessHeap () returned 0xd20000 [0075.085] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31810 | out: hHeap=0xd20000) returned 1 [0075.085] GetProcessHeap () returned 0xd20000 [0075.086] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31b00 | out: hHeap=0xd20000) returned 1 [0075.086] GetProcessHeap () returned 0xd20000 [0075.086] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2e688 | out: hHeap=0xd20000) returned 1 [0075.086] GetProcessHeap () returned 0xd20000 [0075.086] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31fe8 | out: hHeap=0xd20000) returned 1 [0075.086] GetProcessHeap () returned 0xd20000 [0075.086] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3caf0 | out: hHeap=0xd20000) returned 1 [0075.086] GetProcessHeap () returned 0xd20000 [0075.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd43e28 [0075.086] GetProcessHeap () returned 0xd20000 [0075.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd440f8 [0075.086] GetProcessHeap () returned 0xd20000 [0075.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd43d88 [0075.086] GetProcessHeap () returned 0xd20000 [0075.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd442d8 [0075.086] GetProcessHeap () returned 0xd20000 [0075.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd44008 [0075.086] GetProcessHeap () returned 0xd20000 [0075.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd43d38 [0075.087] GetProcessHeap () returned 0xd20000 [0075.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd43bf8 [0075.087] GetProcessHeap () returned 0xd20000 [0075.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd44378 [0075.087] GetProcessHeap () returned 0xd20000 [0075.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd44148 [0075.087] GetProcessHeap () returned 0xd20000 [0075.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd44328 [0075.087] GetProcessHeap () returned 0xd20000 [0075.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd441e8 [0075.087] GetProcessHeap () returned 0xd20000 [0075.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd440a8 [0075.087] GetProcessHeap () returned 0xd20000 [0075.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd43f68 [0075.087] GetProcessHeap () returned 0xd20000 [0075.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd43c48 [0075.087] GetProcessHeap () returned 0xd20000 [0075.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd43f18 [0075.087] GetProcessHeap () returned 0xd20000 [0075.088] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd43fb8 [0075.088] GetProcessHeap () returned 0xd20000 [0075.088] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43e28 | out: hHeap=0xd20000) returned 1 [0075.088] GetProcessHeap () returned 0xd20000 [0075.088] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd440f8 | out: hHeap=0xd20000) returned 1 [0075.088] GetProcessHeap () returned 0xd20000 [0075.088] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43d88 | out: hHeap=0xd20000) returned 1 [0075.088] GetProcessHeap () returned 0xd20000 [0075.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd442d8 | out: hHeap=0xd20000) returned 1 [0075.089] GetProcessHeap () returned 0xd20000 [0075.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44008 | out: hHeap=0xd20000) returned 1 [0075.089] GetProcessHeap () returned 0xd20000 [0075.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43d38 | out: hHeap=0xd20000) returned 1 [0075.089] GetProcessHeap () returned 0xd20000 [0075.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43bf8 | out: hHeap=0xd20000) returned 1 [0075.089] GetProcessHeap () returned 0xd20000 [0075.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44378 | out: hHeap=0xd20000) returned 1 [0075.089] GetProcessHeap () returned 0xd20000 [0075.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44148 | out: hHeap=0xd20000) returned 1 [0075.089] GetProcessHeap () returned 0xd20000 [0075.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44328 | out: hHeap=0xd20000) returned 1 [0075.089] GetProcessHeap () returned 0xd20000 [0075.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd441e8 | out: hHeap=0xd20000) returned 1 [0075.089] GetProcessHeap () returned 0xd20000 [0075.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd440a8 | out: hHeap=0xd20000) returned 1 [0075.089] GetProcessHeap () returned 0xd20000 [0075.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43f68 | out: hHeap=0xd20000) returned 1 [0075.090] GetProcessHeap () returned 0xd20000 [0075.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43c48 | out: hHeap=0xd20000) returned 1 [0075.090] GetProcessHeap () returned 0xd20000 [0075.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43f18 | out: hHeap=0xd20000) returned 1 [0075.090] GetProcessHeap () returned 0xd20000 [0075.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43fb8 | out: hHeap=0xd20000) returned 1 [0075.090] GetProcessHeap () returned 0xd20000 [0075.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44058 | out: hHeap=0xd20000) returned 1 [0075.090] GetProcessHeap () returned 0xd20000 [0075.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd30f70 | out: hHeap=0xd20000) returned 1 [0075.090] GetProcessHeap () returned 0xd20000 [0075.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd32530 | out: hHeap=0xd20000) returned 1 [0075.090] GetProcessHeap () returned 0xd20000 [0075.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd322a8 | out: hHeap=0xd20000) returned 1 [0075.090] GetProcessHeap () returned 0xd20000 [0075.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43ce8 | out: hHeap=0xd20000) returned 1 [0075.090] GetProcessHeap () returned 0xd20000 [0075.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd328d8 | out: hHeap=0xd20000) returned 1 [0075.090] GetProcessHeap () returned 0xd20000 [0075.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x40) returned 0xd32380 [0075.091] GetProcessHeap () returned 0xd20000 [0075.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x40) returned 0xd32770 [0075.091] GetProcessHeap () returned 0xd20000 [0075.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x40) returned 0xd322f0 [0075.091] GetProcessHeap () returned 0xd20000 [0075.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd44238 [0075.091] GetProcessHeap () returned 0xd20000 [0075.091] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd322f0 | out: hHeap=0xd20000) returned 1 [0075.091] GetProcessHeap () returned 0xd20000 [0075.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd441e8 [0075.091] GetProcessHeap () returned 0xd20000 [0075.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd30f70 [0075.091] GetProcessHeap () returned 0xd20000 [0075.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd386f0 [0075.091] GetProcessHeap () returned 0xd20000 [0075.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd328d8 [0075.091] GetProcessHeap () returned 0xd20000 [0075.091] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.091] GetProcessHeap () returned 0xd20000 [0075.092] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd31810 [0075.092] GetProcessHeap () returned 0xd20000 [0075.092] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x40) returned 0xd32218 [0075.092] GetProcessHeap () returned 0xd20000 [0075.092] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8c) returned 0xd2e688 [0075.092] GetProcessHeap () returned 0xd20000 [0075.093] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.093] GetProcessHeap () returned 0xd20000 [0075.093] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd3cb20 [0075.093] GetProcessHeap () returned 0xd20000 [0075.093] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd440a8 [0075.093] GetProcessHeap () returned 0xd20000 [0075.093] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd32218 | out: hHeap=0xd20000) returned 1 [0075.093] GetProcessHeap () returned 0xd20000 [0075.093] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd31fe8 [0075.093] GetProcessHeap () returned 0xd20000 [0075.093] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd440a8 | out: hHeap=0xd20000) returned 1 [0075.093] GetProcessHeap () returned 0xd20000 [0075.093] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.094] GetProcessHeap () returned 0xd20000 [0075.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd3caf0 [0075.094] GetProcessHeap () returned 0xd20000 [0075.094] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.094] GetProcessHeap () returned 0xd20000 [0075.094] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.094] GetProcessHeap () returned 0xd20000 [0075.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.094] GetProcessHeap () returned 0xd20000 [0075.094] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.094] GetProcessHeap () returned 0xd20000 [0075.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x48) returned 0xd442d8 [0075.094] GetProcessHeap () returned 0xd20000 [0075.094] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3caf0 | out: hHeap=0xd20000) returned 1 [0075.094] GetProcessHeap () returned 0xd20000 [0075.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd31b00 [0075.094] GetProcessHeap () returned 0xd20000 [0075.094] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd442d8 | out: hHeap=0xd20000) returned 1 [0075.094] GetProcessHeap () returned 0xd20000 [0075.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.095] GetProcessHeap () returned 0xd20000 [0075.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.095] GetProcessHeap () returned 0xd20000 [0075.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.095] GetProcessHeap () returned 0xd20000 [0075.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.095] GetProcessHeap () returned 0xd20000 [0075.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.095] GetProcessHeap () returned 0xd20000 [0075.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.095] GetProcessHeap () returned 0xd20000 [0075.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.095] GetProcessHeap () returned 0xd20000 [0075.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.095] GetProcessHeap () returned 0xd20000 [0075.096] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.096] GetProcessHeap () returned 0xd20000 [0075.096] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.096] GetProcessHeap () returned 0xd20000 [0075.096] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.096] GetProcessHeap () returned 0xd20000 [0075.096] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.096] GetProcessHeap () returned 0xd20000 [0075.096] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.096] GetProcessHeap () returned 0xd20000 [0075.096] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.096] GetProcessHeap () returned 0xd20000 [0075.096] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.096] GetProcessHeap () returned 0xd20000 [0075.096] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.096] GetProcessHeap () returned 0xd20000 [0075.096] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.096] GetProcessHeap () returned 0xd20000 [0075.097] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.097] GetProcessHeap () returned 0xd20000 [0075.097] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.097] GetProcessHeap () returned 0xd20000 [0075.097] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.097] GetProcessHeap () returned 0xd20000 [0075.097] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.097] GetProcessHeap () returned 0xd20000 [0075.097] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.097] GetProcessHeap () returned 0xd20000 [0075.097] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.097] GetProcessHeap () returned 0xd20000 [0075.097] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.097] GetProcessHeap () returned 0xd20000 [0075.097] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.098] GetProcessHeap () returned 0xd20000 [0075.098] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.098] GetProcessHeap () returned 0xd20000 [0075.098] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.098] GetProcessHeap () returned 0xd20000 [0075.098] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.098] GetProcessHeap () returned 0xd20000 [0075.098] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.098] GetProcessHeap () returned 0xd20000 [0075.098] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.098] GetProcessHeap () returned 0xd20000 [0075.098] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.098] GetProcessHeap () returned 0xd20000 [0075.098] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.098] GetProcessHeap () returned 0xd20000 [0075.098] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.098] GetProcessHeap () returned 0xd20000 [0075.099] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.099] GetProcessHeap () returned 0xd20000 [0075.099] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.099] GetProcessHeap () returned 0xd20000 [0075.099] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.099] GetProcessHeap () returned 0xd20000 [0075.099] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.099] GetProcessHeap () returned 0xd20000 [0075.099] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.099] GetProcessHeap () returned 0xd20000 [0075.099] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.099] GetProcessHeap () returned 0xd20000 [0075.099] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.099] GetProcessHeap () returned 0xd20000 [0075.099] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.099] GetProcessHeap () returned 0xd20000 [0075.099] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.100] GetProcessHeap () returned 0xd20000 [0075.100] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.100] GetProcessHeap () returned 0xd20000 [0075.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.100] GetProcessHeap () returned 0xd20000 [0075.100] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.100] GetProcessHeap () returned 0xd20000 [0075.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.100] GetProcessHeap () returned 0xd20000 [0075.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31810 | out: hHeap=0xd20000) returned 1 [0075.100] GetProcessHeap () returned 0xd20000 [0075.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31fe8 | out: hHeap=0xd20000) returned 1 [0075.100] GetProcessHeap () returned 0xd20000 [0075.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2e688 | out: hHeap=0xd20000) returned 1 [0075.100] GetProcessHeap () returned 0xd20000 [0075.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31b00 | out: hHeap=0xd20000) returned 1 [0075.100] GetProcessHeap () returned 0xd20000 [0075.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cb20 | out: hHeap=0xd20000) returned 1 [0075.101] GetProcessHeap () returned 0xd20000 [0075.101] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd44288 [0075.101] GetProcessHeap () returned 0xd20000 [0075.101] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd442d8 [0075.101] GetProcessHeap () returned 0xd20000 [0075.101] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd44058 [0075.101] GetProcessHeap () returned 0xd20000 [0075.101] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd44148 [0075.101] GetProcessHeap () returned 0xd20000 [0075.101] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd43fb8 [0075.101] GetProcessHeap () returned 0xd20000 [0075.101] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd43d88 [0075.101] GetProcessHeap () returned 0xd20000 [0075.101] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd43c48 [0075.101] GetProcessHeap () returned 0xd20000 [0075.101] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd43c98 [0075.101] GetProcessHeap () returned 0xd20000 [0075.101] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd43e28 [0075.101] GetProcessHeap () returned 0xd20000 [0075.102] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd440f8 [0075.102] GetProcessHeap () returned 0xd20000 [0075.102] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd44198 [0075.102] GetProcessHeap () returned 0xd20000 [0075.102] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd43bf8 [0075.102] GetProcessHeap () returned 0xd20000 [0075.102] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd43dd8 [0075.102] GetProcessHeap () returned 0xd20000 [0075.102] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd44328 [0075.102] GetProcessHeap () returned 0xd20000 [0075.102] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd43ce8 [0075.102] GetProcessHeap () returned 0xd20000 [0075.102] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd43e78 [0075.103] GetProcessHeap () returned 0xd20000 [0075.103] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44288 | out: hHeap=0xd20000) returned 1 [0075.103] GetProcessHeap () returned 0xd20000 [0075.103] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd442d8 | out: hHeap=0xd20000) returned 1 [0075.103] GetProcessHeap () returned 0xd20000 [0075.103] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44058 | out: hHeap=0xd20000) returned 1 [0075.103] GetProcessHeap () returned 0xd20000 [0075.103] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44148 | out: hHeap=0xd20000) returned 1 [0075.103] GetProcessHeap () returned 0xd20000 [0075.103] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43fb8 | out: hHeap=0xd20000) returned 1 [0075.103] GetProcessHeap () returned 0xd20000 [0075.103] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43d88 | out: hHeap=0xd20000) returned 1 [0075.103] GetProcessHeap () returned 0xd20000 [0075.103] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43c48 | out: hHeap=0xd20000) returned 1 [0075.104] GetProcessHeap () returned 0xd20000 [0075.104] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43c98 | out: hHeap=0xd20000) returned 1 [0075.104] GetProcessHeap () returned 0xd20000 [0075.104] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43e28 | out: hHeap=0xd20000) returned 1 [0075.104] GetProcessHeap () returned 0xd20000 [0075.104] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd440f8 | out: hHeap=0xd20000) returned 1 [0075.104] GetProcessHeap () returned 0xd20000 [0075.104] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44198 | out: hHeap=0xd20000) returned 1 [0075.104] GetProcessHeap () returned 0xd20000 [0075.104] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43bf8 | out: hHeap=0xd20000) returned 1 [0075.104] GetProcessHeap () returned 0xd20000 [0075.104] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43dd8 | out: hHeap=0xd20000) returned 1 [0075.104] GetProcessHeap () returned 0xd20000 [0075.104] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44328 | out: hHeap=0xd20000) returned 1 [0075.104] GetProcessHeap () returned 0xd20000 [0075.104] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43ce8 | out: hHeap=0xd20000) returned 1 [0075.104] GetProcessHeap () returned 0xd20000 [0075.104] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43e78 | out: hHeap=0xd20000) returned 1 [0075.105] GetProcessHeap () returned 0xd20000 [0075.105] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd441e8 | out: hHeap=0xd20000) returned 1 [0075.105] GetProcessHeap () returned 0xd20000 [0075.105] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd30f70 | out: hHeap=0xd20000) returned 1 [0075.105] GetProcessHeap () returned 0xd20000 [0075.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0075.105] GetProcessHeap () returned 0xd20000 [0075.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd30f70 [0075.105] GetProcessHeap () returned 0xd20000 [0075.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x40) returned 0xd32218 [0075.105] GetProcessHeap () returned 0xd20000 [0075.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd31810 [0075.105] GetProcessHeap () returned 0xd20000 [0075.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.105] GetProcessHeap () returned 0xd20000 [0075.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd3caf0 [0075.105] GetProcessHeap () returned 0xd20000 [0075.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd2e688 [0075.105] GetProcessHeap () returned 0xd20000 [0075.106] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd30f70 | out: hHeap=0xd20000) returned 1 [0075.106] GetProcessHeap () returned 0xd20000 [0075.106] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x44) returned 0xd44378 [0075.106] GetProcessHeap () returned 0xd20000 [0075.106] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd32218 | out: hHeap=0xd20000) returned 1 [0075.106] GetProcessHeap () returned 0xd20000 [0075.106] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd30f70 [0075.106] GetProcessHeap () returned 0xd20000 [0075.106] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44378 | out: hHeap=0xd20000) returned 1 [0075.106] GetProcessHeap () returned 0xd20000 [0075.106] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.106] GetProcessHeap () returned 0xd20000 [0075.106] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd3cb08 [0075.106] GetProcessHeap () returned 0xd20000 [0075.106] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.106] GetProcessHeap () returned 0xd20000 [0075.106] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.106] GetProcessHeap () returned 0xd20000 [0075.107] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x48) returned 0xd440a8 [0075.107] GetProcessHeap () returned 0xd20000 [0075.107] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cb08 | out: hHeap=0xd20000) returned 1 [0075.107] GetProcessHeap () returned 0xd20000 [0075.107] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd31b00 [0075.107] GetProcessHeap () returned 0xd20000 [0075.107] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd440a8 | out: hHeap=0xd20000) returned 1 [0075.107] GetProcessHeap () returned 0xd20000 [0075.107] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.107] GetProcessHeap () returned 0xd20000 [0075.107] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.107] GetProcessHeap () returned 0xd20000 [0075.107] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.107] GetProcessHeap () returned 0xd20000 [0075.107] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.108] GetProcessHeap () returned 0xd20000 [0075.108] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.108] GetProcessHeap () returned 0xd20000 [0075.108] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.108] GetProcessHeap () returned 0xd20000 [0075.108] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.108] GetProcessHeap () returned 0xd20000 [0075.108] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.108] GetProcessHeap () returned 0xd20000 [0075.108] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.108] GetProcessHeap () returned 0xd20000 [0075.108] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.108] GetProcessHeap () returned 0xd20000 [0075.108] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.109] GetProcessHeap () returned 0xd20000 [0075.109] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.109] GetProcessHeap () returned 0xd20000 [0075.109] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.109] GetProcessHeap () returned 0xd20000 [0075.109] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.109] GetProcessHeap () returned 0xd20000 [0075.109] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.109] GetProcessHeap () returned 0xd20000 [0075.109] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.109] GetProcessHeap () returned 0xd20000 [0075.109] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.109] GetProcessHeap () returned 0xd20000 [0075.109] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.109] GetProcessHeap () returned 0xd20000 [0075.109] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.109] GetProcessHeap () returned 0xd20000 [0075.110] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.110] GetProcessHeap () returned 0xd20000 [0075.110] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.110] GetProcessHeap () returned 0xd20000 [0075.110] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.110] GetProcessHeap () returned 0xd20000 [0075.110] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.110] GetProcessHeap () returned 0xd20000 [0075.110] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.110] GetProcessHeap () returned 0xd20000 [0075.110] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.110] GetProcessHeap () returned 0xd20000 [0075.110] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.110] GetProcessHeap () returned 0xd20000 [0075.110] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.110] GetProcessHeap () returned 0xd20000 [0075.110] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.111] GetProcessHeap () returned 0xd20000 [0075.111] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.111] GetProcessHeap () returned 0xd20000 [0075.111] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.111] GetProcessHeap () returned 0xd20000 [0075.111] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.111] GetProcessHeap () returned 0xd20000 [0075.111] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.111] GetProcessHeap () returned 0xd20000 [0075.111] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.111] GetProcessHeap () returned 0xd20000 [0075.111] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.111] GetProcessHeap () returned 0xd20000 [0075.111] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.111] GetProcessHeap () returned 0xd20000 [0075.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.112] GetProcessHeap () returned 0xd20000 [0075.112] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.112] GetProcessHeap () returned 0xd20000 [0075.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.112] GetProcessHeap () returned 0xd20000 [0075.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2e688 | out: hHeap=0xd20000) returned 1 [0075.112] GetProcessHeap () returned 0xd20000 [0075.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd30f70 | out: hHeap=0xd20000) returned 1 [0075.112] GetProcessHeap () returned 0xd20000 [0075.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31810 | out: hHeap=0xd20000) returned 1 [0075.112] GetProcessHeap () returned 0xd20000 [0075.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31b00 | out: hHeap=0xd20000) returned 1 [0075.112] GetProcessHeap () returned 0xd20000 [0075.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3caf0 | out: hHeap=0xd20000) returned 1 [0075.112] GetProcessHeap () returned 0xd20000 [0075.112] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd30f70 [0075.112] GetProcessHeap () returned 0xd20000 [0075.112] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x40) returned 0xd32530 [0075.112] GetProcessHeap () returned 0xd20000 [0075.113] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd31810 [0075.113] GetProcessHeap () returned 0xd20000 [0075.113] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd386f0 [0075.218] GetProcessHeap () returned 0xd20000 [0075.218] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44058 | out: hHeap=0xd20000) returned 1 [0075.218] GetProcessHeap () returned 0xd20000 [0075.218] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43f18 | out: hHeap=0xd20000) returned 1 [0075.218] GetProcessHeap () returned 0xd20000 [0075.218] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44328 | out: hHeap=0xd20000) returned 1 [0075.218] GetProcessHeap () returned 0xd20000 [0075.218] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43e78 | out: hHeap=0xd20000) returned 1 [0075.218] GetProcessHeap () returned 0xd20000 [0075.218] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43f68 | out: hHeap=0xd20000) returned 1 [0075.218] GetProcessHeap () returned 0xd20000 [0075.218] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43d38 | out: hHeap=0xd20000) returned 1 [0075.218] GetProcessHeap () returned 0xd20000 [0075.218] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44148 | out: hHeap=0xd20000) returned 1 [0075.218] GetProcessHeap () returned 0xd20000 [0075.219] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43ce8 | out: hHeap=0xd20000) returned 1 [0075.219] GetProcessHeap () returned 0xd20000 [0075.219] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44288 | out: hHeap=0xd20000) returned 1 [0075.219] GetProcessHeap () returned 0xd20000 [0075.219] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd441e8 | out: hHeap=0xd20000) returned 1 [0075.219] GetProcessHeap () returned 0xd20000 [0075.219] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43e28 | out: hHeap=0xd20000) returned 1 [0075.368] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0075.368] WriteFile (in: hFile=0x200, lpBuffer=0xd3d3f0*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x19faf4, lpOverlapped=0x0 | out: lpBuffer=0xd3d3f0*, lpNumberOfBytesWritten=0x19faf4*=0x102, lpOverlapped=0x0) returned 1 [0075.370] GetProcessHeap () returned 0xd20000 [0075.370] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd45590 [0075.370] GetProcessHeap () returned 0xd20000 [0075.370] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd451e8 [0075.371] GetProcessHeap () returned 0xd20000 [0075.371] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc0) returned 0xd31810 [0075.371] lstrlenA (lpString="rsa_encrypt") returned 11 [0075.371] CryptAcquireContextW (in: phProv=0x19f038, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x19f038*=0xd30f70) returned 1 [0075.373] CryptGenRandom (in: hProv=0xd30f70, dwLen=0x80, pbBuffer=0x19f050 | out: pbBuffer=0x19f050) returned 1 [0075.373] CryptReleaseContext (hProv=0xd30f70, dwFlags=0x0) returned 1 [0075.373] lstrlenA (lpString="BF0F066679C120B3FB4711596F397EC5E50F23220017E2266BA4386E33CCD370966A14C4616ADF21ADFEA16694A1CDBCE529100453571CF7C13FEDCCE6B4F6DF653C2967D7E4A5252E96B8FBF6862505DA1B50FA00A11EE4B826A01527E3C03BE7DDC87196273B9C3C5DE0FB651E2117A724C4D9CA7E9A1F347332E3A5C2463E5A463F013CC67BA3DF8EA7938773474AD8E6D9BB984308F8E63A80A0AB1B03FD4FFD61DF763AA3775487DE057AF6A63C11F9EAFACD08CA9C51F7485CC398891E9E07448BF67E290638B7A35FC07A152945C1452C50741F0E4DE45FF46106A65FFB6AB25726A3EDDE521AB20EEA8BCCA7F204867443EAA1F5E96E815B4759B745") returned 512 [0075.374] GetProcessHeap () returned 0xd20000 [0075.374] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x100) returned 0xd31c30 [0075.374] lstrlenA (lpString="010001") returned 6 [0075.374] GetProcessHeap () returned 0xd20000 [0075.374] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd386f0 [0075.374] GetProcessHeap () returned 0xd20000 [0075.374] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x100) returned 0xd31998 [0075.374] GetProcessHeap () returned 0xd20000 [0075.375] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd2fbe0 [0075.375] GetProcessHeap () returned 0xd20000 [0075.375] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31998 | out: hHeap=0xd20000) returned 1 [0075.375] GetProcessHeap () returned 0xd20000 [0075.375] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd31998 [0075.375] GetProcessHeap () returned 0xd20000 [0075.375] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x208) returned 0xd3b850 [0075.375] GetProcessHeap () returned 0xd20000 [0075.375] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd38700 [0075.375] GetProcessHeap () returned 0xd20000 [0075.375] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x204) returned 0xd45be8 [0075.375] GetProcessHeap () returned 0xd20000 [0075.375] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.375] GetProcessHeap () returned 0xd20000 [0075.375] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x204) returned 0xd45df8 [0075.375] GetProcessHeap () returned 0xd20000 [0075.375] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x100) returned 0xd2f9c0 [0075.375] GetProcessHeap () returned 0xd20000 [0075.375] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20c) returned 0xd46008 [0075.375] GetProcessHeap () returned 0xd20000 [0075.375] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.376] GetProcessHeap () returned 0xd20000 [0075.376] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd3cb20 [0075.376] GetProcessHeap () returned 0xd20000 [0075.376] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd2f6e8 [0075.376] GetProcessHeap () returned 0xd20000 [0075.376] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f9c0 | out: hHeap=0xd20000) returned 1 [0075.376] GetProcessHeap () returned 0xd20000 [0075.376] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x204) returned 0xd46220 [0075.376] GetProcessHeap () returned 0xd20000 [0075.376] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f6e8 | out: hHeap=0xd20000) returned 1 [0075.376] GetProcessHeap () returned 0xd20000 [0075.376] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd44428 [0075.376] GetProcessHeap () returned 0xd20000 [0075.376] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd3caf0 [0075.376] GetProcessHeap () returned 0xd20000 [0075.376] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.376] GetProcessHeap () returned 0xd20000 [0075.376] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44428 | out: hHeap=0xd20000) returned 1 [0075.376] GetProcessHeap () returned 0xd20000 [0075.376] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd2f9c0 [0075.377] GetProcessHeap () returned 0xd20000 [0075.377] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3caf0 | out: hHeap=0xd20000) returned 1 [0075.377] GetProcessHeap () returned 0xd20000 [0075.377] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x204) returned 0xd46430 [0075.377] GetProcessHeap () returned 0xd20000 [0075.377] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f9c0 | out: hHeap=0xd20000) returned 1 [0075.377] GetProcessHeap () returned 0xd20000 [0075.377] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.377] GetProcessHeap () returned 0xd20000 [0075.377] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.377] GetProcessHeap () returned 0xd20000 [0075.377] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.377] GetProcessHeap () returned 0xd20000 [0075.377] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.377] GetProcessHeap () returned 0xd20000 [0075.377] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.377] GetProcessHeap () returned 0xd20000 [0075.377] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.378] GetProcessHeap () returned 0xd20000 [0075.378] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.378] GetProcessHeap () returned 0xd20000 [0075.378] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.378] GetProcessHeap () returned 0xd20000 [0075.378] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.378] GetProcessHeap () returned 0xd20000 [0075.378] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.378] GetProcessHeap () returned 0xd20000 [0075.378] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.378] GetProcessHeap () returned 0xd20000 [0075.378] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.378] GetProcessHeap () returned 0xd20000 [0075.378] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.378] GetProcessHeap () returned 0xd20000 [0075.378] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.378] GetProcessHeap () returned 0xd20000 [0075.378] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.378] GetProcessHeap () returned 0xd20000 [0075.379] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.379] GetProcessHeap () returned 0xd20000 [0075.379] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.379] GetProcessHeap () returned 0xd20000 [0075.379] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.379] GetProcessHeap () returned 0xd20000 [0075.379] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.379] GetProcessHeap () returned 0xd20000 [0075.379] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.379] GetProcessHeap () returned 0xd20000 [0075.379] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.379] GetProcessHeap () returned 0xd20000 [0075.379] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.379] GetProcessHeap () returned 0xd20000 [0075.379] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.379] GetProcessHeap () returned 0xd20000 [0075.379] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.380] GetProcessHeap () returned 0xd20000 [0075.380] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.380] GetProcessHeap () returned 0xd20000 [0075.380] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.380] GetProcessHeap () returned 0xd20000 [0075.380] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.380] GetProcessHeap () returned 0xd20000 [0075.380] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.380] GetProcessHeap () returned 0xd20000 [0075.380] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.380] GetProcessHeap () returned 0xd20000 [0075.380] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.380] GetProcessHeap () returned 0xd20000 [0075.380] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.380] GetProcessHeap () returned 0xd20000 [0075.380] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.380] GetProcessHeap () returned 0xd20000 [0075.380] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.380] GetProcessHeap () returned 0xd20000 [0075.381] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.381] GetProcessHeap () returned 0xd20000 [0075.381] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.381] GetProcessHeap () returned 0xd20000 [0075.381] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.381] GetProcessHeap () returned 0xd20000 [0075.381] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.381] GetProcessHeap () returned 0xd20000 [0075.381] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.381] GetProcessHeap () returned 0xd20000 [0075.381] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.381] GetProcessHeap () returned 0xd20000 [0075.381] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.381] GetProcessHeap () returned 0xd20000 [0075.381] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.381] GetProcessHeap () returned 0xd20000 [0075.381] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.381] GetProcessHeap () returned 0xd20000 [0075.381] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.382] GetProcessHeap () returned 0xd20000 [0075.382] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.382] GetProcessHeap () returned 0xd20000 [0075.382] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.382] GetProcessHeap () returned 0xd20000 [0075.382] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.382] GetProcessHeap () returned 0xd20000 [0075.382] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.382] GetProcessHeap () returned 0xd20000 [0075.382] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.382] GetProcessHeap () returned 0xd20000 [0075.382] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.382] GetProcessHeap () returned 0xd20000 [0075.382] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.382] GetProcessHeap () returned 0xd20000 [0075.382] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.382] GetProcessHeap () returned 0xd20000 [0075.382] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.383] GetProcessHeap () returned 0xd20000 [0075.383] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.383] GetProcessHeap () returned 0xd20000 [0075.383] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.383] GetProcessHeap () returned 0xd20000 [0075.383] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.383] GetProcessHeap () returned 0xd20000 [0075.383] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.383] GetProcessHeap () returned 0xd20000 [0075.383] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.383] GetProcessHeap () returned 0xd20000 [0075.383] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.383] GetProcessHeap () returned 0xd20000 [0075.383] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.383] GetProcessHeap () returned 0xd20000 [0075.383] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.383] GetProcessHeap () returned 0xd20000 [0075.383] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.383] GetProcessHeap () returned 0xd20000 [0075.384] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.384] GetProcessHeap () returned 0xd20000 [0075.384] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.384] GetProcessHeap () returned 0xd20000 [0075.384] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.384] GetProcessHeap () returned 0xd20000 [0075.384] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.384] GetProcessHeap () returned 0xd20000 [0075.384] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.384] GetProcessHeap () returned 0xd20000 [0075.384] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.384] GetProcessHeap () returned 0xd20000 [0075.384] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.384] GetProcessHeap () returned 0xd20000 [0075.384] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.384] GetProcessHeap () returned 0xd20000 [0075.384] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.384] GetProcessHeap () returned 0xd20000 [0075.384] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.385] GetProcessHeap () returned 0xd20000 [0075.385] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.385] GetProcessHeap () returned 0xd20000 [0075.385] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.385] GetProcessHeap () returned 0xd20000 [0075.385] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.385] GetProcessHeap () returned 0xd20000 [0075.385] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.385] GetProcessHeap () returned 0xd20000 [0075.385] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.385] GetProcessHeap () returned 0xd20000 [0075.385] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.385] GetProcessHeap () returned 0xd20000 [0075.385] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.385] GetProcessHeap () returned 0xd20000 [0075.385] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.385] GetProcessHeap () returned 0xd20000 [0075.385] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.386] GetProcessHeap () returned 0xd20000 [0075.386] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.386] GetProcessHeap () returned 0xd20000 [0075.386] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.386] GetProcessHeap () returned 0xd20000 [0075.386] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.386] GetProcessHeap () returned 0xd20000 [0075.386] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.386] GetProcessHeap () returned 0xd20000 [0075.386] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.386] GetProcessHeap () returned 0xd20000 [0075.386] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.386] GetProcessHeap () returned 0xd20000 [0075.386] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.386] GetProcessHeap () returned 0xd20000 [0075.386] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.386] GetProcessHeap () returned 0xd20000 [0075.386] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.386] GetProcessHeap () returned 0xd20000 [0075.386] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.387] GetProcessHeap () returned 0xd20000 [0075.387] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.387] GetProcessHeap () returned 0xd20000 [0075.387] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.387] GetProcessHeap () returned 0xd20000 [0075.387] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.387] GetProcessHeap () returned 0xd20000 [0075.387] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.387] GetProcessHeap () returned 0xd20000 [0075.387] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.387] GetProcessHeap () returned 0xd20000 [0075.387] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.387] GetProcessHeap () returned 0xd20000 [0075.387] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.387] GetProcessHeap () returned 0xd20000 [0075.387] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.387] GetProcessHeap () returned 0xd20000 [0075.387] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.388] GetProcessHeap () returned 0xd20000 [0075.388] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.388] GetProcessHeap () returned 0xd20000 [0075.388] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.388] GetProcessHeap () returned 0xd20000 [0075.388] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.388] GetProcessHeap () returned 0xd20000 [0075.388] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.388] GetProcessHeap () returned 0xd20000 [0075.388] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.388] GetProcessHeap () returned 0xd20000 [0075.388] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.388] GetProcessHeap () returned 0xd20000 [0075.388] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.388] GetProcessHeap () returned 0xd20000 [0075.388] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.388] GetProcessHeap () returned 0xd20000 [0075.388] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.388] GetProcessHeap () returned 0xd20000 [0075.389] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.389] GetProcessHeap () returned 0xd20000 [0075.389] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.389] GetProcessHeap () returned 0xd20000 [0075.389] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.389] GetProcessHeap () returned 0xd20000 [0075.389] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.389] GetProcessHeap () returned 0xd20000 [0075.389] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.389] GetProcessHeap () returned 0xd20000 [0075.389] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.389] GetProcessHeap () returned 0xd20000 [0075.389] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.389] GetProcessHeap () returned 0xd20000 [0075.389] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.389] GetProcessHeap () returned 0xd20000 [0075.390] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.390] GetProcessHeap () returned 0xd20000 [0075.390] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.390] GetProcessHeap () returned 0xd20000 [0075.390] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.390] GetProcessHeap () returned 0xd20000 [0075.390] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.390] GetProcessHeap () returned 0xd20000 [0075.390] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.390] GetProcessHeap () returned 0xd20000 [0075.390] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.390] GetProcessHeap () returned 0xd20000 [0075.390] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.390] GetProcessHeap () returned 0xd20000 [0075.390] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.390] GetProcessHeap () returned 0xd20000 [0075.390] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.390] GetProcessHeap () returned 0xd20000 [0075.390] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.391] GetProcessHeap () returned 0xd20000 [0075.391] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.391] GetProcessHeap () returned 0xd20000 [0075.391] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.391] GetProcessHeap () returned 0xd20000 [0075.391] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.391] GetProcessHeap () returned 0xd20000 [0075.391] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.391] GetProcessHeap () returned 0xd20000 [0075.391] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.391] GetProcessHeap () returned 0xd20000 [0075.391] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.391] GetProcessHeap () returned 0xd20000 [0075.391] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.391] GetProcessHeap () returned 0xd20000 [0075.391] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.391] GetProcessHeap () returned 0xd20000 [0075.391] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.392] GetProcessHeap () returned 0xd20000 [0075.392] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.392] GetProcessHeap () returned 0xd20000 [0075.392] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.392] GetProcessHeap () returned 0xd20000 [0075.392] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.392] GetProcessHeap () returned 0xd20000 [0075.392] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.392] GetProcessHeap () returned 0xd20000 [0075.392] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.392] GetProcessHeap () returned 0xd20000 [0075.392] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.392] GetProcessHeap () returned 0xd20000 [0075.392] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.392] GetProcessHeap () returned 0xd20000 [0075.392] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.392] GetProcessHeap () returned 0xd20000 [0075.392] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.393] GetProcessHeap () returned 0xd20000 [0075.393] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.393] GetProcessHeap () returned 0xd20000 [0075.393] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.393] GetProcessHeap () returned 0xd20000 [0075.393] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.393] GetProcessHeap () returned 0xd20000 [0075.393] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.393] GetProcessHeap () returned 0xd20000 [0075.393] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.393] GetProcessHeap () returned 0xd20000 [0075.393] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.393] GetProcessHeap () returned 0xd20000 [0075.393] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.393] GetProcessHeap () returned 0xd20000 [0075.393] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.393] GetProcessHeap () returned 0xd20000 [0075.393] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.393] GetProcessHeap () returned 0xd20000 [0075.394] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.394] GetProcessHeap () returned 0xd20000 [0075.394] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.394] GetProcessHeap () returned 0xd20000 [0075.394] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.394] GetProcessHeap () returned 0xd20000 [0075.394] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.394] GetProcessHeap () returned 0xd20000 [0075.394] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.394] GetProcessHeap () returned 0xd20000 [0075.394] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd38700 [0075.394] GetProcessHeap () returned 0xd20000 [0075.394] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.394] GetProcessHeap () returned 0xd20000 [0075.394] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45df8 | out: hHeap=0xd20000) returned 1 [0075.394] GetProcessHeap () returned 0xd20000 [0075.394] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd46220 | out: hHeap=0xd20000) returned 1 [0075.394] GetProcessHeap () returned 0xd20000 [0075.394] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd46008 | out: hHeap=0xd20000) returned 1 [0075.394] GetProcessHeap () returned 0xd20000 [0075.395] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd46430 | out: hHeap=0xd20000) returned 1 [0075.395] GetProcessHeap () returned 0xd20000 [0075.395] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cb20 | out: hHeap=0xd20000) returned 1 [0075.395] GetProcessHeap () returned 0xd20000 [0075.395] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31998 | out: hHeap=0xd20000) returned 1 [0075.395] GetProcessHeap () returned 0xd20000 [0075.395] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3b850 | out: hHeap=0xd20000) returned 1 [0075.395] GetProcessHeap () returned 0xd20000 [0075.395] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2fbe0 | out: hHeap=0xd20000) returned 1 [0075.395] GetProcessHeap () returned 0xd20000 [0075.395] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45be8 | out: hHeap=0xd20000) returned 1 [0075.395] GetProcessHeap () returned 0xd20000 [0075.395] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386f0 | out: hHeap=0xd20000) returned 1 [0075.395] GetProcessHeap () returned 0xd20000 [0075.395] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31c30 | out: hHeap=0xd20000) returned 1 [0075.396] GetProcessHeap () returned 0xd20000 [0075.396] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31810 | out: hHeap=0xd20000) returned 1 [0075.396] GetProcessHeap () returned 0xd20000 [0075.396] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45590 | out: hHeap=0xd20000) returned 1 [0075.396] GetProcessHeap () returned 0xd20000 [0075.396] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e8 | out: hHeap=0xd20000) returned 1 [0075.396] GetProcessHeap () returned 0xd20000 [0075.396] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45620 | out: hHeap=0xd20000) returned 1 [0075.396] GetProcessHeap () returned 0xd20000 [0075.396] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd32770 | out: hHeap=0xd20000) returned 1 [0075.396] GetProcessHeap () returned 0xd20000 [0075.396] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd322a8 | out: hHeap=0xd20000) returned 1 [0075.396] GetProcessHeap () returned 0xd20000 [0075.396] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd324e8 | out: hHeap=0xd20000) returned 1 [0075.396] GetProcessHeap () returned 0xd20000 [0075.396] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd323c8 | out: hHeap=0xd20000) returned 1 [0075.396] GetProcessHeap () returned 0xd20000 [0075.396] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31b00 | out: hHeap=0xd20000) returned 1 [0075.396] GetProcessHeap () returned 0xd20000 [0075.396] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd386a0 | out: hHeap=0xd20000) returned 1 [0075.396] GetProcessHeap () returned 0xd20000 [0075.397] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0075.397] GetProcessHeap () returned 0xd20000 [0075.397] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cb98 | out: hHeap=0xd20000) returned 1 [0075.397] SetFilePointer (in: hFile=0x200, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x102 [0075.397] WriteFile (in: hFile=0x200, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x19ff64, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x19ff64*=0x300, lpOverlapped=0x0) returned 1 [0075.404] CloseHandle (hObject=0x200) returned 1 [0075.410] GetProcessHeap () returned 0xd20000 [0075.410] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x130) returned 0xd2f6e8 [0075.410] GetProcessHeap () returned 0xd20000 [0075.410] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x6f0) returned 0xd45be8 [0075.410] GetProcessHeap () returned 0xd20000 [0075.410] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x70) returned 0xd31750 [0075.410] GetLogicalDrives () returned 0x4 [0075.410] GetDriveTypeA (lpRootPathName="C:\\") returned 0x3 [0075.410] GetProcessHeap () returned 0xd20000 [0075.410] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x3) returned 0xd386a0 [0075.410] lstrcpyA (in: lpString1=0xd386a0, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0075.410] GetProcessHeap () returned 0xd20000 [0075.411] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd3caf0 [0075.411] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4096d7, lpParameter=0xd3caf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x200 [0075.412] WaitForMultipleObjects (nCount=0x1, lpHandles=0x19f6f4*=0x200, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x2d0 Thread: id = 3 os_tid = 0xddc [0075.432] _alloca_probe () returned 0x4096e1 [0075.433] CryptAcquireContextW (in: phProv=0x299d700, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299d700*=0xd26760) returned 1 [0075.435] CryptGenRandom (in: hProv=0xd26760, dwLen=0x80, pbBuffer=0x299d718 | out: pbBuffer=0x299d718) returned 1 [0075.435] CryptReleaseContext (hProv=0xd26760, dwFlags=0x0) returned 1 [0075.435] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xd386a0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0075.435] GetProcessHeap () returned 0xd20000 [0075.435] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd386f0 [0075.435] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x1, lpMultiByteStr=0xd386a0, cbMultiByte=-1, lpWideCharStr=0xd386f0, cchWideChar=4 | out: lpWideCharStr="C:\\") returned 4 [0075.435] GetProcessHeap () returned 0xd20000 [0075.435] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd38700 [0075.435] lstrlenW (lpString="C:\\") returned 3 [0075.435] GetProcessHeap () returned 0xd20000 [0075.435] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cda8 [0075.436] lstrcpyW (in: lpString1=0xd3cda8, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0075.436] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\" | out: lpString1="C:\\") returned="C:\\" [0075.436] GetProcessHeap () returned 0xd20000 [0075.436] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cda8 | out: hHeap=0xd20000) returned 1 [0075.436] GetProcessHeap () returned 0xd20000 [0075.436] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd38700 | out: hHeap=0xd20000) returned 1 [0075.436] lstrlenW (lpString="C:\\") returned 3 [0075.436] lstrcatW (in: lpString1="C:\\", lpString2="*" | out: lpString1="C:\\*") returned="C:\\*" [0075.436] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0xd36948 [0075.436] lstrcmpiW (lpString1="$GetCurrent", lpString2=".") returned -1 [0075.437] lstrcmpiW (lpString1="$GetCurrent", lpString2="..") returned -1 [0075.437] lstrcatW (in: lpString1="C:\\", lpString2="$GetCurrent" | out: lpString1="C:\\$GetCurrent") returned="C:\\$GetCurrent" [0075.437] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="$GetCurrent", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0075.437] GetProcessHeap () returned 0xd20000 [0075.437] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd44648 [0075.437] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="$GetCurrent", cchWideChar=-1, lpMultiByteStr=0xd44648, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$GetCurrent", lpUsedDefaultChar=0x0) returned 12 [0075.437] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0075.437] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0075.437] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0075.437] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0075.437] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0075.437] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0075.437] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0075.437] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0075.437] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0075.437] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0075.438] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0075.438] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0075.438] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0075.438] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0075.438] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0075.438] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0075.438] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0075.438] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0075.438] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0075.438] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0075.438] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0075.438] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0075.438] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0075.438] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0075.438] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0075.438] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0075.438] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0075.438] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0075.439] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0075.439] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0075.439] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0075.439] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0075.439] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0075.439] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0075.439] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0075.439] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0075.439] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0075.439] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0075.439] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0075.439] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0075.439] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0075.439] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0075.439] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$GetCurrent", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0075.439] lstrcatW (in: lpString1="C:\\$GetCurrent", lpString2="\\" | out: lpString1="C:\\$GetCurrent\\") returned="C:\\$GetCurrent\\" [0075.439] GetProcessHeap () returned 0xd20000 [0075.439] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd38700 [0075.440] lstrlenW (lpString="C:\\$GetCurrent\\") returned 15 [0075.440] GetProcessHeap () returned 0xd20000 [0075.440] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x20) returned 0xd42468 [0075.440] lstrcpyW (in: lpString1=0xd42468, lpString2="C:\\$GetCurrent\\" | out: lpString1="C:\\$GetCurrent\\") returned="C:\\$GetCurrent\\" [0075.440] GetProcessHeap () returned 0xd20000 [0075.440] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44648 | out: hHeap=0xd20000) returned 1 [0075.440] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0075.440] lstrcmpiW (lpString1="$Recycle.Bin", lpString2=".") returned -1 [0075.440] lstrcmpiW (lpString1="$Recycle.Bin", lpString2="..") returned -1 [0075.440] lstrcatW (in: lpString1="C:\\", lpString2="$Recycle.Bin" | out: lpString1="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0075.440] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="$Recycle.Bin", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0075.440] GetProcessHeap () returned 0xd20000 [0075.440] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xd) returned 0xd445a0 [0075.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="$Recycle.Bin", cchWideChar=-1, lpMultiByteStr=0xd445a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$Recycle.Bin", lpUsedDefaultChar=0x0) returned 13 [0075.441] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0075.441] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0075.441] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0075.441] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0075.441] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0075.441] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0075.441] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0075.441] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0075.441] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0075.441] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0075.441] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0075.441] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0075.441] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0075.441] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0075.441] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0075.441] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0075.441] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0075.441] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0075.442] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0075.442] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0075.442] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0075.442] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0075.442] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0075.442] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0075.442] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0075.442] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0075.442] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0075.442] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0075.442] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0075.442] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0075.442] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0075.442] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0075.442] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0075.442] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0075.442] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0075.442] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0075.442] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0075.443] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0075.443] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0075.443] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0075.443] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0075.443] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0075.443] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="$Recycle.Bin", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0075.443] lstrcatW (in: lpString1="C:\\$Recycle.Bin", lpString2="\\" | out: lpString1="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0075.443] GetProcessHeap () returned 0xd20000 [0075.443] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3ccb8 [0075.443] lstrlenW (lpString="C:\\$Recycle.Bin\\") returned 16 [0075.443] GetProcessHeap () returned 0xd20000 [0075.443] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x22) returned 0xd34d38 [0075.443] lstrcpyW (in: lpString1=0xd34d38, lpString2="C:\\$Recycle.Bin\\" | out: lpString1="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0075.443] GetProcessHeap () returned 0xd20000 [0075.443] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445a0 | out: hHeap=0xd20000) returned 1 [0075.443] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0075.445] lstrcmpiW (lpString1="$WINRE_BACKUP_PARTITION.MARKER", lpString2=".") returned -1 [0075.445] lstrcmpiW (lpString1="$WINRE_BACKUP_PARTITION.MARKER", lpString2="..") returned -1 [0075.445] lstrcatW (in: lpString1="C:\\", lpString2="$WINRE_BACKUP_PARTITION.MARKER" | out: lpString1="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned="C:\\$WINRE_BACKUP_PARTITION.MARKER" [0075.445] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="$WINRE_BACKUP_PARTITION.MARKER", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0075.445] GetProcessHeap () returned 0xd20000 [0075.445] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1f) returned 0xd428c8 [0075.445] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="$WINRE_BACKUP_PARTITION.MARKER", cchWideChar=-1, lpMultiByteStr=0xd428c8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$WINRE_BACKUP_PARTITION.MARKER", lpUsedDefaultChar=0x0) returned 31 [0075.445] lstrlenA (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0075.445] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0075.445] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0075.446] lstrlenA (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0075.446] lstrcmpiA (lpString1="BACKUP_PARTITION.MARKER", lpString2=".[ponce.lorena@aol.com]") returned 1 [0075.446] lstrlenA (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0075.446] lstrlenA (lpString=".dll") returned 4 [0075.446] lstrlenA (lpString=".dll") returned 4 [0075.446] lstrlenA (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0075.446] lstrcmpiA (lpString1="RKER", lpString2=".dll") returned 1 [0075.446] lstrlenA (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0075.446] lstrlenA (lpString=".ini") returned 4 [0075.446] lstrlenA (lpString=".ini") returned 4 [0075.446] lstrlenA (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0075.446] lstrcmpiA (lpString1="RKER", lpString2=".ini") returned 1 [0075.446] lstrlenA (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0075.446] lstrlenA (lpString=".inc") returned 4 [0075.446] lstrlenA (lpString=".inc") returned 4 [0075.446] lstrlenA (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0075.446] lstrcmpiA (lpString1="RKER", lpString2=".inc") returned 1 [0075.446] lstrcmpiW (lpString1="$WINRE_BACKUP_PARTITION.MARKER", lpString2="HOW_RECOVER.html") returned -1 [0075.446] lstrcmpiW (lpString1="$WINRE_BACKUP_PARTITION.MARKER", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0075.447] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0075.447] lstrcmpiW (lpString1="$WINRE_BACKUP_PARTITION.MARKER", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned -1 [0075.447] GetProcessHeap () returned 0xd20000 [0075.447] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd428a0 [0075.447] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0075.449] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=0) returned 1 [0075.449] CloseHandle (hObject=0x230) returned 1 [0075.449] GetProcessHeap () returned 0xd20000 [0075.449] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd428a0 | out: hHeap=0xd20000) returned 1 [0075.449] GetProcessHeap () returned 0xd20000 [0075.449] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd428c8 | out: hHeap=0xd20000) returned 1 [0075.449] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0075.449] lstrcmpiW (lpString1="588bce7c90097ed212", lpString2=".") returned 1 [0075.449] lstrcmpiW (lpString1="588bce7c90097ed212", lpString2="..") returned 1 [0075.449] lstrcatW (in: lpString1="C:\\", lpString2="588bce7c90097ed212" | out: lpString1="C:\\588bce7c90097ed212") returned="C:\\588bce7c90097ed212" [0075.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="588bce7c90097ed212", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0075.449] GetProcessHeap () returned 0xd20000 [0075.449] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x13) returned 0xd36728 [0075.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="588bce7c90097ed212", cchWideChar=-1, lpMultiByteStr=0xd36728, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="588bce7c90097ed212", lpUsedDefaultChar=0x0) returned 19 [0075.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0075.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0075.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0075.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0075.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0075.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0075.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0075.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0075.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0075.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0075.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0075.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0075.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0075.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0075.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0075.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0075.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0075.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0075.450] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0075.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0075.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0075.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0075.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0075.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0075.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0075.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0075.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0075.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0075.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0075.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0075.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0075.451] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0075.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0075.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0075.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0075.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0075.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0075.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0075.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0075.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0075.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0075.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0075.452] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="588bce7c90097ed212", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0075.452] lstrcatW (in: lpString1="C:\\588bce7c90097ed212", lpString2="\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0075.453] GetProcessHeap () returned 0xd20000 [0075.453] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cc68 [0075.453] lstrlenW (lpString="C:\\588bce7c90097ed212\\") returned 22 [0075.453] GetProcessHeap () returned 0xd20000 [0075.453] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x2e) returned 0xd3fbd8 [0075.453] lstrcpyW (in: lpString1=0xd3fbd8, lpString2="C:\\588bce7c90097ed212\\" | out: lpString1="C:\\588bce7c90097ed212\\") returned="C:\\588bce7c90097ed212\\" [0075.453] GetProcessHeap () returned 0xd20000 [0075.453] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36728 | out: hHeap=0xd20000) returned 1 [0075.453] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0075.453] lstrcmpiW (lpString1="Boot", lpString2=".") returned 1 [0075.453] lstrcmpiW (lpString1="Boot", lpString2="..") returned 1 [0075.453] lstrcatW (in: lpString1="C:\\", lpString2="Boot" | out: lpString1="C:\\Boot") returned="C:\\Boot" [0075.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Boot", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0075.453] GetProcessHeap () returned 0xd20000 [0075.453] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x5) returned 0xd3cc38 [0075.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Boot", cchWideChar=-1, lpMultiByteStr=0xd3cc38, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Boot", lpUsedDefaultChar=0x0) returned 5 [0075.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0075.453] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0075.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0075.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0075.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0075.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0075.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0075.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0075.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0075.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0075.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0075.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0075.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0075.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0075.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0075.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0075.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0075.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0075.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0075.454] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0075.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0075.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0075.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0075.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0075.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0075.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0075.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0075.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0075.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0075.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0075.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0075.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0075.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0075.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0075.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0075.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0075.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0075.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0075.455] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0075.456] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0075.456] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0075.456] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0075.456] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Boot", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0075.456] lstrcatW (in: lpString1="C:\\Boot", lpString2="\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0075.456] GetProcessHeap () returned 0xd20000 [0075.456] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cda8 [0075.456] lstrlenW (lpString="C:\\Boot\\") returned 8 [0075.456] GetProcessHeap () returned 0xd20000 [0075.456] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x12) returned 0xd36628 [0075.456] lstrcpyW (in: lpString1=0xd36628, lpString2="C:\\Boot\\" | out: lpString1="C:\\Boot\\") returned="C:\\Boot\\" [0075.456] GetProcessHeap () returned 0xd20000 [0075.456] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0075.456] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0075.456] lstrcmpiW (lpString1="bootmgr", lpString2=".") returned 1 [0075.456] lstrcmpiW (lpString1="bootmgr", lpString2="..") returned 1 [0075.456] lstrcatW (in: lpString1="C:\\", lpString2="bootmgr" | out: lpString1="C:\\bootmgr") returned="C:\\bootmgr" [0075.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bootmgr", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0075.457] GetProcessHeap () returned 0xd20000 [0075.457] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cd38 [0075.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bootmgr", cchWideChar=-1, lpMultiByteStr=0xd3cd38, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootmgr", lpUsedDefaultChar=0x0) returned 8 [0075.457] lstrlenA (lpString="bootmgr") returned 7 [0075.457] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0075.457] lstrlenA (lpString="bootmgr") returned 7 [0075.457] lstrlenA (lpString=".dll") returned 4 [0075.457] lstrlenA (lpString=".dll") returned 4 [0075.457] lstrlenA (lpString="bootmgr") returned 7 [0075.457] lstrcmpiA (lpString1="tmgr", lpString2=".dll") returned 1 [0075.457] lstrlenA (lpString="bootmgr") returned 7 [0075.457] lstrlenA (lpString=".ini") returned 4 [0075.457] lstrlenA (lpString=".ini") returned 4 [0075.457] lstrlenA (lpString="bootmgr") returned 7 [0075.457] lstrcmpiA (lpString1="tmgr", lpString2=".ini") returned 1 [0075.457] lstrlenA (lpString="bootmgr") returned 7 [0075.457] lstrlenA (lpString=".inc") returned 4 [0075.457] lstrlenA (lpString=".inc") returned 4 [0075.457] lstrlenA (lpString="bootmgr") returned 7 [0075.458] lstrcmpiA (lpString1="tmgr", lpString2=".inc") returned 1 [0075.458] lstrcmpiW (lpString1="bootmgr", lpString2="HOW_RECOVER.html") returned -1 [0075.458] lstrcmpiW (lpString1="bootmgr", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0075.458] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0075.458] lstrcmpiW (lpString1="bootmgr", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0075.458] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0075.461] GetProcessHeap () returned 0xd20000 [0075.461] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd424e0 [0075.461] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0075.461] CloseHandle (hObject=0xffffffff) returned 1 [0075.462] GetProcessHeap () returned 0xd20000 [0075.462] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd424e0 | out: hHeap=0xd20000) returned 1 [0075.462] GetProcessHeap () returned 0xd20000 [0075.462] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0075.462] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef9d0a0c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0075.462] lstrcmpiW (lpString1="BOOTNXT", lpString2=".") returned 1 [0075.462] lstrcmpiW (lpString1="BOOTNXT", lpString2="..") returned 1 [0075.462] lstrcatW (in: lpString1="C:\\", lpString2="BOOTNXT" | out: lpString1="C:\\BOOTNXT") returned="C:\\BOOTNXT" [0075.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTNXT", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0075.462] GetProcessHeap () returned 0xd20000 [0075.462] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cbc8 [0075.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTNXT", cchWideChar=-1, lpMultiByteStr=0xd3cbc8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BOOTNXT", lpUsedDefaultChar=0x0) returned 8 [0075.462] lstrlenA (lpString="BOOTNXT") returned 7 [0075.462] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0075.462] lstrlenA (lpString="BOOTNXT") returned 7 [0075.462] lstrlenA (lpString=".dll") returned 4 [0075.462] lstrlenA (lpString=".dll") returned 4 [0075.462] lstrlenA (lpString="BOOTNXT") returned 7 [0075.462] lstrcmpiA (lpString1="TNXT", lpString2=".dll") returned 1 [0075.463] lstrlenA (lpString="BOOTNXT") returned 7 [0075.463] lstrlenA (lpString=".ini") returned 4 [0075.463] lstrlenA (lpString=".ini") returned 4 [0075.463] lstrlenA (lpString="BOOTNXT") returned 7 [0075.463] lstrcmpiA (lpString1="TNXT", lpString2=".ini") returned 1 [0075.463] lstrlenA (lpString="BOOTNXT") returned 7 [0075.463] lstrlenA (lpString=".inc") returned 4 [0075.463] lstrlenA (lpString=".inc") returned 4 [0075.463] lstrlenA (lpString="BOOTNXT") returned 7 [0075.463] lstrcmpiA (lpString1="TNXT", lpString2=".inc") returned 1 [0075.463] lstrcmpiW (lpString1="BOOTNXT", lpString2="HOW_RECOVER.html") returned -1 [0075.463] lstrcmpiW (lpString1="BOOTNXT", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0075.463] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0075.463] lstrcmpiW (lpString1="BOOTNXT", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0075.463] GetProcessHeap () returned 0xd20000 [0075.463] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42828 [0075.463] CreateFileW (lpFileName="C:\\BOOTNXT" (normalized: "c:\\bootnxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0075.523] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=1) returned 1 [0075.523] GetProcessHeap () returned 0xd20000 [0075.524] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd2e898 [0075.524] GetProcessHeap () returned 0xd20000 [0075.524] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0075.524] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0075.524] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0075.525] GetProcessHeap () returned 0xd20000 [0075.525] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0075.526] GetProcessHeap () returned 0xd20000 [0075.526] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x38f) returned 0xd47bc0 [0075.526] lstrlenA (lpString="rsa_encrypt") returned 11 [0075.526] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0075.533] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0075.533] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0075.533] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0075.533] GetProcessHeap () returned 0xd20000 [0075.533] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0075.533] lstrlenA (lpString="010001") returned 6 [0075.533] GetProcessHeap () returned 0xd20000 [0075.533] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc38 [0075.533] GetProcessHeap () returned 0xd20000 [0075.533] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0075.534] GetProcessHeap () returned 0xd20000 [0075.534] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd30f70 [0075.534] GetProcessHeap () returned 0xd20000 [0075.534] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0075.534] GetProcessHeap () returned 0xd20000 [0075.534] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd2f820 [0075.534] GetProcessHeap () returned 0xd20000 [0075.534] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd31c30 [0075.534] GetProcessHeap () returned 0xd20000 [0075.534] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd48 [0075.534] GetProcessHeap () returned 0xd20000 [0075.534] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd2fbe0 [0075.534] GetProcessHeap () returned 0xd20000 [0075.535] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd48 | out: hHeap=0xd20000) returned 1 [0075.535] GetProcessHeap () returned 0xd20000 [0075.535] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd31998 [0075.535] GetProcessHeap () returned 0xd20000 [0075.535] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd31810 [0075.535] GetProcessHeap () returned 0xd20000 [0075.535] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd2f9c0 [0075.535] GetProcessHeap () returned 0xd20000 [0075.535] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0075.535] GetProcessHeap () returned 0xd20000 [0075.535] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444e0 [0075.535] GetProcessHeap () returned 0xd20000 [0075.535] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd328d8 [0075.535] GetProcessHeap () returned 0xd20000 [0075.535] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31810 | out: hHeap=0xd20000) returned 1 [0075.535] GetProcessHeap () returned 0xd20000 [0075.535] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd3ddb0 [0075.535] GetProcessHeap () returned 0xd20000 [0075.535] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd328d8 | out: hHeap=0xd20000) returned 1 [0075.536] GetProcessHeap () returned 0xd20000 [0075.536] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccd8 [0075.536] GetProcessHeap () returned 0xd20000 [0075.536] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44450 [0075.536] GetProcessHeap () returned 0xd20000 [0075.536] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0075.536] GetProcessHeap () returned 0xd20000 [0075.536] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccd8 | out: hHeap=0xd20000) returned 1 [0075.536] GetProcessHeap () returned 0xd20000 [0075.536] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0075.536] GetProcessHeap () returned 0xd20000 [0075.536] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0075.536] GetProcessHeap () returned 0xd20000 [0075.536] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0075.536] GetProcessHeap () returned 0xd20000 [0075.536] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0075.536] GetProcessHeap () returned 0xd20000 [0075.537] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd328d8 [0075.537] GetProcessHeap () returned 0xd20000 [0075.537] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44450 | out: hHeap=0xd20000) returned 1 [0075.537] GetProcessHeap () returned 0xd20000 [0075.537] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd47f58 [0075.538] GetProcessHeap () returned 0xd20000 [0075.538] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd328d8 | out: hHeap=0xd20000) returned 1 [0075.538] GetProcessHeap () returned 0xd20000 [0075.538] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cca8 [0075.538] GetProcessHeap () returned 0xd20000 [0075.538] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cca8 | out: hHeap=0xd20000) returned 1 [0075.538] GetProcessHeap () returned 0xd20000 [0075.538] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccd8 [0075.538] GetProcessHeap () returned 0xd20000 [0075.538] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccd8 | out: hHeap=0xd20000) returned 1 [0075.538] GetProcessHeap () returned 0xd20000 [0075.538] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccc8 [0075.538] GetProcessHeap () returned 0xd20000 [0075.538] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccc8 | out: hHeap=0xd20000) returned 1 [0075.538] GetProcessHeap () returned 0xd20000 [0075.539] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd48 [0075.539] GetProcessHeap () returned 0xd20000 [0075.539] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd48 | out: hHeap=0xd20000) returned 1 [0075.539] GetProcessHeap () returned 0xd20000 [0075.539] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd78 [0075.539] GetProcessHeap () returned 0xd20000 [0075.539] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd78 | out: hHeap=0xd20000) returned 1 [0075.539] GetProcessHeap () returned 0xd20000 [0075.539] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0075.539] GetProcessHeap () returned 0xd20000 [0075.539] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0075.539] GetProcessHeap () returned 0xd20000 [0075.539] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cce8 [0075.539] GetProcessHeap () returned 0xd20000 [0075.539] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cce8 | out: hHeap=0xd20000) returned 1 [0075.539] GetProcessHeap () returned 0xd20000 [0075.539] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0075.539] GetProcessHeap () returned 0xd20000 [0075.540] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0075.540] GetProcessHeap () returned 0xd20000 [0075.540] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccd8 [0075.540] GetProcessHeap () returned 0xd20000 [0075.540] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccd8 | out: hHeap=0xd20000) returned 1 [0075.540] GetProcessHeap () returned 0xd20000 [0075.540] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccc8 [0075.540] GetProcessHeap () returned 0xd20000 [0075.540] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccc8 | out: hHeap=0xd20000) returned 1 [0075.540] GetProcessHeap () returned 0xd20000 [0075.540] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0075.540] GetProcessHeap () returned 0xd20000 [0075.540] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0075.540] GetProcessHeap () returned 0xd20000 [0075.540] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0075.540] GetProcessHeap () returned 0xd20000 [0075.540] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0075.540] GetProcessHeap () returned 0xd20000 [0075.541] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0075.541] GetProcessHeap () returned 0xd20000 [0075.541] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0075.541] GetProcessHeap () returned 0xd20000 [0075.541] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0075.541] GetProcessHeap () returned 0xd20000 [0075.541] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0075.541] GetProcessHeap () returned 0xd20000 [0075.541] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd48 [0075.541] GetProcessHeap () returned 0xd20000 [0075.541] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd48 | out: hHeap=0xd20000) returned 1 [0075.541] GetProcessHeap () returned 0xd20000 [0075.541] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cca8 [0075.541] GetProcessHeap () returned 0xd20000 [0075.541] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cca8 | out: hHeap=0xd20000) returned 1 [0075.541] GetProcessHeap () returned 0xd20000 [0075.541] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd78 [0075.541] GetProcessHeap () returned 0xd20000 [0075.541] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd78 | out: hHeap=0xd20000) returned 1 [0075.542] GetProcessHeap () returned 0xd20000 [0075.542] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc78 [0075.542] GetProcessHeap () returned 0xd20000 [0075.542] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc78 | out: hHeap=0xd20000) returned 1 [0075.542] GetProcessHeap () returned 0xd20000 [0075.542] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0075.542] GetProcessHeap () returned 0xd20000 [0075.542] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0075.542] GetProcessHeap () returned 0xd20000 [0075.542] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0075.542] GetProcessHeap () returned 0xd20000 [0075.542] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0075.542] GetProcessHeap () returned 0xd20000 [0075.542] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0075.542] GetProcessHeap () returned 0xd20000 [0075.542] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0075.542] GetProcessHeap () returned 0xd20000 [0075.542] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0075.543] GetProcessHeap () returned 0xd20000 [0075.543] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0075.543] GetProcessHeap () returned 0xd20000 [0075.543] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccc8 [0075.543] GetProcessHeap () returned 0xd20000 [0075.543] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccc8 | out: hHeap=0xd20000) returned 1 [0075.543] GetProcessHeap () returned 0xd20000 [0075.543] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0075.543] GetProcessHeap () returned 0xd20000 [0075.543] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0075.543] GetProcessHeap () returned 0xd20000 [0075.543] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0075.543] GetProcessHeap () returned 0xd20000 [0075.543] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0075.543] GetProcessHeap () returned 0xd20000 [0075.543] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0075.543] GetProcessHeap () returned 0xd20000 [0075.543] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0075.544] GetProcessHeap () returned 0xd20000 [0075.544] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0075.544] GetProcessHeap () returned 0xd20000 [0075.544] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0075.544] GetProcessHeap () returned 0xd20000 [0075.544] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0075.544] GetProcessHeap () returned 0xd20000 [0075.544] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0075.544] GetProcessHeap () returned 0xd20000 [0075.544] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0075.544] GetProcessHeap () returned 0xd20000 [0075.544] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0075.544] GetProcessHeap () returned 0xd20000 [0075.544] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccc8 [0075.544] GetProcessHeap () returned 0xd20000 [0075.544] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccc8 | out: hHeap=0xd20000) returned 1 [0075.544] GetProcessHeap () returned 0xd20000 [0075.545] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0075.545] GetProcessHeap () returned 0xd20000 [0075.545] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0075.545] GetProcessHeap () returned 0xd20000 [0075.545] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0075.545] GetProcessHeap () returned 0xd20000 [0075.545] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0075.545] GetProcessHeap () returned 0xd20000 [0075.545] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0075.545] GetProcessHeap () returned 0xd20000 [0075.545] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0075.545] GetProcessHeap () returned 0xd20000 [0075.546] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0075.546] GetProcessHeap () returned 0xd20000 [0075.546] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0075.546] GetProcessHeap () returned 0xd20000 [0075.546] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccc8 [0075.546] GetProcessHeap () returned 0xd20000 [0075.546] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccc8 | out: hHeap=0xd20000) returned 1 [0075.546] GetProcessHeap () returned 0xd20000 [0075.546] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0075.546] GetProcessHeap () returned 0xd20000 [0075.546] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0075.546] GetProcessHeap () returned 0xd20000 [0075.546] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0075.546] GetProcessHeap () returned 0xd20000 [0075.546] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0075.546] GetProcessHeap () returned 0xd20000 [0075.546] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0075.546] GetProcessHeap () returned 0xd20000 [0075.547] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0075.547] GetProcessHeap () returned 0xd20000 [0075.547] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0075.547] GetProcessHeap () returned 0xd20000 [0075.547] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0075.547] GetProcessHeap () returned 0xd20000 [0075.547] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccd8 [0075.547] GetProcessHeap () returned 0xd20000 [0075.547] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccd8 | out: hHeap=0xd20000) returned 1 [0075.547] GetProcessHeap () returned 0xd20000 [0075.547] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0075.547] GetProcessHeap () returned 0xd20000 [0075.547] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0075.547] GetProcessHeap () returned 0xd20000 [0075.547] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0075.547] GetProcessHeap () returned 0xd20000 [0075.547] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0075.547] GetProcessHeap () returned 0xd20000 [0075.548] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0075.548] GetProcessHeap () returned 0xd20000 [0075.548] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0075.548] GetProcessHeap () returned 0xd20000 [0075.548] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0075.548] GetProcessHeap () returned 0xd20000 [0075.548] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0075.548] GetProcessHeap () returned 0xd20000 [0075.548] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0075.548] GetProcessHeap () returned 0xd20000 [0075.548] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0075.548] GetProcessHeap () returned 0xd20000 [0075.548] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0075.548] GetProcessHeap () returned 0xd20000 [0075.548] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0075.548] GetProcessHeap () returned 0xd20000 [0075.548] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd68 [0075.548] GetProcessHeap () returned 0xd20000 [0075.548] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd68 | out: hHeap=0xd20000) returned 1 [0075.549] GetProcessHeap () returned 0xd20000 [0075.549] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0075.549] GetProcessHeap () returned 0xd20000 [0075.549] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0075.549] GetProcessHeap () returned 0xd20000 [0075.549] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd78 [0075.549] GetProcessHeap () returned 0xd20000 [0075.549] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd78 | out: hHeap=0xd20000) returned 1 [0075.549] GetProcessHeap () returned 0xd20000 [0075.549] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0075.549] GetProcessHeap () returned 0xd20000 [0075.549] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0075.549] GetProcessHeap () returned 0xd20000 [0075.549] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0075.549] GetProcessHeap () returned 0xd20000 [0075.549] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0075.549] GetProcessHeap () returned 0xd20000 [0075.549] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0075.550] GetProcessHeap () returned 0xd20000 [0075.550] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0075.550] GetProcessHeap () returned 0xd20000 [0075.550] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0075.550] GetProcessHeap () returned 0xd20000 [0075.550] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0075.550] GetProcessHeap () returned 0xd20000 [0075.550] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0075.550] GetProcessHeap () returned 0xd20000 [0075.550] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0075.550] GetProcessHeap () returned 0xd20000 [0075.550] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccd8 [0075.550] GetProcessHeap () returned 0xd20000 [0075.550] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccd8 | out: hHeap=0xd20000) returned 1 [0075.550] GetProcessHeap () returned 0xd20000 [0075.550] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0075.550] GetProcessHeap () returned 0xd20000 [0075.550] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0075.551] GetProcessHeap () returned 0xd20000 [0075.551] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0075.551] GetProcessHeap () returned 0xd20000 [0075.551] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0075.551] GetProcessHeap () returned 0xd20000 [0075.551] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0075.551] GetProcessHeap () returned 0xd20000 [0075.551] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0075.551] GetProcessHeap () returned 0xd20000 [0075.551] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0075.551] GetProcessHeap () returned 0xd20000 [0075.551] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0075.551] GetProcessHeap () returned 0xd20000 [0075.551] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0075.551] GetProcessHeap () returned 0xd20000 [0075.551] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0075.551] GetProcessHeap () returned 0xd20000 [0075.551] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0075.551] GetProcessHeap () returned 0xd20000 [0075.552] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0075.552] GetProcessHeap () returned 0xd20000 [0075.552] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0075.552] GetProcessHeap () returned 0xd20000 [0075.552] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0075.552] GetProcessHeap () returned 0xd20000 [0075.552] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0075.552] GetProcessHeap () returned 0xd20000 [0075.552] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0075.552] GetProcessHeap () returned 0xd20000 [0075.552] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0075.552] GetProcessHeap () returned 0xd20000 [0075.552] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0075.552] GetProcessHeap () returned 0xd20000 [0075.552] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0075.552] GetProcessHeap () returned 0xd20000 [0075.552] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0075.552] GetProcessHeap () returned 0xd20000 [0075.552] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd48 [0075.553] GetProcessHeap () returned 0xd20000 [0075.553] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd48 | out: hHeap=0xd20000) returned 1 [0075.553] GetProcessHeap () returned 0xd20000 [0075.553] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd78 [0075.553] GetProcessHeap () returned 0xd20000 [0075.553] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd78 | out: hHeap=0xd20000) returned 1 [0075.553] GetProcessHeap () returned 0xd20000 [0075.553] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd48 [0075.553] GetProcessHeap () returned 0xd20000 [0075.553] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd48 | out: hHeap=0xd20000) returned 1 [0075.553] GetProcessHeap () returned 0xd20000 [0075.553] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0075.553] GetProcessHeap () returned 0xd20000 [0075.553] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0075.553] GetProcessHeap () returned 0xd20000 [0075.553] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd48 [0075.553] GetProcessHeap () returned 0xd20000 [0075.553] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd48 | out: hHeap=0xd20000) returned 1 [0075.553] GetProcessHeap () returned 0xd20000 [0075.554] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0075.554] GetProcessHeap () returned 0xd20000 [0075.554] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0075.554] GetProcessHeap () returned 0xd20000 [0075.554] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd78 [0075.554] GetProcessHeap () returned 0xd20000 [0075.554] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd78 | out: hHeap=0xd20000) returned 1 [0075.554] GetProcessHeap () returned 0xd20000 [0075.554] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0075.554] GetProcessHeap () returned 0xd20000 [0075.554] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0075.554] GetProcessHeap () returned 0xd20000 [0075.554] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0075.554] GetProcessHeap () returned 0xd20000 [0075.554] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0075.554] GetProcessHeap () returned 0xd20000 [0075.554] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccc8 [0075.554] GetProcessHeap () returned 0xd20000 [0075.555] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccc8 | out: hHeap=0xd20000) returned 1 [0075.555] GetProcessHeap () returned 0xd20000 [0075.555] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd48 [0075.555] GetProcessHeap () returned 0xd20000 [0075.555] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd48 | out: hHeap=0xd20000) returned 1 [0075.555] GetProcessHeap () returned 0xd20000 [0075.555] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0075.555] GetProcessHeap () returned 0xd20000 [0075.555] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0075.555] GetProcessHeap () returned 0xd20000 [0075.555] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0075.555] GetProcessHeap () returned 0xd20000 [0075.555] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0075.555] GetProcessHeap () returned 0xd20000 [0075.555] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0075.555] GetProcessHeap () returned 0xd20000 [0075.555] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0075.556] GetProcessHeap () returned 0xd20000 [0075.556] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0075.556] GetProcessHeap () returned 0xd20000 [0075.556] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0075.556] GetProcessHeap () returned 0xd20000 [0075.556] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0075.556] GetProcessHeap () returned 0xd20000 [0075.556] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0075.556] GetProcessHeap () returned 0xd20000 [0075.556] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd48 [0075.556] GetProcessHeap () returned 0xd20000 [0075.556] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd48 | out: hHeap=0xd20000) returned 1 [0075.556] GetProcessHeap () returned 0xd20000 [0075.556] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0075.556] GetProcessHeap () returned 0xd20000 [0075.556] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0075.556] GetProcessHeap () returned 0xd20000 [0075.556] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc78 [0075.556] GetProcessHeap () returned 0xd20000 [0075.557] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc78 | out: hHeap=0xd20000) returned 1 [0075.557] GetProcessHeap () returned 0xd20000 [0075.557] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0075.557] GetProcessHeap () returned 0xd20000 [0075.557] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0075.557] GetProcessHeap () returned 0xd20000 [0075.557] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31998 | out: hHeap=0xd20000) returned 1 [0075.557] GetProcessHeap () returned 0xd20000 [0075.557] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ddb0 | out: hHeap=0xd20000) returned 1 [0075.557] GetProcessHeap () returned 0xd20000 [0075.557] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f9c0 | out: hHeap=0xd20000) returned 1 [0075.557] GetProcessHeap () returned 0xd20000 [0075.557] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd47f58 | out: hHeap=0xd20000) returned 1 [0075.557] GetProcessHeap () returned 0xd20000 [0075.557] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444e0 | out: hHeap=0xd20000) returned 1 [0075.557] GetProcessHeap () returned 0xd20000 [0075.557] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0075.557] GetProcessHeap () returned 0xd20000 [0075.558] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31c30 | out: hHeap=0xd20000) returned 1 [0075.558] GetProcessHeap () returned 0xd20000 [0075.558] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd30f70 | out: hHeap=0xd20000) returned 1 [0075.558] GetProcessHeap () returned 0xd20000 [0075.558] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2fbe0 | out: hHeap=0xd20000) returned 1 [0075.558] GetProcessHeap () returned 0xd20000 [0075.558] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0075.558] GetProcessHeap () returned 0xd20000 [0075.558] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0075.558] WriteFile (in: hFile=0x230, lpBuffer=0xd47bc0*, nNumberOfBytesToWrite=0x38f, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd47bc0*, lpNumberOfBytesWritten=0x299d864*=0x38f, lpOverlapped=0x0) returned 1 [0075.575] GetProcessHeap () returned 0xd20000 [0075.576] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd47bc0, Size=0x30) returned 0xd47bc0 [0075.576] GetProcessHeap () returned 0xd20000 [0075.576] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0075.576] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.576] GetProcessHeap () returned 0xd20000 [0075.576] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd44438 [0075.577] ReadFile (in: hFile=0x230, lpBuffer=0xd44438, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd44438*, lpNumberOfBytesRead=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.578] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.578] WriteFile (in: hFile=0x230, lpBuffer=0xd44438*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd44438*, lpNumberOfBytesWritten=0x299d7e4*=0x10, lpOverlapped=0x0) returned 1 [0075.579] GetProcessHeap () returned 0xd20000 [0075.579] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44438 | out: hHeap=0xd20000) returned 1 [0075.579] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0075.580] WriteFile (in: hFile=0x230, lpBuffer=0xd47bc0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd47bc0*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0075.581] CloseHandle (hObject=0x230) returned 1 [0075.585] GetProcessHeap () returned 0xd20000 [0075.585] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42828 | out: hHeap=0xd20000) returned 1 [0075.585] GetProcessHeap () returned 0xd20000 [0075.585] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2e898 | out: hHeap=0xd20000) returned 1 [0075.585] GetProcessHeap () returned 0xd20000 [0075.585] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0075.585] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\BOOTNXT" | out: lpString1="C:\\BOOTNXT") returned="C:\\BOOTNXT" [0075.585] lstrcatW (in: lpString1="C:\\BOOTNXT", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\BOOTNXT.[ponce.lorena@aol.com]") returned="C:\\BOOTNXT.[ponce.lorena@aol.com]" [0075.585] MoveFileExW (lpExistingFileName="C:\\BOOTNXT" (normalized: "c:\\bootnxt"), lpNewFileName="C:\\BOOTNXT.[ponce.lorena@aol.com]" (normalized: "c:\\bootnxt.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0075.588] PathRemoveFileSpecW (in: pszPath="C:\\BOOTNXT" | out: pszPath="C:\\") returned 1 [0075.588] PathAddBackslashW (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0075.588] lstrcatW (in: lpString1="C:\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\HOW_RECOVER.html") returned="C:\\HOW_RECOVER.html" [0075.589] GetFileAttributesW (lpFileName="C:\\HOW_RECOVER.html" (normalized: "c:\\how_recover.html")) returned 0xffffffff [0075.589] CreateFileW (lpFileName="C:\\HOW_RECOVER.html" (normalized: "c:\\how_recover.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0075.802] GetProcessHeap () returned 0xd20000 [0075.802] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd2e898 [0075.802] GetProcessHeap () returned 0xd20000 [0075.802] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0075.812] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.814] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.814] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.814] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.814] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.814] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.815] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.815] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.815] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.815] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.815] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.815] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.815] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.816] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.816] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.816] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.816] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.816] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.816] GetProcessHeap () returned 0xd20000 [0075.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2e898 | out: hHeap=0xd20000) returned 1 [0075.816] GetProcessHeap () returned 0xd20000 [0075.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0075.816] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x299d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x299d9d0*=0x300, lpOverlapped=0x0) returned 1 [0075.818] GetProcessHeap () returned 0xd20000 [0075.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd2e898 [0075.818] GetProcessHeap () returned 0xd20000 [0075.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0075.829] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.829] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.829] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.829] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.829] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.829] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.830] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.830] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.830] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.830] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.830] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.830] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.830] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.830] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.831] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.831] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.831] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.831] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.831] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.831] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.831] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.832] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.832] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.832] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.832] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.832] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.832] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.832] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.832] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.833] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.833] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.833] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.833] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.833] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.833] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.833] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.833] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.833] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.834] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.834] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.834] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.834] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.834] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.834] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.834] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.834] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.835] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.835] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.835] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.835] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.835] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.835] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.835] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.835] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.835] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.836] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.836] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.836] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.836] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.836] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.836] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.836] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.836] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.836] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.837] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.837] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.837] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.837] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.837] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.837] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.837] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.837] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.838] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.838] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.838] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.838] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.838] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.838] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.838] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.838] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.838] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.839] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.839] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.839] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.839] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.839] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.839] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.839] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.839] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.840] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.840] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.840] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.840] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.840] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.840] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.840] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.840] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.840] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.841] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.841] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.841] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.841] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.841] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.841] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.841] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.841] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.842] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.842] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.842] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.867] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0075.867] GetProcessHeap () returned 0xd20000 [0075.867] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2e898 | out: hHeap=0xd20000) returned 1 [0075.867] GetProcessHeap () returned 0xd20000 [0075.867] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0075.868] CloseHandle (hObject=0x230) returned 1 [0075.869] GetProcessHeap () returned 0xd20000 [0075.869] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0075.870] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xc4ee267e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4ee267e, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1c63cdd, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0075.870] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2=".") returned 1 [0075.870] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="..") returned 1 [0075.870] lstrcatW (in: lpString1="C:\\", lpString2="BOOTSECT.BAK" | out: lpString1="C:\\BOOTSECT.BAK") returned="C:\\BOOTSECT.BAK" [0075.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTSECT.BAK", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0075.870] GetProcessHeap () returned 0xd20000 [0075.870] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xd) returned 0xd44528 [0075.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BOOTSECT.BAK", cchWideChar=-1, lpMultiByteStr=0xd44528, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BOOTSECT.BAK", lpUsedDefaultChar=0x0) returned 13 [0075.870] lstrlenA (lpString="BOOTSECT.BAK") returned 12 [0075.871] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0075.871] lstrlenA (lpString="BOOTSECT.BAK") returned 12 [0075.871] lstrlenA (lpString=".dll") returned 4 [0075.871] lstrlenA (lpString=".dll") returned 4 [0075.871] lstrlenA (lpString="BOOTSECT.BAK") returned 12 [0075.871] lstrcmpiA (lpString1=".BAK", lpString2=".dll") returned -1 [0075.871] lstrlenA (lpString="BOOTSECT.BAK") returned 12 [0075.872] lstrlenA (lpString=".ini") returned 4 [0075.872] lstrlenA (lpString=".ini") returned 4 [0075.872] lstrlenA (lpString="BOOTSECT.BAK") returned 12 [0075.872] lstrcmpiA (lpString1=".BAK", lpString2=".ini") returned -1 [0075.872] lstrlenA (lpString="BOOTSECT.BAK") returned 12 [0075.872] lstrlenA (lpString=".inc") returned 4 [0075.872] lstrlenA (lpString=".inc") returned 4 [0075.872] lstrlenA (lpString="BOOTSECT.BAK") returned 12 [0075.872] lstrcmpiA (lpString1=".BAK", lpString2=".inc") returned -1 [0075.872] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="HOW_RECOVER.html") returned -1 [0075.872] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0075.872] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0075.872] lstrcmpiW (lpString1="BOOTSECT.BAK", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0075.873] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0075.874] GetProcessHeap () returned 0xd20000 [0075.874] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42738 [0075.874] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0075.874] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=8192) returned 1 [0075.874] GetProcessHeap () returned 0xd20000 [0075.874] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd2e898 [0075.874] GetProcessHeap () returned 0xd20000 [0075.874] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0075.874] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0075.875] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0075.875] GetProcessHeap () returned 0xd20000 [0075.875] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0075.875] GetProcessHeap () returned 0xd20000 [0075.875] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd47bf8 [0075.875] lstrlenA (lpString="rsa_encrypt") returned 11 [0075.875] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0075.877] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0075.877] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0075.877] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0075.877] GetProcessHeap () returned 0xd20000 [0075.877] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0075.877] lstrlenA (lpString="010001") returned 6 [0075.878] GetProcessHeap () returned 0xd20000 [0075.878] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd88 [0075.878] GetProcessHeap () returned 0xd20000 [0075.878] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0075.878] GetProcessHeap () returned 0xd20000 [0075.878] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd30f70 [0075.878] GetProcessHeap () returned 0xd20000 [0075.878] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0075.878] GetProcessHeap () returned 0xd20000 [0075.878] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd2f820 [0075.878] GetProcessHeap () returned 0xd20000 [0075.878] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd2fbe0 [0075.878] GetProcessHeap () returned 0xd20000 [0075.878] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd68 [0075.878] GetProcessHeap () returned 0xd20000 [0075.878] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd31c30 [0075.878] GetProcessHeap () returned 0xd20000 [0075.878] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd68 | out: hHeap=0xd20000) returned 1 [0075.879] GetProcessHeap () returned 0xd20000 [0075.879] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd31998 [0075.879] GetProcessHeap () returned 0xd20000 [0075.879] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd328d8 [0075.879] GetProcessHeap () returned 0xd20000 [0075.879] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44e98 [0075.879] GetProcessHeap () returned 0xd20000 [0075.879] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0075.879] GetProcessHeap () returned 0xd20000 [0075.879] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44480 [0075.879] GetProcessHeap () returned 0xd20000 [0075.879] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd31810 [0075.879] GetProcessHeap () returned 0xd20000 [0075.879] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd328d8 | out: hHeap=0xd20000) returned 1 [0075.879] GetProcessHeap () returned 0xd20000 [0075.879] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd2f9c0 [0075.879] GetProcessHeap () returned 0xd20000 [0075.879] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31810 | out: hHeap=0xd20000) returned 1 [0075.880] GetProcessHeap () returned 0xd20000 [0075.880] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0075.880] GetProcessHeap () returned 0xd20000 [0075.880] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44510 [0075.880] GetProcessHeap () returned 0xd20000 [0075.880] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0075.880] GetProcessHeap () returned 0xd20000 [0075.880] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0075.880] GetProcessHeap () returned 0xd20000 [0075.880] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0075.880] GetProcessHeap () returned 0xd20000 [0075.880] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0075.880] GetProcessHeap () returned 0xd20000 [0075.880] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0075.880] GetProcessHeap () returned 0xd20000 [0075.880] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0075.880] GetProcessHeap () returned 0xd20000 [0075.880] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd31810 [0075.880] GetProcessHeap () returned 0xd20000 [0075.880] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44510 | out: hHeap=0xd20000) returned 1 [0075.881] GetProcessHeap () returned 0xd20000 [0075.881] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd3ddb0 [0075.881] GetProcessHeap () returned 0xd20000 [0075.881] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31810 | out: hHeap=0xd20000) returned 1 [0075.881] GetProcessHeap () returned 0xd20000 [0075.881] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0075.881] GetProcessHeap () returned 0xd20000 [0075.881] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0075.881] GetProcessHeap () returned 0xd20000 [0075.881] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0075.881] GetProcessHeap () returned 0xd20000 [0075.881] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0075.881] GetProcessHeap () returned 0xd20000 [0075.881] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0075.881] GetProcessHeap () returned 0xd20000 [0075.881] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0075.881] GetProcessHeap () returned 0xd20000 [0075.881] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0075.881] GetProcessHeap () returned 0xd20000 [0075.882] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0075.882] GetProcessHeap () returned 0xd20000 [0075.882] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0075.882] GetProcessHeap () returned 0xd20000 [0075.882] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0075.882] GetProcessHeap () returned 0xd20000 [0075.882] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0075.882] GetProcessHeap () returned 0xd20000 [0075.882] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0075.882] GetProcessHeap () returned 0xd20000 [0075.882] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cca8 [0075.882] GetProcessHeap () returned 0xd20000 [0075.882] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cca8 | out: hHeap=0xd20000) returned 1 [0075.882] GetProcessHeap () returned 0xd20000 [0075.882] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0075.882] GetProcessHeap () returned 0xd20000 [0075.882] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0075.882] GetProcessHeap () returned 0xd20000 [0075.882] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd48 [0075.883] GetProcessHeap () returned 0xd20000 [0075.883] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd48 | out: hHeap=0xd20000) returned 1 [0075.883] GetProcessHeap () returned 0xd20000 [0075.883] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cce8 [0075.883] GetProcessHeap () returned 0xd20000 [0075.883] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cce8 | out: hHeap=0xd20000) returned 1 [0075.883] GetProcessHeap () returned 0xd20000 [0075.883] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0075.883] GetProcessHeap () returned 0xd20000 [0075.883] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0075.883] GetProcessHeap () returned 0xd20000 [0075.883] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0075.883] GetProcessHeap () returned 0xd20000 [0075.883] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0075.883] GetProcessHeap () returned 0xd20000 [0075.883] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0075.883] GetProcessHeap () returned 0xd20000 [0075.884] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0075.884] GetProcessHeap () returned 0xd20000 [0075.884] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0075.884] GetProcessHeap () returned 0xd20000 [0075.884] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0075.884] GetProcessHeap () returned 0xd20000 [0075.884] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd48 [0075.884] GetProcessHeap () returned 0xd20000 [0075.884] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd48 | out: hHeap=0xd20000) returned 1 [0075.884] GetProcessHeap () returned 0xd20000 [0075.884] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0075.884] GetProcessHeap () returned 0xd20000 [0075.884] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0075.884] GetProcessHeap () returned 0xd20000 [0075.884] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc78 [0075.884] GetProcessHeap () returned 0xd20000 [0075.884] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc78 | out: hHeap=0xd20000) returned 1 [0075.884] GetProcessHeap () returned 0xd20000 [0075.885] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0075.885] GetProcessHeap () returned 0xd20000 [0075.885] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0075.885] GetProcessHeap () returned 0xd20000 [0075.885] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccc8 [0075.885] GetProcessHeap () returned 0xd20000 [0075.885] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccc8 | out: hHeap=0xd20000) returned 1 [0075.885] GetProcessHeap () returned 0xd20000 [0075.885] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0075.885] GetProcessHeap () returned 0xd20000 [0075.885] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0075.885] GetProcessHeap () returned 0xd20000 [0075.885] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0075.885] GetProcessHeap () returned 0xd20000 [0075.885] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0075.885] GetProcessHeap () returned 0xd20000 [0075.885] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd78 [0075.885] GetProcessHeap () returned 0xd20000 [0075.885] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd78 | out: hHeap=0xd20000) returned 1 [0075.886] GetProcessHeap () returned 0xd20000 [0075.886] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd68 [0075.886] GetProcessHeap () returned 0xd20000 [0075.886] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd68 | out: hHeap=0xd20000) returned 1 [0075.886] GetProcessHeap () returned 0xd20000 [0075.886] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0075.886] GetProcessHeap () returned 0xd20000 [0075.886] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0075.886] GetProcessHeap () returned 0xd20000 [0075.886] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccc8 [0075.886] GetProcessHeap () returned 0xd20000 [0075.886] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccc8 | out: hHeap=0xd20000) returned 1 [0075.886] GetProcessHeap () returned 0xd20000 [0075.886] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccd8 [0075.886] GetProcessHeap () returned 0xd20000 [0075.886] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccd8 | out: hHeap=0xd20000) returned 1 [0075.886] GetProcessHeap () returned 0xd20000 [0075.886] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccd8 [0075.886] GetProcessHeap () returned 0xd20000 [0075.887] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccd8 | out: hHeap=0xd20000) returned 1 [0075.887] GetProcessHeap () returned 0xd20000 [0075.887] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0075.887] GetProcessHeap () returned 0xd20000 [0075.887] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0075.887] GetProcessHeap () returned 0xd20000 [0075.887] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccc8 [0075.887] GetProcessHeap () returned 0xd20000 [0075.887] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccc8 | out: hHeap=0xd20000) returned 1 [0075.887] GetProcessHeap () returned 0xd20000 [0075.887] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0075.887] GetProcessHeap () returned 0xd20000 [0075.887] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0075.887] GetProcessHeap () returned 0xd20000 [0075.887] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccc8 [0075.887] GetProcessHeap () returned 0xd20000 [0075.888] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccc8 | out: hHeap=0xd20000) returned 1 [0075.888] GetProcessHeap () returned 0xd20000 [0075.888] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0075.888] GetProcessHeap () returned 0xd20000 [0075.888] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0075.888] GetProcessHeap () returned 0xd20000 [0075.888] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0075.888] GetProcessHeap () returned 0xd20000 [0075.888] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0075.888] GetProcessHeap () returned 0xd20000 [0075.888] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0075.888] GetProcessHeap () returned 0xd20000 [0075.888] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0075.888] GetProcessHeap () returned 0xd20000 [0075.888] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0075.888] GetProcessHeap () returned 0xd20000 [0075.888] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0075.888] GetProcessHeap () returned 0xd20000 [0075.889] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0075.889] GetProcessHeap () returned 0xd20000 [0075.889] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0075.889] GetProcessHeap () returned 0xd20000 [0075.889] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0075.889] GetProcessHeap () returned 0xd20000 [0075.889] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0075.890] GetProcessHeap () returned 0xd20000 [0075.890] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd48 [0075.890] GetProcessHeap () returned 0xd20000 [0075.890] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd48 | out: hHeap=0xd20000) returned 1 [0075.890] GetProcessHeap () returned 0xd20000 [0075.890] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd48 [0075.890] GetProcessHeap () returned 0xd20000 [0075.890] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd48 | out: hHeap=0xd20000) returned 1 [0075.890] GetProcessHeap () returned 0xd20000 [0075.890] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0075.890] GetProcessHeap () returned 0xd20000 [0075.890] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0075.890] GetProcessHeap () returned 0xd20000 [0075.890] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0075.890] GetProcessHeap () returned 0xd20000 [0075.890] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0075.890] GetProcessHeap () returned 0xd20000 [0075.890] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0075.890] GetProcessHeap () returned 0xd20000 [0075.891] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0075.891] GetProcessHeap () returned 0xd20000 [0075.891] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0075.891] GetProcessHeap () returned 0xd20000 [0075.891] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0075.891] GetProcessHeap () returned 0xd20000 [0075.891] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0075.891] GetProcessHeap () returned 0xd20000 [0075.891] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0075.891] GetProcessHeap () returned 0xd20000 [0075.891] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0075.891] GetProcessHeap () returned 0xd20000 [0075.891] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0075.891] GetProcessHeap () returned 0xd20000 [0075.891] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0075.891] GetProcessHeap () returned 0xd20000 [0075.891] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0075.891] GetProcessHeap () returned 0xd20000 [0075.892] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0075.892] GetProcessHeap () returned 0xd20000 [0075.892] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0075.892] GetProcessHeap () returned 0xd20000 [0075.892] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0075.892] GetProcessHeap () returned 0xd20000 [0075.892] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0075.892] GetProcessHeap () returned 0xd20000 [0075.892] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0075.892] GetProcessHeap () returned 0xd20000 [0075.892] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0075.892] GetProcessHeap () returned 0xd20000 [0075.892] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd48 [0075.892] GetProcessHeap () returned 0xd20000 [0075.892] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd48 | out: hHeap=0xd20000) returned 1 [0075.892] GetProcessHeap () returned 0xd20000 [0075.892] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccd8 [0075.892] GetProcessHeap () returned 0xd20000 [0075.893] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccd8 | out: hHeap=0xd20000) returned 1 [0075.893] GetProcessHeap () returned 0xd20000 [0075.893] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0075.893] GetProcessHeap () returned 0xd20000 [0075.893] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0075.893] GetProcessHeap () returned 0xd20000 [0075.893] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0075.893] GetProcessHeap () returned 0xd20000 [0075.893] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0075.893] GetProcessHeap () returned 0xd20000 [0075.893] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0075.893] GetProcessHeap () returned 0xd20000 [0075.893] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0075.893] GetProcessHeap () returned 0xd20000 [0075.893] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc78 [0075.893] GetProcessHeap () returned 0xd20000 [0075.893] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc78 | out: hHeap=0xd20000) returned 1 [0075.894] GetProcessHeap () returned 0xd20000 [0075.894] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0075.894] GetProcessHeap () returned 0xd20000 [0075.894] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0075.894] GetProcessHeap () returned 0xd20000 [0075.894] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0075.894] GetProcessHeap () returned 0xd20000 [0075.894] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0075.894] GetProcessHeap () returned 0xd20000 [0075.894] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0075.894] GetProcessHeap () returned 0xd20000 [0075.894] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0075.894] GetProcessHeap () returned 0xd20000 [0075.894] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0075.894] GetProcessHeap () returned 0xd20000 [0075.894] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0075.894] GetProcessHeap () returned 0xd20000 [0075.894] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0075.895] GetProcessHeap () returned 0xd20000 [0075.895] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0075.895] GetProcessHeap () returned 0xd20000 [0075.895] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd48 [0075.895] GetProcessHeap () returned 0xd20000 [0075.895] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd48 | out: hHeap=0xd20000) returned 1 [0075.895] GetProcessHeap () returned 0xd20000 [0075.895] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0075.895] GetProcessHeap () returned 0xd20000 [0075.895] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0075.895] GetProcessHeap () returned 0xd20000 [0075.895] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0075.895] GetProcessHeap () returned 0xd20000 [0075.895] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0075.895] GetProcessHeap () returned 0xd20000 [0075.895] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cca8 [0075.895] GetProcessHeap () returned 0xd20000 [0075.895] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cca8 | out: hHeap=0xd20000) returned 1 [0075.896] GetProcessHeap () returned 0xd20000 [0075.896] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0075.896] GetProcessHeap () returned 0xd20000 [0075.896] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0075.896] GetProcessHeap () returned 0xd20000 [0075.896] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0075.896] GetProcessHeap () returned 0xd20000 [0075.896] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0075.896] GetProcessHeap () returned 0xd20000 [0075.896] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0075.896] GetProcessHeap () returned 0xd20000 [0075.896] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0075.896] GetProcessHeap () returned 0xd20000 [0075.896] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0075.896] GetProcessHeap () returned 0xd20000 [0075.896] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0075.896] GetProcessHeap () returned 0xd20000 [0075.896] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0075.897] GetProcessHeap () returned 0xd20000 [0075.897] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0075.897] GetProcessHeap () returned 0xd20000 [0075.897] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd48 [0075.897] GetProcessHeap () returned 0xd20000 [0075.897] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd48 | out: hHeap=0xd20000) returned 1 [0075.897] GetProcessHeap () returned 0xd20000 [0075.897] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0075.897] GetProcessHeap () returned 0xd20000 [0075.897] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0075.897] GetProcessHeap () returned 0xd20000 [0075.897] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc78 [0075.897] GetProcessHeap () returned 0xd20000 [0075.897] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc78 | out: hHeap=0xd20000) returned 1 [0075.897] GetProcessHeap () returned 0xd20000 [0075.897] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd68 [0075.897] GetProcessHeap () returned 0xd20000 [0075.897] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd68 | out: hHeap=0xd20000) returned 1 [0075.898] GetProcessHeap () returned 0xd20000 [0075.898] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0075.898] GetProcessHeap () returned 0xd20000 [0075.898] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0075.898] GetProcessHeap () returned 0xd20000 [0075.898] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cca8 [0075.898] GetProcessHeap () returned 0xd20000 [0075.898] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cca8 | out: hHeap=0xd20000) returned 1 [0075.898] GetProcessHeap () returned 0xd20000 [0075.898] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccc8 [0075.898] GetProcessHeap () returned 0xd20000 [0075.898] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccc8 | out: hHeap=0xd20000) returned 1 [0075.898] GetProcessHeap () returned 0xd20000 [0075.898] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0075.898] GetProcessHeap () returned 0xd20000 [0075.898] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0075.898] GetProcessHeap () returned 0xd20000 [0075.898] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0075.899] GetProcessHeap () returned 0xd20000 [0075.899] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0075.899] GetProcessHeap () returned 0xd20000 [0075.899] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0075.899] GetProcessHeap () returned 0xd20000 [0075.899] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0075.899] GetProcessHeap () returned 0xd20000 [0075.899] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0075.899] GetProcessHeap () returned 0xd20000 [0075.899] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0075.899] GetProcessHeap () returned 0xd20000 [0075.899] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc78 [0075.899] GetProcessHeap () returned 0xd20000 [0075.899] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc78 | out: hHeap=0xd20000) returned 1 [0075.899] GetProcessHeap () returned 0xd20000 [0075.899] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0075.899] GetProcessHeap () returned 0xd20000 [0075.899] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0075.900] GetProcessHeap () returned 0xd20000 [0075.900] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0075.900] GetProcessHeap () returned 0xd20000 [0075.900] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0075.900] GetProcessHeap () returned 0xd20000 [0075.900] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0075.900] GetProcessHeap () returned 0xd20000 [0075.900] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0075.900] GetProcessHeap () returned 0xd20000 [0075.900] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cce8 [0075.900] GetProcessHeap () returned 0xd20000 [0075.900] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cce8 | out: hHeap=0xd20000) returned 1 [0075.900] GetProcessHeap () returned 0xd20000 [0075.900] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31998 | out: hHeap=0xd20000) returned 1 [0075.900] GetProcessHeap () returned 0xd20000 [0075.900] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f9c0 | out: hHeap=0xd20000) returned 1 [0075.900] GetProcessHeap () returned 0xd20000 [0075.900] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0075.901] GetProcessHeap () returned 0xd20000 [0075.901] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ddb0 | out: hHeap=0xd20000) returned 1 [0075.901] GetProcessHeap () returned 0xd20000 [0075.901] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44480 | out: hHeap=0xd20000) returned 1 [0075.901] GetProcessHeap () returned 0xd20000 [0075.901] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0075.901] GetProcessHeap () returned 0xd20000 [0075.901] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2fbe0 | out: hHeap=0xd20000) returned 1 [0075.901] GetProcessHeap () returned 0xd20000 [0075.901] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd30f70 | out: hHeap=0xd20000) returned 1 [0075.901] GetProcessHeap () returned 0xd20000 [0075.901] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31c30 | out: hHeap=0xd20000) returned 1 [0075.901] GetProcessHeap () returned 0xd20000 [0075.901] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0075.901] GetProcessHeap () returned 0xd20000 [0075.901] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0075.901] WriteFile (in: hFile=0x230, lpBuffer=0xd47bf8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd47bf8*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0075.908] GetProcessHeap () returned 0xd20000 [0075.909] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd47bf8, Size=0x30) returned 0xd47bf8 [0075.909] GetProcessHeap () returned 0xd20000 [0075.909] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0075.909] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.909] GetProcessHeap () returned 0xd20000 [0075.909] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x2000) returned 0xd47c30 [0075.909] ReadFile (in: hFile=0x230, lpBuffer=0xd47c30, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd47c30*, lpNumberOfBytesRead=0x299d7e8*=0x2000, lpOverlapped=0x0) returned 1 [0075.911] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0075.911] WriteFile (in: hFile=0x230, lpBuffer=0xd47c30*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd47c30*, lpNumberOfBytesWritten=0x299d7e4*=0x2000, lpOverlapped=0x0) returned 1 [0076.289] GetProcessHeap () returned 0xd20000 [0076.289] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd47c30 | out: hHeap=0xd20000) returned 1 [0076.289] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0076.289] WriteFile (in: hFile=0x230, lpBuffer=0xd47bf8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd47bf8*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0076.291] CloseHandle (hObject=0x230) returned 1 [0076.295] GetProcessHeap () returned 0xd20000 [0076.295] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42738 | out: hHeap=0xd20000) returned 1 [0076.295] GetProcessHeap () returned 0xd20000 [0076.295] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2e898 | out: hHeap=0xd20000) returned 1 [0076.295] GetProcessHeap () returned 0xd20000 [0076.296] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0076.296] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\BOOTSECT.BAK" | out: lpString1="C:\\BOOTSECT.BAK") returned="C:\\BOOTSECT.BAK" [0076.296] lstrcatW (in: lpString1="C:\\BOOTSECT.BAK", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\BOOTSECT.BAK.[ponce.lorena@aol.com]") returned="C:\\BOOTSECT.BAK.[ponce.lorena@aol.com]" [0076.296] MoveFileExW (lpExistingFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), lpNewFileName="C:\\BOOTSECT.BAK.[ponce.lorena@aol.com]" (normalized: "c:\\bootsect.bak.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0076.297] PathRemoveFileSpecW (in: pszPath="C:\\BOOTSECT.BAK" | out: pszPath="C:\\") returned 1 [0076.297] PathAddBackslashW (in: pszPath="C:\\" | out: pszPath="C:\\") returned="" [0076.297] lstrcatW (in: lpString1="C:\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\HOW_RECOVER.html") returned="C:\\HOW_RECOVER.html" [0076.297] GetFileAttributesW (lpFileName="C:\\HOW_RECOVER.html" (normalized: "c:\\how_recover.html")) returned 0x20 [0076.297] GetProcessHeap () returned 0xd20000 [0076.298] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44528 | out: hHeap=0xd20000) returned 1 [0076.298] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0076.298] lstrcmpiW (lpString1="Documents and Settings", lpString2=".") returned 1 [0076.298] lstrcmpiW (lpString1="Documents and Settings", lpString2="..") returned 1 [0076.298] lstrcatW (in: lpString1="C:\\", lpString2="Documents and Settings" | out: lpString1="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0076.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Documents and Settings", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0076.298] GetProcessHeap () returned 0xd20000 [0076.298] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x17) returned 0xd36468 [0076.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Documents and Settings", cchWideChar=-1, lpMultiByteStr=0xd36468, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Documents and Settings", lpUsedDefaultChar=0x0) returned 23 [0076.298] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0076.298] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0076.298] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0076.298] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0076.298] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0076.299] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0076.299] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0076.299] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0076.299] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0076.299] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0076.299] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0076.299] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0076.299] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0076.299] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0076.299] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0076.299] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0076.299] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0076.299] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0076.299] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0076.299] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0076.299] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0076.299] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0076.300] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0076.300] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0076.300] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0076.300] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0076.300] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0076.300] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0076.300] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0076.300] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0076.300] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0076.300] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0076.300] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0076.300] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0076.300] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0076.300] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0076.300] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0076.300] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0076.300] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0076.300] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0076.301] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0076.301] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0076.301] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents and Settings", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0076.301] lstrcatW (in: lpString1="C:\\Documents and Settings", lpString2="\\" | out: lpString1="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0076.301] GetProcessHeap () returned 0xd20000 [0076.301] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cca8 [0076.301] lstrlenW (lpString="C:\\Documents and Settings\\") returned 26 [0076.301] GetProcessHeap () returned 0xd20000 [0076.301] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x36) returned 0xd36a48 [0076.301] lstrcpyW (in: lpString1=0xd36a48, lpString2="C:\\Documents and Settings\\" | out: lpString1="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0076.301] GetProcessHeap () returned 0xd20000 [0076.301] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36468 | out: hHeap=0xd20000) returned 1 [0076.301] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1 [0076.301] lstrcmpiW (lpString1="ESD", lpString2=".") returned 1 [0076.301] lstrcmpiW (lpString1="ESD", lpString2="..") returned 1 [0076.301] lstrcatW (in: lpString1="C:\\", lpString2="ESD" | out: lpString1="C:\\ESD") returned="C:\\ESD" [0076.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ESD", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0076.302] GetProcessHeap () returned 0xd20000 [0076.302] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4) returned 0xd3cd78 [0076.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ESD", cchWideChar=-1, lpMultiByteStr=0xd3cd78, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ESD", lpUsedDefaultChar=0x0) returned 4 [0076.302] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0076.302] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0076.302] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0076.302] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0076.302] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0076.302] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0076.302] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0076.302] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0076.302] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0076.302] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0076.302] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0076.302] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0076.302] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0076.302] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0076.303] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0076.303] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0076.303] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0076.303] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0076.303] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0076.303] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0076.303] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0076.303] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0076.303] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0076.303] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0076.303] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0076.303] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0076.303] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0076.303] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0076.303] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0076.303] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0076.303] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0076.303] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0076.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0076.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0076.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0076.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0076.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0076.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0076.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0076.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0076.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0076.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0076.304] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ESD", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0076.304] lstrcatW (in: lpString1="C:\\ESD", lpString2="\\" | out: lpString1="C:\\ESD\\") returned="C:\\ESD\\" [0076.304] GetProcessHeap () returned 0xd20000 [0076.304] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3ccc8 [0076.304] lstrlenW (lpString="C:\\ESD\\") returned 7 [0076.304] GetProcessHeap () returned 0xd20000 [0076.304] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd44450 [0076.304] lstrcpyW (in: lpString1=0xd44450, lpString2="C:\\ESD\\" | out: lpString1="C:\\ESD\\") returned="C:\\ESD\\" [0076.304] GetProcessHeap () returned 0xd20000 [0076.305] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd78 | out: hHeap=0xd20000) returned 1 [0076.305] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3d7ebe9, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0076.305] lstrcmpiW (lpString1="hiberfil.sys", lpString2=".") returned 1 [0076.305] lstrcmpiW (lpString1="hiberfil.sys", lpString2="..") returned 1 [0076.305] lstrcatW (in: lpString1="C:\\", lpString2="hiberfil.sys" | out: lpString1="C:\\hiberfil.sys") returned="C:\\hiberfil.sys" [0076.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hiberfil.sys", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0076.305] GetProcessHeap () returned 0xd20000 [0076.305] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xd) returned 0xd445a0 [0076.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hiberfil.sys", cchWideChar=-1, lpMultiByteStr=0xd445a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hiberfil.sys", lpUsedDefaultChar=0x0) returned 13 [0076.305] lstrlenA (lpString="hiberfil.sys") returned 12 [0076.305] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0076.305] lstrlenA (lpString="hiberfil.sys") returned 12 [0076.305] lstrlenA (lpString=".dll") returned 4 [0076.305] lstrlenA (lpString=".dll") returned 4 [0076.305] lstrlenA (lpString="hiberfil.sys") returned 12 [0076.305] lstrcmpiA (lpString1=".sys", lpString2=".dll") returned 1 [0076.305] lstrlenA (lpString="hiberfil.sys") returned 12 [0076.305] lstrlenA (lpString=".ini") returned 4 [0076.306] lstrlenA (lpString=".ini") returned 4 [0076.306] lstrlenA (lpString="hiberfil.sys") returned 12 [0076.306] lstrcmpiA (lpString1=".sys", lpString2=".ini") returned 1 [0076.306] lstrlenA (lpString="hiberfil.sys") returned 12 [0076.306] lstrlenA (lpString=".inc") returned 4 [0076.306] lstrlenA (lpString=".inc") returned 4 [0076.306] lstrlenA (lpString="hiberfil.sys") returned 12 [0076.306] lstrcmpiA (lpString1=".sys", lpString2=".inc") returned 1 [0076.306] lstrcmpiW (lpString1="hiberfil.sys", lpString2="HOW_RECOVER.html") returned -1 [0076.306] lstrcmpiW (lpString1="hiberfil.sys", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0076.306] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0076.306] lstrcmpiW (lpString1="hiberfil.sys", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0076.306] GetProcessHeap () returned 0xd20000 [0076.306] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd426c0 [0076.306] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0076.310] CloseHandle (hObject=0xffffffff) returned 1 [0076.310] GetProcessHeap () returned 0xd20000 [0076.310] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd426c0 | out: hHeap=0xd20000) returned 1 [0076.310] GetProcessHeap () returned 0xd20000 [0076.310] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445a0 | out: hHeap=0xd20000) returned 1 [0076.310] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0076.310] lstrcmpiW (lpString1="Logs", lpString2=".") returned 1 [0076.311] lstrcmpiW (lpString1="Logs", lpString2="..") returned 1 [0076.311] lstrcatW (in: lpString1="C:\\", lpString2="Logs" | out: lpString1="C:\\Logs") returned="C:\\Logs" [0076.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Logs", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0076.311] GetProcessHeap () returned 0xd20000 [0076.311] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x5) returned 0xd3cdb8 [0076.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Logs", cchWideChar=-1, lpMultiByteStr=0xd3cdb8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Logs", lpUsedDefaultChar=0x0) returned 5 [0076.311] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0076.311] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0076.311] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0076.311] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0076.312] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0076.312] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0076.312] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0076.312] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0076.312] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0076.312] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0076.312] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0076.312] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0076.312] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0076.312] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0076.312] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0076.312] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0076.312] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0076.312] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0076.312] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0076.312] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0076.312] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0076.312] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0076.313] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0076.313] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0076.313] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0076.313] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0076.313] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0076.313] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0076.313] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0076.313] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0076.313] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0076.313] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0076.313] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0076.313] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0076.313] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0076.313] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0076.313] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0076.313] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0076.313] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0076.314] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0076.314] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0076.314] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0076.314] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Logs", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0076.314] lstrcatW (in: lpString1="C:\\Logs", lpString2="\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0076.314] GetProcessHeap () returned 0xd20000 [0076.314] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cc78 [0076.314] lstrlenW (lpString="C:\\Logs\\") returned 8 [0076.314] GetProcessHeap () returned 0xd20000 [0076.314] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x12) returned 0xd36728 [0076.314] lstrcpyW (in: lpString1=0xd36728, lpString2="C:\\Logs\\" | out: lpString1="C:\\Logs\\") returned="C:\\Logs\\" [0076.314] GetProcessHeap () returned 0xd20000 [0076.314] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0076.314] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0076.314] lstrcmpiW (lpString1="pagefile.sys", lpString2=".") returned 1 [0076.314] lstrcmpiW (lpString1="pagefile.sys", lpString2="..") returned 1 [0076.314] lstrcatW (in: lpString1="C:\\", lpString2="pagefile.sys" | out: lpString1="C:\\pagefile.sys") returned="C:\\pagefile.sys" [0076.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pagefile.sys", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0076.315] GetProcessHeap () returned 0xd20000 [0076.315] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xd) returned 0xd446a8 [0076.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pagefile.sys", cchWideChar=-1, lpMultiByteStr=0xd446a8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pagefile.sys", lpUsedDefaultChar=0x0) returned 13 [0076.315] lstrlenA (lpString="pagefile.sys") returned 12 [0076.315] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0076.315] lstrlenA (lpString="pagefile.sys") returned 12 [0076.315] lstrlenA (lpString=".dll") returned 4 [0076.315] lstrlenA (lpString=".dll") returned 4 [0076.315] lstrlenA (lpString="pagefile.sys") returned 12 [0076.315] lstrcmpiA (lpString1=".sys", lpString2=".dll") returned 1 [0076.315] lstrlenA (lpString="pagefile.sys") returned 12 [0076.315] lstrlenA (lpString=".ini") returned 4 [0076.315] lstrlenA (lpString=".ini") returned 4 [0076.315] lstrlenA (lpString="pagefile.sys") returned 12 [0076.315] lstrcmpiA (lpString1=".sys", lpString2=".ini") returned 1 [0076.315] lstrlenA (lpString="pagefile.sys") returned 12 [0076.316] lstrlenA (lpString=".inc") returned 4 [0076.316] lstrlenA (lpString=".inc") returned 4 [0076.316] lstrlenA (lpString="pagefile.sys") returned 12 [0076.316] lstrcmpiA (lpString1=".sys", lpString2=".inc") returned 1 [0076.316] lstrcmpiW (lpString1="pagefile.sys", lpString2="HOW_RECOVER.html") returned 1 [0076.316] lstrcmpiW (lpString1="pagefile.sys", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0076.316] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0076.316] lstrcmpiW (lpString1="pagefile.sys", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0076.316] GetProcessHeap () returned 0xd20000 [0076.316] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42490 [0076.316] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0076.316] CloseHandle (hObject=0xffffffff) returned 1 [0076.316] GetProcessHeap () returned 0xd20000 [0076.316] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42490 | out: hHeap=0xd20000) returned 1 [0076.317] GetProcessHeap () returned 0xd20000 [0076.317] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446a8 | out: hHeap=0xd20000) returned 1 [0076.317] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0076.317] lstrcmpiW (lpString1="PerfLogs", lpString2=".") returned 1 [0076.317] lstrcmpiW (lpString1="PerfLogs", lpString2="..") returned 1 [0076.317] lstrcatW (in: lpString1="C:\\", lpString2="PerfLogs" | out: lpString1="C:\\PerfLogs") returned="C:\\PerfLogs" [0076.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PerfLogs", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0076.317] GetProcessHeap () returned 0xd20000 [0076.317] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x9) returned 0xd444c8 [0076.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PerfLogs", cchWideChar=-1, lpMultiByteStr=0xd444c8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PerfLogs", lpUsedDefaultChar=0x0) returned 9 [0076.317] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0076.317] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0076.317] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0076.317] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0076.317] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0076.317] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0076.318] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0076.318] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0076.318] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0076.318] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0076.318] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0076.318] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0076.318] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0076.318] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0076.318] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0076.318] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0076.318] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0076.318] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0076.318] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0076.318] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0076.318] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0076.318] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0076.319] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0076.319] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0076.319] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0076.319] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0076.319] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0076.319] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0076.319] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0076.319] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0076.319] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0076.319] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0076.319] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0076.319] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0076.319] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0076.319] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0076.319] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0076.319] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0076.319] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0076.319] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0076.320] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0076.320] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0076.320] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PerfLogs", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0076.320] lstrcatW (in: lpString1="C:\\PerfLogs", lpString2="\\" | out: lpString1="C:\\PerfLogs\\") returned="C:\\PerfLogs\\" [0076.320] GetProcessHeap () returned 0xd20000 [0076.320] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cd78 [0076.320] lstrlenW (lpString="C:\\PerfLogs\\") returned 12 [0076.320] GetProcessHeap () returned 0xd20000 [0076.320] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1a) returned 0xd423f0 [0076.320] lstrcpyW (in: lpString1=0xd423f0, lpString2="C:\\PerfLogs\\" | out: lpString1="C:\\PerfLogs\\") returned="C:\\PerfLogs\\" [0076.320] GetProcessHeap () returned 0xd20000 [0076.320] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444c8 | out: hHeap=0xd20000) returned 1 [0076.320] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x5996606d, ftLastAccessTime.dwHighDateTime=0x1d5c395, ftLastWriteTime.dwLowDateTime=0x5996606d, ftLastWriteTime.dwHighDateTime=0x1d5c395, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0076.320] lstrcmpiW (lpString1="Program Files", lpString2=".") returned 1 [0076.321] lstrcmpiW (lpString1="Program Files", lpString2="..") returned 1 [0076.321] lstrcatW (in: lpString1="C:\\", lpString2="Program Files" | out: lpString1="C:\\Program Files") returned="C:\\Program Files" [0076.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Program Files", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0076.321] GetProcessHeap () returned 0xd20000 [0076.321] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xe) returned 0xd44630 [0076.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Program Files", cchWideChar=-1, lpMultiByteStr=0xd44630, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Program Files", lpUsedDefaultChar=0x0) returned 14 [0076.321] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0076.321] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0076.321] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0076.321] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0076.321] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0076.321] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0076.321] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0076.321] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0076.322] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0076.322] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0076.322] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0076.322] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0076.322] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0076.322] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0076.322] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0076.322] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0076.322] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0076.322] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0076.322] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0076.322] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0076.323] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0076.323] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0076.323] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0076.323] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0076.323] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0076.323] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0076.323] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0076.323] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0076.323] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0076.323] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0076.323] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0076.323] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0076.323] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0076.323] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0076.324] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0076.324] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0076.324] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0076.324] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0076.324] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0076.324] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0076.324] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0076.324] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0076.324] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0076.324] lstrcatW (in: lpString1="C:\\Program Files", lpString2="\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0076.324] GetProcessHeap () returned 0xd20000 [0076.324] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3ccd8 [0076.324] lstrlenW (lpString="C:\\Program Files\\") returned 17 [0076.325] GetProcessHeap () returned 0xd20000 [0076.325] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x24) returned 0xd34e88 [0076.325] lstrcpyW (in: lpString1=0xd34e88, lpString2="C:\\Program Files\\" | out: lpString1="C:\\Program Files\\") returned="C:\\Program Files\\" [0076.325] GetProcessHeap () returned 0xd20000 [0076.325] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44630 | out: hHeap=0xd20000) returned 1 [0076.325] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7511354, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7511354, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0076.325] lstrcmpiW (lpString1="Program Files (x86)", lpString2=".") returned 1 [0076.325] lstrcmpiW (lpString1="Program Files (x86)", lpString2="..") returned 1 [0076.325] lstrcatW (in: lpString1="C:\\", lpString2="Program Files (x86)" | out: lpString1="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0076.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0076.325] GetProcessHeap () returned 0xd20000 [0076.325] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x14) returned 0xd364c8 [0076.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Program Files (x86)", cchWideChar=-1, lpMultiByteStr=0xd364c8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Program Files (x86)", lpUsedDefaultChar=0x0) returned 20 [0076.325] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0076.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0076.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0076.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0076.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0076.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0076.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0076.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0076.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0076.326] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0076.327] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0076.328] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0076.328] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0076.328] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0076.328] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0076.328] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0076.328] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0076.328] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0076.328] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0076.328] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0076.328] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0076.328] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0076.328] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0076.328] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0076.328] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0076.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0076.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0076.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0076.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0076.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0076.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0076.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0076.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0076.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0076.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0076.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0076.329] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Program Files (x86)", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0076.329] lstrcatW (in: lpString1="C:\\Program Files (x86)", lpString2="\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0076.329] GetProcessHeap () returned 0xd20000 [0076.330] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cd68 [0076.330] lstrlenW (lpString="C:\\Program Files (x86)\\") returned 23 [0076.330] GetProcessHeap () returned 0xd20000 [0076.330] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x30) returned 0xd40268 [0076.330] lstrcpyW (in: lpString1=0xd40268, lpString2="C:\\Program Files (x86)\\" | out: lpString1="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0076.330] GetProcessHeap () returned 0xd20000 [0076.330] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd364c8 | out: hHeap=0xd20000) returned 1 [0076.330] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0076.330] lstrcmpiW (lpString1="ProgramData", lpString2=".") returned 1 [0076.330] lstrcmpiW (lpString1="ProgramData", lpString2="..") returned 1 [0076.330] lstrcatW (in: lpString1="C:\\", lpString2="ProgramData" | out: lpString1="C:\\ProgramData") returned="C:\\ProgramData" [0076.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramData", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0076.330] GetProcessHeap () returned 0xd20000 [0076.331] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd44468 [0076.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ProgramData", cchWideChar=-1, lpMultiByteStr=0xd44468, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ProgramData", lpUsedDefaultChar=0x0) returned 12 [0076.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0076.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0076.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0076.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0076.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0076.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0076.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0076.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0076.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0076.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0076.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0076.331] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0076.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0076.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0076.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0076.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0076.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0076.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0076.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0076.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0076.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0076.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0076.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0076.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0076.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0076.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0076.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0076.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0076.332] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0076.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0076.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0076.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0076.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0076.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0076.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0076.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0076.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0076.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0076.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0076.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0076.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0076.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0076.333] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ProgramData", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 2 [0076.333] GetProcessHeap () returned 0xd20000 [0076.333] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44468 | out: hHeap=0xd20000) returned 1 [0076.333] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0076.333] lstrcmpiW (lpString1="Recovery", lpString2=".") returned 1 [0076.334] lstrcmpiW (lpString1="Recovery", lpString2="..") returned 1 [0076.334] lstrcatW (in: lpString1="C:\\", lpString2="Recovery" | out: lpString1="C:\\Recovery") returned="C:\\Recovery" [0076.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Recovery", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0076.334] GetProcessHeap () returned 0xd20000 [0076.334] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x9) returned 0xd44498 [0076.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Recovery", cchWideChar=-1, lpMultiByteStr=0xd44498, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Recovery", lpUsedDefaultChar=0x0) returned 9 [0076.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0076.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0076.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0076.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0076.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0076.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0076.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0076.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0076.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0076.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0076.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0076.334] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0076.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0076.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0076.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0076.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0076.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0076.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0076.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0076.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0076.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0076.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0076.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0076.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0076.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0076.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0076.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0076.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0076.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0076.335] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0076.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0076.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0076.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0076.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0076.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0076.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0076.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0076.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0076.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0076.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0076.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0076.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0076.336] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recovery", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0076.336] lstrcatW (in: lpString1="C:\\Recovery", lpString2="\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0076.336] GetProcessHeap () returned 0xd20000 [0076.336] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cce8 [0076.336] lstrlenW (lpString="C:\\Recovery\\") returned 12 [0076.336] GetProcessHeap () returned 0xd20000 [0076.337] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1a) returned 0xd42508 [0076.337] lstrcpyW (in: lpString1=0xd42508, lpString2="C:\\Recovery\\" | out: lpString1="C:\\Recovery\\") returned="C:\\Recovery\\" [0076.337] GetProcessHeap () returned 0xd20000 [0076.337] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44498 | out: hHeap=0xd20000) returned 1 [0076.337] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6ead2556, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6ead2556, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x10000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="swapfile.sys", cAlternateFileName="")) returned 1 [0076.337] lstrcmpiW (lpString1="swapfile.sys", lpString2=".") returned 1 [0076.337] lstrcmpiW (lpString1="swapfile.sys", lpString2="..") returned 1 [0076.337] lstrcatW (in: lpString1="C:\\", lpString2="swapfile.sys" | out: lpString1="C:\\swapfile.sys") returned="C:\\swapfile.sys" [0076.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="swapfile.sys", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0076.337] GetProcessHeap () returned 0xd20000 [0076.337] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xd) returned 0xd44678 [0076.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="swapfile.sys", cchWideChar=-1, lpMultiByteStr=0xd44678, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="swapfile.sys", lpUsedDefaultChar=0x0) returned 13 [0076.337] lstrlenA (lpString="swapfile.sys") returned 12 [0076.337] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0076.337] lstrlenA (lpString="swapfile.sys") returned 12 [0076.337] lstrlenA (lpString=".dll") returned 4 [0076.337] lstrlenA (lpString=".dll") returned 4 [0076.337] lstrlenA (lpString="swapfile.sys") returned 12 [0076.338] lstrcmpiA (lpString1=".sys", lpString2=".dll") returned 1 [0076.338] lstrlenA (lpString="swapfile.sys") returned 12 [0076.338] lstrlenA (lpString=".ini") returned 4 [0076.338] lstrlenA (lpString=".ini") returned 4 [0076.338] lstrlenA (lpString="swapfile.sys") returned 12 [0076.338] lstrcmpiA (lpString1=".sys", lpString2=".ini") returned 1 [0076.338] lstrlenA (lpString="swapfile.sys") returned 12 [0076.338] lstrlenA (lpString=".inc") returned 4 [0076.338] lstrlenA (lpString=".inc") returned 4 [0076.338] lstrlenA (lpString="swapfile.sys") returned 12 [0076.338] lstrcmpiA (lpString1=".sys", lpString2=".inc") returned 1 [0076.338] lstrcmpiW (lpString1="swapfile.sys", lpString2="HOW_RECOVER.html") returned 1 [0076.338] lstrcmpiW (lpString1="swapfile.sys", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0076.338] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0076.338] lstrcmpiW (lpString1="swapfile.sys", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0076.338] GetProcessHeap () returned 0xd20000 [0076.338] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd428c8 [0076.338] CreateFileW (lpFileName="C:\\swapfile.sys" (normalized: "c:\\swapfile.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0076.339] CloseHandle (hObject=0xffffffff) returned 1 [0076.339] GetProcessHeap () returned 0xd20000 [0076.339] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd428c8 | out: hHeap=0xd20000) returned 1 [0076.339] GetProcessHeap () returned 0xd20000 [0076.339] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44678 | out: hHeap=0xd20000) returned 1 [0076.339] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x6e16f135, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0xb1ff7ba5, ftLastAccessTime.dwHighDateTime=0x1d336d8, ftLastWriteTime.dwLowDateTime=0xb1ff7ba5, ftLastWriteTime.dwHighDateTime=0x1d336d8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0076.339] lstrcmpiW (lpString1="System Volume Information", lpString2=".") returned 1 [0076.339] lstrcmpiW (lpString1="System Volume Information", lpString2="..") returned 1 [0076.339] lstrcatW (in: lpString1="C:\\", lpString2="System Volume Information" | out: lpString1="C:\\System Volume Information") returned="C:\\System Volume Information" [0076.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="System Volume Information", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0076.339] GetProcessHeap () returned 0xd20000 [0076.339] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1a) returned 0xd424e0 [0076.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="System Volume Information", cchWideChar=-1, lpMultiByteStr=0xd424e0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="System Volume Information", lpUsedDefaultChar=0x0) returned 26 [0076.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0076.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0076.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0076.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0076.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0076.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0076.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0076.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0076.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0076.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0076.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0076.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0076.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0076.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0076.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0076.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0076.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0076.340] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0076.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0076.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0076.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0076.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0076.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0076.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0076.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0076.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0076.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0076.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0076.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0076.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0076.341] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="System Volume Information", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 2 [0076.341] GetProcessHeap () returned 0xd20000 [0076.341] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd424e0 | out: hHeap=0xd20000) returned 1 [0076.341] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0076.341] lstrcmpiW (lpString1="Users", lpString2=".") returned 1 [0076.341] lstrcmpiW (lpString1="Users", lpString2="..") returned 1 [0076.342] lstrcatW (in: lpString1="C:\\", lpString2="Users" | out: lpString1="C:\\Users") returned="C:\\Users" [0076.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Users", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0076.342] GetProcessHeap () returned 0xd20000 [0076.342] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x6) returned 0xd3cc38 [0076.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Users", cchWideChar=-1, lpMultiByteStr=0xd3cc38, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Users", lpUsedDefaultChar=0x0) returned 6 [0076.342] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0076.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0076.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0076.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0076.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0076.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0076.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0076.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0076.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0076.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0076.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0076.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0076.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0076.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0076.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0076.343] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0076.344] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0076.344] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0076.344] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0076.344] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0076.344] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0076.344] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0076.344] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0076.344] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0076.344] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0076.344] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0076.344] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0076.344] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0076.344] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0076.344] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0076.344] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0076.344] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0076.344] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0076.344] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0076.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0076.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0076.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0076.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0076.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0076.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0076.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0076.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0076.345] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Users", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0076.345] lstrcatW (in: lpString1="C:\\Users", lpString2="\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0076.345] GetProcessHeap () returned 0xd20000 [0076.345] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cd48 [0076.345] lstrlenW (lpString="C:\\Users\\") returned 9 [0076.345] GetProcessHeap () returned 0xd20000 [0076.345] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x14) returned 0xd36428 [0076.345] lstrcpyW (in: lpString1=0xd36428, lpString2="C:\\Users\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0076.345] GetProcessHeap () returned 0xd20000 [0076.345] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0076.345] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0076.346] lstrcmpiW (lpString1="Windows", lpString2=".") returned 1 [0076.346] lstrcmpiW (lpString1="Windows", lpString2="..") returned 1 [0076.346] lstrcatW (in: lpString1="C:\\", lpString2="Windows" | out: lpString1="C:\\Windows") returned="C:\\Windows" [0076.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Windows", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0076.346] GetProcessHeap () returned 0xd20000 [0076.346] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cc58 [0076.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Windows", cchWideChar=-1, lpMultiByteStr=0xd3cc58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows", lpUsedDefaultChar=0x0) returned 8 [0076.346] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 2 [0076.346] GetProcessHeap () returned 0xd20000 [0076.346] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0076.346] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 1 [0076.346] lstrcmpiW (lpString1="Windows10Upgrade", lpString2=".") returned 1 [0076.346] lstrcmpiW (lpString1="Windows10Upgrade", lpString2="..") returned 1 [0076.346] lstrcatW (in: lpString1="C:\\", lpString2="Windows10Upgrade" | out: lpString1="C:\\Windows10Upgrade") returned="C:\\Windows10Upgrade" [0076.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Windows10Upgrade", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0076.346] GetProcessHeap () returned 0xd20000 [0076.346] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x11) returned 0xd365c8 [0076.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Windows10Upgrade", cchWideChar=-1, lpMultiByteStr=0xd365c8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows10Upgrade", lpUsedDefaultChar=0x0) returned 17 [0076.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 3 [0076.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0076.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0076.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 3 [0076.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 3 [0076.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0076.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0076.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 3 [0076.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 3 [0076.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 3 [0076.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 3 [0076.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 3 [0076.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 3 [0076.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 3 [0076.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 3 [0076.347] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 3 [0076.348] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 3 [0076.348] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0076.348] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0076.348] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0076.348] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0076.348] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0076.348] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0076.348] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0076.348] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0076.348] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0076.348] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0076.348] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0076.348] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0076.348] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0076.348] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0076.348] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0076.348] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0076.349] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0076.349] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0076.349] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0076.349] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0076.349] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0076.349] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0076.349] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0076.349] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0076.349] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0076.349] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Windows10Upgrade", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0076.349] lstrcatW (in: lpString1="C:\\Windows10Upgrade", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0076.349] GetProcessHeap () returned 0xd20000 [0076.349] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cbf8 [0076.349] lstrlenW (lpString="C:\\Windows10Upgrade\\") returned 20 [0076.349] GetProcessHeap () returned 0xd20000 [0076.349] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x2a) returned 0xd40038 [0076.349] lstrcpyW (in: lpString1=0xd40038, lpString2="C:\\Windows10Upgrade\\" | out: lpString1="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0076.350] GetProcessHeap () returned 0xd20000 [0076.350] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd365c8 | out: hHeap=0xd20000) returned 1 [0076.350] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 0 [0076.350] FindClose (in: hFindFile=0xd36948 | out: hFindFile=0xd36948) returned 1 [0076.350] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Windows10Upgrade\\" | out: lpString1="C:\\Windows10Upgrade\\") returned="C:\\Windows10Upgrade\\" [0076.350] GetProcessHeap () returned 0xd20000 [0076.350] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd40038 | out: hHeap=0xd20000) returned 1 [0076.350] GetProcessHeap () returned 0xd20000 [0076.350] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0076.351] lstrlenW (lpString="C:\\Windows10Upgrade\\") returned 20 [0076.351] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\*") returned="C:\\Windows10Upgrade\\*" [0076.351] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd36d08 [0076.366] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0076.366] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.368] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0076.368] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0076.368] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea35483d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea355be9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2052", cAlternateFileName="")) returned 1 [0076.368] lstrcmpiW (lpString1="2052", lpString2=".") returned 1 [0076.368] lstrcmpiW (lpString1="2052", lpString2="..") returned 1 [0076.368] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="2052" | out: lpString1="C:\\Windows10Upgrade\\2052") returned="C:\\Windows10Upgrade\\2052" [0076.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="2052", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0076.369] GetProcessHeap () returned 0xd20000 [0076.369] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x5) returned 0xd3ccf8 [0076.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="2052", cchWideChar=-1, lpMultiByteStr=0xd3ccf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2052", lpUsedDefaultChar=0x0) returned 5 [0076.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0076.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0076.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0076.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0076.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0076.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0076.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0076.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0076.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0076.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0076.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0076.369] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0076.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0076.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0076.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0076.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0076.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0076.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0076.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0076.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0076.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0076.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0076.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0076.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0076.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0076.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0076.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0076.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0076.370] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0076.371] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0076.371] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0076.371] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0076.371] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0076.371] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0076.371] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0076.371] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0076.371] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0076.371] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0076.371] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0076.371] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0076.371] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0076.371] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0076.371] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="2052", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0076.371] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\2052", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\2052\\") returned="C:\\Windows10Upgrade\\2052\\" [0076.371] GetProcessHeap () returned 0xd20000 [0076.371] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cd08 [0076.372] lstrlenW (lpString="C:\\Windows10Upgrade\\2052\\") returned 25 [0076.372] GetProcessHeap () returned 0xd20000 [0076.372] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x34) returned 0xd36948 [0076.372] lstrcpyW (in: lpString1=0xd36948, lpString2="C:\\Windows10Upgrade\\2052\\" | out: lpString1="C:\\Windows10Upgrade\\2052\\") returned="C:\\Windows10Upgrade\\2052\\" [0076.372] GetProcessHeap () returned 0xd20000 [0076.372] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0076.372] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3659ec, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3659ec, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x704c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="appraiserxp.dll", cAlternateFileName="APPRAI~1.DLL")) returned 1 [0076.372] lstrcmpiW (lpString1="appraiserxp.dll", lpString2=".") returned 1 [0076.372] lstrcmpiW (lpString1="appraiserxp.dll", lpString2="..") returned 1 [0076.372] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="appraiserxp.dll" | out: lpString1="C:\\Windows10Upgrade\\appraiserxp.dll") returned="C:\\Windows10Upgrade\\appraiserxp.dll" [0076.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appraiserxp.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0076.372] GetProcessHeap () returned 0xd20000 [0076.372] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd44690 [0076.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="appraiserxp.dll", cchWideChar=-1, lpMultiByteStr=0xd44690, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="appraiserxp.dll", lpUsedDefaultChar=0x0) returned 16 [0076.372] lstrlenA (lpString="appraiserxp.dll") returned 15 [0076.372] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0076.372] lstrlenA (lpString="appraiserxp.dll") returned 15 [0076.373] lstrlenA (lpString=".dll") returned 4 [0076.373] lstrlenA (lpString=".dll") returned 4 [0076.373] lstrlenA (lpString="appraiserxp.dll") returned 15 [0076.373] lstrcmpiA (lpString1=".dll", lpString2=".dll") returned 0 [0076.373] GetProcessHeap () returned 0xd20000 [0076.373] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44690 | out: hHeap=0xd20000) returned 1 [0076.373] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea36cf08, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea36cf08, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x1cec8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bootsect.exe", cAlternateFileName="")) returned 1 [0076.373] lstrcmpiW (lpString1="bootsect.exe", lpString2=".") returned 1 [0076.373] lstrcmpiW (lpString1="bootsect.exe", lpString2="..") returned 1 [0076.373] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="bootsect.exe" | out: lpString1="C:\\Windows10Upgrade\\bootsect.exe") returned="C:\\Windows10Upgrade\\bootsect.exe" [0076.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bootsect.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0076.374] GetProcessHeap () returned 0xd20000 [0076.374] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xd) returned 0xd446a8 [0076.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bootsect.exe", cchWideChar=-1, lpMultiByteStr=0xd446a8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bootsect.exe", lpUsedDefaultChar=0x0) returned 13 [0076.374] lstrlenA (lpString="bootsect.exe") returned 12 [0076.374] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0076.374] lstrlenA (lpString="bootsect.exe") returned 12 [0076.374] lstrlenA (lpString=".dll") returned 4 [0076.374] lstrlenA (lpString=".dll") returned 4 [0076.374] lstrlenA (lpString="bootsect.exe") returned 12 [0076.374] lstrcmpiA (lpString1=".exe", lpString2=".dll") returned 1 [0076.374] lstrlenA (lpString="bootsect.exe") returned 12 [0076.374] lstrlenA (lpString=".ini") returned 4 [0076.374] lstrlenA (lpString=".ini") returned 4 [0076.374] lstrlenA (lpString="bootsect.exe") returned 12 [0076.374] lstrcmpiA (lpString1=".exe", lpString2=".ini") returned -1 [0076.374] lstrlenA (lpString="bootsect.exe") returned 12 [0076.374] lstrlenA (lpString=".inc") returned 4 [0076.374] lstrlenA (lpString=".inc") returned 4 [0076.375] lstrlenA (lpString="bootsect.exe") returned 12 [0076.375] lstrcmpiA (lpString1=".exe", lpString2=".inc") returned -1 [0076.375] lstrcmpiW (lpString1="bootsect.exe", lpString2="HOW_RECOVER.html") returned -1 [0076.375] lstrcmpiW (lpString1="bootsect.exe", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0076.375] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0076.375] lstrcmpiW (lpString1="bootsect.exe", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0076.375] GetProcessHeap () returned 0xd20000 [0076.375] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd426c0 [0076.375] CreateFileW (lpFileName="C:\\Windows10Upgrade\\bootsect.exe" (normalized: "c:\\windows10upgrade\\bootsect.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0076.377] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=118472) returned 1 [0076.377] GetProcessHeap () returned 0xd20000 [0076.377] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd2e898 [0076.377] GetProcessHeap () returned 0xd20000 [0076.377] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0076.377] lstrlenW (lpString="C:\\Windows10Upgrade\\bootsect.exe") returned 32 [0076.377] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0076.377] GetProcessHeap () returned 0xd20000 [0076.377] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0076.378] GetProcessHeap () returned 0xd20000 [0076.378] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x388) returned 0xd47c30 [0076.378] lstrlenA (lpString="rsa_encrypt") returned 11 [0076.378] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0076.380] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0076.380] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0076.380] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0076.380] GetProcessHeap () returned 0xd20000 [0076.380] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0076.380] lstrlenA (lpString="010001") returned 6 [0076.380] GetProcessHeap () returned 0xd20000 [0076.380] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd38 [0076.381] GetProcessHeap () returned 0xd20000 [0076.381] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0076.381] GetProcessHeap () returned 0xd20000 [0076.381] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd30f70 [0076.381] GetProcessHeap () returned 0xd20000 [0076.381] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0076.381] GetProcessHeap () returned 0xd20000 [0076.381] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd2f820 [0076.381] GetProcessHeap () returned 0xd20000 [0076.381] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd31c30 [0076.381] GetProcessHeap () returned 0xd20000 [0076.381] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc38 [0076.381] GetProcessHeap () returned 0xd20000 [0076.381] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd2fbe0 [0076.381] GetProcessHeap () returned 0xd20000 [0076.381] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0076.381] GetProcessHeap () returned 0xd20000 [0076.381] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd31998 [0076.381] GetProcessHeap () returned 0xd20000 [0076.382] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd31810 [0076.382] GetProcessHeap () returned 0xd20000 [0076.382] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44fb0 [0076.382] GetProcessHeap () returned 0xd20000 [0076.382] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0076.382] GetProcessHeap () returned 0xd20000 [0076.382] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444e0 [0076.382] GetProcessHeap () returned 0xd20000 [0076.382] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd328d8 [0076.382] GetProcessHeap () returned 0xd20000 [0076.382] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31810 | out: hHeap=0xd20000) returned 1 [0076.382] GetProcessHeap () returned 0xd20000 [0076.382] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd2f9c0 [0076.382] GetProcessHeap () returned 0xd20000 [0076.382] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd328d8 | out: hHeap=0xd20000) returned 1 [0076.382] GetProcessHeap () returned 0xd20000 [0076.382] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0076.382] GetProcessHeap () returned 0xd20000 [0076.383] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446c0 [0076.383] GetProcessHeap () returned 0xd20000 [0076.383] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0076.383] GetProcessHeap () returned 0xd20000 [0076.383] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0076.383] GetProcessHeap () returned 0xd20000 [0076.383] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0076.383] GetProcessHeap () returned 0xd20000 [0076.383] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0076.383] GetProcessHeap () returned 0xd20000 [0076.383] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0076.383] GetProcessHeap () returned 0xd20000 [0076.383] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0076.383] GetProcessHeap () returned 0xd20000 [0076.383] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd328d8 [0076.383] GetProcessHeap () returned 0xd20000 [0076.383] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446c0 | out: hHeap=0xd20000) returned 1 [0076.383] GetProcessHeap () returned 0xd20000 [0076.383] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd3ddb0 [0076.384] GetProcessHeap () returned 0xd20000 [0076.384] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd328d8 | out: hHeap=0xd20000) returned 1 [0076.384] GetProcessHeap () returned 0xd20000 [0076.384] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0076.384] GetProcessHeap () returned 0xd20000 [0076.384] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0076.384] GetProcessHeap () returned 0xd20000 [0076.384] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0076.384] GetProcessHeap () returned 0xd20000 [0076.384] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0076.384] GetProcessHeap () returned 0xd20000 [0076.384] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0076.384] GetProcessHeap () returned 0xd20000 [0076.384] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0076.384] GetProcessHeap () returned 0xd20000 [0076.384] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0076.384] GetProcessHeap () returned 0xd20000 [0076.384] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0076.385] GetProcessHeap () returned 0xd20000 [0076.385] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0076.385] GetProcessHeap () returned 0xd20000 [0076.385] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0076.385] GetProcessHeap () returned 0xd20000 [0076.385] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0076.385] GetProcessHeap () returned 0xd20000 [0076.385] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0076.385] GetProcessHeap () returned 0xd20000 [0076.385] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0076.385] GetProcessHeap () returned 0xd20000 [0076.385] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0076.385] GetProcessHeap () returned 0xd20000 [0076.385] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0076.385] GetProcessHeap () returned 0xd20000 [0076.385] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0076.385] GetProcessHeap () returned 0xd20000 [0076.385] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0076.385] GetProcessHeap () returned 0xd20000 [0076.386] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0076.386] GetProcessHeap () returned 0xd20000 [0076.386] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0076.386] GetProcessHeap () returned 0xd20000 [0076.386] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0076.386] GetProcessHeap () returned 0xd20000 [0076.386] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0076.386] GetProcessHeap () returned 0xd20000 [0076.386] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0076.386] GetProcessHeap () returned 0xd20000 [0076.386] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0076.386] GetProcessHeap () returned 0xd20000 [0076.386] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0076.386] GetProcessHeap () returned 0xd20000 [0076.386] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0076.386] GetProcessHeap () returned 0xd20000 [0076.386] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0076.387] GetProcessHeap () returned 0xd20000 [0076.387] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0076.387] GetProcessHeap () returned 0xd20000 [0076.387] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0076.387] GetProcessHeap () returned 0xd20000 [0076.387] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0076.387] GetProcessHeap () returned 0xd20000 [0076.387] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0076.387] GetProcessHeap () returned 0xd20000 [0076.387] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0076.387] GetProcessHeap () returned 0xd20000 [0076.387] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0076.387] GetProcessHeap () returned 0xd20000 [0076.387] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0076.387] GetProcessHeap () returned 0xd20000 [0076.387] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0076.387] GetProcessHeap () returned 0xd20000 [0076.388] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0076.388] GetProcessHeap () returned 0xd20000 [0076.388] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0076.388] GetProcessHeap () returned 0xd20000 [0076.388] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0076.388] GetProcessHeap () returned 0xd20000 [0076.388] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0076.388] GetProcessHeap () returned 0xd20000 [0076.388] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0076.388] GetProcessHeap () returned 0xd20000 [0076.388] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0076.388] GetProcessHeap () returned 0xd20000 [0076.388] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0076.388] GetProcessHeap () returned 0xd20000 [0076.388] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0076.388] GetProcessHeap () returned 0xd20000 [0076.388] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0076.388] GetProcessHeap () returned 0xd20000 [0076.389] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0076.389] GetProcessHeap () returned 0xd20000 [0076.389] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0076.470] GetProcessHeap () returned 0xd20000 [0076.470] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0076.470] GetProcessHeap () returned 0xd20000 [0076.470] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0076.470] GetProcessHeap () returned 0xd20000 [0076.470] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0076.471] GetProcessHeap () returned 0xd20000 [0076.471] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0076.471] GetProcessHeap () returned 0xd20000 [0076.471] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0076.471] GetProcessHeap () returned 0xd20000 [0076.471] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0076.471] GetProcessHeap () returned 0xd20000 [0076.471] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0076.471] GetProcessHeap () returned 0xd20000 [0076.471] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0076.471] GetProcessHeap () returned 0xd20000 [0076.471] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0076.471] GetProcessHeap () returned 0xd20000 [0076.471] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0076.471] GetProcessHeap () returned 0xd20000 [0076.471] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0076.471] GetProcessHeap () returned 0xd20000 [0076.472] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0076.472] GetProcessHeap () returned 0xd20000 [0076.472] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0076.472] GetProcessHeap () returned 0xd20000 [0076.472] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0076.472] GetProcessHeap () returned 0xd20000 [0076.472] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0076.472] GetProcessHeap () returned 0xd20000 [0076.472] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0076.472] GetProcessHeap () returned 0xd20000 [0076.472] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0076.472] GetProcessHeap () returned 0xd20000 [0076.472] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0076.472] GetProcessHeap () returned 0xd20000 [0076.472] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0076.472] GetProcessHeap () returned 0xd20000 [0076.472] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0076.472] GetProcessHeap () returned 0xd20000 [0076.472] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0076.473] GetProcessHeap () returned 0xd20000 [0076.473] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0076.473] GetProcessHeap () returned 0xd20000 [0076.473] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0076.473] GetProcessHeap () returned 0xd20000 [0076.473] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0076.473] GetProcessHeap () returned 0xd20000 [0076.473] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0076.473] GetProcessHeap () returned 0xd20000 [0076.473] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0076.473] GetProcessHeap () returned 0xd20000 [0076.473] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0076.473] GetProcessHeap () returned 0xd20000 [0076.473] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0076.473] GetProcessHeap () returned 0xd20000 [0076.473] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0076.473] GetProcessHeap () returned 0xd20000 [0076.473] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0076.474] GetProcessHeap () returned 0xd20000 [0076.474] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0076.474] GetProcessHeap () returned 0xd20000 [0076.474] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0076.474] GetProcessHeap () returned 0xd20000 [0076.474] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0076.474] GetProcessHeap () returned 0xd20000 [0076.474] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0076.474] GetProcessHeap () returned 0xd20000 [0076.474] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0076.474] GetProcessHeap () returned 0xd20000 [0076.474] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0076.474] GetProcessHeap () returned 0xd20000 [0076.474] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0076.474] GetProcessHeap () returned 0xd20000 [0076.474] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0076.474] GetProcessHeap () returned 0xd20000 [0076.474] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0076.474] GetProcessHeap () returned 0xd20000 [0076.474] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0076.475] GetProcessHeap () returned 0xd20000 [0076.475] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0076.475] GetProcessHeap () returned 0xd20000 [0076.475] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0076.475] GetProcessHeap () returned 0xd20000 [0076.475] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0076.475] GetProcessHeap () returned 0xd20000 [0076.475] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0076.475] GetProcessHeap () returned 0xd20000 [0076.475] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0076.475] GetProcessHeap () returned 0xd20000 [0076.475] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0076.475] GetProcessHeap () returned 0xd20000 [0076.475] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0076.475] GetProcessHeap () returned 0xd20000 [0076.475] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0076.475] GetProcessHeap () returned 0xd20000 [0076.475] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0076.475] GetProcessHeap () returned 0xd20000 [0076.476] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0076.476] GetProcessHeap () returned 0xd20000 [0076.476] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0076.476] GetProcessHeap () returned 0xd20000 [0076.476] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0076.476] GetProcessHeap () returned 0xd20000 [0076.476] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0076.476] GetProcessHeap () returned 0xd20000 [0076.476] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0076.476] GetProcessHeap () returned 0xd20000 [0076.476] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0076.476] GetProcessHeap () returned 0xd20000 [0076.476] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0076.476] GetProcessHeap () returned 0xd20000 [0076.476] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0076.476] GetProcessHeap () returned 0xd20000 [0076.476] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0076.476] GetProcessHeap () returned 0xd20000 [0076.476] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0076.477] GetProcessHeap () returned 0xd20000 [0076.477] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0076.477] GetProcessHeap () returned 0xd20000 [0076.477] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0076.477] GetProcessHeap () returned 0xd20000 [0076.477] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0076.477] GetProcessHeap () returned 0xd20000 [0076.477] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0076.477] GetProcessHeap () returned 0xd20000 [0076.477] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0076.477] GetProcessHeap () returned 0xd20000 [0076.477] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0076.477] GetProcessHeap () returned 0xd20000 [0076.477] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0076.477] GetProcessHeap () returned 0xd20000 [0076.477] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0076.477] GetProcessHeap () returned 0xd20000 [0076.477] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0076.477] GetProcessHeap () returned 0xd20000 [0076.477] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0076.478] GetProcessHeap () returned 0xd20000 [0076.478] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0076.478] GetProcessHeap () returned 0xd20000 [0076.478] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0076.478] GetProcessHeap () returned 0xd20000 [0076.478] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0076.478] GetProcessHeap () returned 0xd20000 [0076.478] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0076.478] GetProcessHeap () returned 0xd20000 [0076.478] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0076.478] GetProcessHeap () returned 0xd20000 [0076.478] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0076.478] GetProcessHeap () returned 0xd20000 [0076.478] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0076.478] GetProcessHeap () returned 0xd20000 [0076.478] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0076.478] GetProcessHeap () returned 0xd20000 [0076.478] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0076.479] GetProcessHeap () returned 0xd20000 [0076.479] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0076.479] GetProcessHeap () returned 0xd20000 [0076.479] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0076.479] GetProcessHeap () returned 0xd20000 [0076.479] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0076.479] GetProcessHeap () returned 0xd20000 [0076.479] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0076.479] GetProcessHeap () returned 0xd20000 [0076.479] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0076.479] GetProcessHeap () returned 0xd20000 [0076.479] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0076.479] GetProcessHeap () returned 0xd20000 [0076.479] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0076.479] GetProcessHeap () returned 0xd20000 [0076.479] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0076.479] GetProcessHeap () returned 0xd20000 [0076.479] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0076.480] GetProcessHeap () returned 0xd20000 [0076.480] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0076.480] GetProcessHeap () returned 0xd20000 [0076.480] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0076.480] GetProcessHeap () returned 0xd20000 [0076.480] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0076.480] GetProcessHeap () returned 0xd20000 [0076.480] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0076.480] GetProcessHeap () returned 0xd20000 [0076.480] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0076.480] GetProcessHeap () returned 0xd20000 [0076.480] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0076.480] GetProcessHeap () returned 0xd20000 [0076.480] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0076.480] GetProcessHeap () returned 0xd20000 [0076.480] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0076.480] GetProcessHeap () returned 0xd20000 [0076.481] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0076.481] GetProcessHeap () returned 0xd20000 [0076.481] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0076.481] GetProcessHeap () returned 0xd20000 [0076.481] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0076.481] GetProcessHeap () returned 0xd20000 [0076.481] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0076.481] GetProcessHeap () returned 0xd20000 [0076.481] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0076.481] GetProcessHeap () returned 0xd20000 [0076.481] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0076.481] GetProcessHeap () returned 0xd20000 [0076.481] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0076.481] GetProcessHeap () returned 0xd20000 [0076.481] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0076.481] GetProcessHeap () returned 0xd20000 [0076.481] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0076.481] GetProcessHeap () returned 0xd20000 [0076.481] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0076.482] GetProcessHeap () returned 0xd20000 [0076.482] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0076.482] GetProcessHeap () returned 0xd20000 [0076.482] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0076.482] GetProcessHeap () returned 0xd20000 [0076.482] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0076.482] GetProcessHeap () returned 0xd20000 [0076.482] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0076.482] GetProcessHeap () returned 0xd20000 [0076.482] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0076.482] GetProcessHeap () returned 0xd20000 [0076.482] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0076.482] GetProcessHeap () returned 0xd20000 [0076.482] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0076.482] GetProcessHeap () returned 0xd20000 [0076.482] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0076.483] GetProcessHeap () returned 0xd20000 [0076.483] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0076.484] GetProcessHeap () returned 0xd20000 [0076.484] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0076.484] GetProcessHeap () returned 0xd20000 [0076.484] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0076.484] GetProcessHeap () returned 0xd20000 [0076.484] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0076.484] GetProcessHeap () returned 0xd20000 [0076.484] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0076.484] GetProcessHeap () returned 0xd20000 [0076.484] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0076.484] GetProcessHeap () returned 0xd20000 [0076.484] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0076.484] GetProcessHeap () returned 0xd20000 [0076.484] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0076.484] GetProcessHeap () returned 0xd20000 [0076.484] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0076.484] GetProcessHeap () returned 0xd20000 [0076.484] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0076.485] GetProcessHeap () returned 0xd20000 [0076.485] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0076.485] GetProcessHeap () returned 0xd20000 [0076.485] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0076.485] GetProcessHeap () returned 0xd20000 [0076.485] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31998 | out: hHeap=0xd20000) returned 1 [0076.485] GetProcessHeap () returned 0xd20000 [0076.485] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f9c0 | out: hHeap=0xd20000) returned 1 [0076.485] GetProcessHeap () returned 0xd20000 [0076.485] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0076.485] GetProcessHeap () returned 0xd20000 [0076.485] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ddb0 | out: hHeap=0xd20000) returned 1 [0076.485] GetProcessHeap () returned 0xd20000 [0076.485] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444e0 | out: hHeap=0xd20000) returned 1 [0076.485] GetProcessHeap () returned 0xd20000 [0076.485] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0076.485] GetProcessHeap () returned 0xd20000 [0076.485] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31c30 | out: hHeap=0xd20000) returned 1 [0076.485] GetProcessHeap () returned 0xd20000 [0076.486] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd30f70 | out: hHeap=0xd20000) returned 1 [0076.486] GetProcessHeap () returned 0xd20000 [0076.486] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2fbe0 | out: hHeap=0xd20000) returned 1 [0076.486] GetProcessHeap () returned 0xd20000 [0076.486] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0076.486] GetProcessHeap () returned 0xd20000 [0076.486] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0076.486] WriteFile (in: hFile=0x230, lpBuffer=0xd47c30*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd47c30*, lpNumberOfBytesWritten=0x299d864*=0x388, lpOverlapped=0x0) returned 1 [0076.671] GetProcessHeap () returned 0xd20000 [0076.671] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd47c30, Size=0x30) returned 0xd47c30 [0076.671] GetProcessHeap () returned 0xd20000 [0076.671] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0076.671] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0076.672] GetProcessHeap () returned 0xd20000 [0076.672] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1ced0) returned 0xd47c68 [0076.674] ReadFile (in: hFile=0x230, lpBuffer=0xd47c68, nNumberOfBytesToRead=0x1ced0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd47c68*, lpNumberOfBytesRead=0x299d7e8*=0x1ced0, lpOverlapped=0x0) returned 1 [0076.679] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0076.679] WriteFile (in: hFile=0x230, lpBuffer=0xd47c68*, nNumberOfBytesToWrite=0x1ced0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd47c68*, lpNumberOfBytesWritten=0x299d7e4*=0x1ced0, lpOverlapped=0x0) returned 1 [0076.914] GetProcessHeap () returned 0xd20000 [0076.914] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd47c68 | out: hHeap=0xd20000) returned 1 [0076.914] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0076.914] WriteFile (in: hFile=0x230, lpBuffer=0xd47c30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd47c30*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0076.916] CloseHandle (hObject=0x230) returned 1 [0076.923] GetProcessHeap () returned 0xd20000 [0076.923] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd426c0 | out: hHeap=0xd20000) returned 1 [0076.923] GetProcessHeap () returned 0xd20000 [0076.923] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2e898 | out: hHeap=0xd20000) returned 1 [0076.923] GetProcessHeap () returned 0xd20000 [0076.923] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0076.923] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\bootsect.exe" | out: lpString1="C:\\Windows10Upgrade\\bootsect.exe") returned="C:\\Windows10Upgrade\\bootsect.exe" [0076.923] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\bootsect.exe", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\bootsect.exe.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\bootsect.exe.[ponce.lorena@aol.com]" [0076.923] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\bootsect.exe" (normalized: "c:\\windows10upgrade\\bootsect.exe"), lpNewFileName="C:\\Windows10Upgrade\\bootsect.exe.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\bootsect.exe.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0076.924] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\bootsect.exe" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0076.924] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0076.924] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\HOW_RECOVER.html" [0076.924] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\how_recover.html")) returned 0xffffffff [0076.924] CreateFileW (lpFileName="C:\\Windows10Upgrade\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\how_recover.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0076.925] GetProcessHeap () returned 0xd20000 [0076.925] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd2e898 [0076.925] GetProcessHeap () returned 0xd20000 [0076.925] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0076.932] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.934] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.934] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.934] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.934] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.934] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.934] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.935] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.935] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.935] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.935] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.935] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.935] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.935] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.935] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.936] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.936] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.936] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.936] GetProcessHeap () returned 0xd20000 [0076.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2e898 | out: hHeap=0xd20000) returned 1 [0076.936] GetProcessHeap () returned 0xd20000 [0076.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0076.936] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x299d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x299d9d0*=0x300, lpOverlapped=0x0) returned 1 [0076.937] GetProcessHeap () returned 0xd20000 [0076.937] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd2e898 [0076.937] GetProcessHeap () returned 0xd20000 [0076.937] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0076.944] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.945] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.945] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.945] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.945] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.945] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.945] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.945] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.945] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.946] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.946] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.946] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.946] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.946] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.946] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.946] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.946] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.946] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.947] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.947] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.947] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.947] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.947] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.947] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.947] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.947] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.947] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.948] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.948] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.948] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.948] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.948] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.948] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.948] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.948] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.948] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.949] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.949] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.949] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.949] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.949] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.949] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.949] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.949] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.949] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.950] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.950] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.950] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.950] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.950] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.950] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.950] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.950] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.951] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.951] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.951] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.951] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.951] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.951] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.951] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.952] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.952] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.952] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.952] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.952] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.952] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.952] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.952] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.953] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.953] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.953] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.953] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.953] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.953] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.953] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.954] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.954] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.954] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.954] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.954] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.954] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.954] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.954] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.955] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.955] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.955] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.955] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.955] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.955] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.955] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.955] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.956] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.956] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.956] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.956] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.956] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.956] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.956] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.956] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.956] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.957] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.957] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.957] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.957] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.957] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.957] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.957] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.957] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.957] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.958] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0076.958] GetProcessHeap () returned 0xd20000 [0076.958] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2e898 | out: hHeap=0xd20000) returned 1 [0076.958] GetProcessHeap () returned 0xd20000 [0076.958] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0076.958] CloseHandle (hObject=0x230) returned 1 [0076.958] GetProcessHeap () returned 0xd20000 [0076.958] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446a8 | out: hHeap=0xd20000) returned 1 [0076.958] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea350dad, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea350dad, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xb08c3ee, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Configuration.ini", cAlternateFileName="CONFIG~1.INI")) returned 1 [0076.959] lstrcmpiW (lpString1="Configuration.ini", lpString2=".") returned 1 [0076.959] lstrcmpiW (lpString1="Configuration.ini", lpString2="..") returned 1 [0076.959] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="Configuration.ini" | out: lpString1="C:\\Windows10Upgrade\\Configuration.ini") returned="C:\\Windows10Upgrade\\Configuration.ini" [0076.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Configuration.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0076.959] GetProcessHeap () returned 0xd20000 [0076.959] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x12) returned 0xd36768 [0076.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Configuration.ini", cchWideChar=-1, lpMultiByteStr=0xd36768, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Configuration.ini", lpUsedDefaultChar=0x0) returned 18 [0076.959] lstrlenA (lpString="Configuration.ini") returned 17 [0076.959] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0076.959] lstrlenA (lpString="Configuration.ini") returned 17 [0076.959] lstrlenA (lpString=".dll") returned 4 [0076.959] lstrlenA (lpString=".dll") returned 4 [0076.959] lstrlenA (lpString="Configuration.ini") returned 17 [0076.959] lstrcmpiA (lpString1=".ini", lpString2=".dll") returned 1 [0076.959] lstrlenA (lpString="Configuration.ini") returned 17 [0076.959] lstrlenA (lpString=".ini") returned 4 [0076.959] lstrlenA (lpString=".ini") returned 4 [0076.959] lstrlenA (lpString="Configuration.ini") returned 17 [0076.960] lstrcmpiA (lpString1=".ini", lpString2=".ini") returned 0 [0076.960] GetProcessHeap () returned 0xd20000 [0076.960] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36768 | out: hHeap=0xd20000) returned 1 [0076.960] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea36e29e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea36e29e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xf0c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cosquery.dll", cAlternateFileName="")) returned 1 [0076.960] lstrcmpiW (lpString1="cosquery.dll", lpString2=".") returned 1 [0076.960] lstrcmpiW (lpString1="cosquery.dll", lpString2="..") returned 1 [0076.960] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="cosquery.dll" | out: lpString1="C:\\Windows10Upgrade\\cosquery.dll") returned="C:\\Windows10Upgrade\\cosquery.dll" [0076.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cosquery.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0076.960] GetProcessHeap () returned 0xd20000 [0076.960] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xd) returned 0xd444e0 [0076.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cosquery.dll", cchWideChar=-1, lpMultiByteStr=0xd444e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cosquery.dll", lpUsedDefaultChar=0x0) returned 13 [0076.960] lstrlenA (lpString="cosquery.dll") returned 12 [0076.960] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0076.960] lstrlenA (lpString="cosquery.dll") returned 12 [0076.960] lstrlenA (lpString=".dll") returned 4 [0076.960] lstrlenA (lpString=".dll") returned 4 [0076.960] lstrlenA (lpString="cosquery.dll") returned 12 [0076.960] lstrcmpiA (lpString1=".dll", lpString2=".dll") returned 0 [0076.960] GetProcessHeap () returned 0xd20000 [0076.960] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444e0 | out: hHeap=0xd20000) returned 1 [0076.961] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea370998, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea370998, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x508c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DevInv.dll", cAlternateFileName="")) returned 1 [0076.961] lstrcmpiW (lpString1="DevInv.dll", lpString2=".") returned 1 [0076.961] lstrcmpiW (lpString1="DevInv.dll", lpString2="..") returned 1 [0076.961] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="DevInv.dll" | out: lpString1="C:\\Windows10Upgrade\\DevInv.dll") returned="C:\\Windows10Upgrade\\DevInv.dll" [0076.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DevInv.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0076.961] GetProcessHeap () returned 0xd20000 [0076.961] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xb) returned 0xd446c0 [0076.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DevInv.dll", cchWideChar=-1, lpMultiByteStr=0xd446c0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DevInv.dll", lpUsedDefaultChar=0x0) returned 11 [0076.961] lstrlenA (lpString="DevInv.dll") returned 10 [0076.961] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0076.961] lstrlenA (lpString="DevInv.dll") returned 10 [0076.961] lstrlenA (lpString=".dll") returned 4 [0076.961] lstrlenA (lpString=".dll") returned 4 [0076.961] lstrlenA (lpString="DevInv.dll") returned 10 [0076.961] lstrcmpiA (lpString1=".dll", lpString2=".dll") returned 0 [0076.961] GetProcessHeap () returned 0xd20000 [0076.961] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446c0 | out: hHeap=0xd20000) returned 1 [0076.961] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3757e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea377ed3, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dll1", cAlternateFileName="")) returned 1 [0076.962] lstrcmpiW (lpString1="dll1", lpString2=".") returned 1 [0076.962] lstrcmpiW (lpString1="dll1", lpString2="..") returned 1 [0076.962] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="dll1" | out: lpString1="C:\\Windows10Upgrade\\dll1") returned="C:\\Windows10Upgrade\\dll1" [0076.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dll1", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0076.962] GetProcessHeap () returned 0xd20000 [0076.962] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x5) returned 0xd3cbe8 [0076.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dll1", cchWideChar=-1, lpMultiByteStr=0xd3cbe8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dll1", lpUsedDefaultChar=0x0) returned 5 [0076.962] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0076.962] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0076.962] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0076.962] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0076.962] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0076.962] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0076.962] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0076.962] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0076.962] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0076.962] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0076.962] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0076.962] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0076.962] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0076.963] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0076.963] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0076.963] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0076.963] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0076.963] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0076.963] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0076.963] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0076.963] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0076.963] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0076.963] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0076.963] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0076.963] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0076.963] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0076.963] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0076.963] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0076.963] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0076.963] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0076.963] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0076.964] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0076.964] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0076.964] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0076.964] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0076.964] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0076.964] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0076.964] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0076.964] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0076.964] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0076.964] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0076.964] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0076.964] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll1", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0076.964] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll1", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\dll1\\") returned="C:\\Windows10Upgrade\\dll1\\" [0076.964] GetProcessHeap () returned 0xd20000 [0076.964] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cc88 [0076.964] lstrlenW (lpString="C:\\Windows10Upgrade\\dll1\\") returned 25 [0076.964] GetProcessHeap () returned 0xd20000 [0076.964] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x34) returned 0xd36a88 [0076.964] lstrcpyW (in: lpString1=0xd36a88, lpString2="C:\\Windows10Upgrade\\dll1\\" | out: lpString1="C:\\Windows10Upgrade\\dll1\\") returned="C:\\Windows10Upgrade\\dll1\\" [0076.965] GetProcessHeap () returned 0xd20000 [0076.965] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0076.965] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea37cd05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37cd05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37cd05, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dll2", cAlternateFileName="")) returned 1 [0076.965] lstrcmpiW (lpString1="dll2", lpString2=".") returned 1 [0076.965] lstrcmpiW (lpString1="dll2", lpString2="..") returned 1 [0076.965] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="dll2" | out: lpString1="C:\\Windows10Upgrade\\dll2") returned="C:\\Windows10Upgrade\\dll2" [0076.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dll2", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0076.965] GetProcessHeap () returned 0xd20000 [0076.965] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x5) returned 0xd3cc08 [0076.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dll2", cchWideChar=-1, lpMultiByteStr=0xd3cc08, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dll2", lpUsedDefaultChar=0x0) returned 5 [0076.965] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0076.965] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0076.965] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0076.965] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0076.965] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0076.965] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0076.965] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0076.965] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0076.965] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0076.965] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0076.966] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0076.966] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0076.966] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0076.966] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0076.966] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0076.966] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0076.966] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0076.966] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0076.966] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0076.966] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0076.966] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0076.966] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0076.966] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0076.966] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0076.966] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0076.966] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0076.966] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0076.966] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0076.966] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0076.967] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0076.967] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0076.967] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0076.967] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0076.967] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0076.967] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0077.075] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0077.076] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0077.076] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0077.076] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0077.076] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0077.076] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0077.076] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0077.076] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="dll2", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0077.076] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll2", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\dll2\\") returned="C:\\Windows10Upgrade\\dll2\\" [0077.076] GetProcessHeap () returned 0xd20000 [0077.076] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cd58 [0077.077] lstrlenW (lpString="C:\\Windows10Upgrade\\dll2\\") returned 25 [0077.077] GetProcessHeap () returned 0xd20000 [0077.077] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x34) returned 0xd49160 [0077.078] lstrcpyW (in: lpString1=0xd49160, lpString2="C:\\Windows10Upgrade\\dll2\\" | out: lpString1="C:\\Windows10Upgrade\\dll2\\") returned="C:\\Windows10Upgrade\\dll2\\" [0077.078] GetProcessHeap () returned 0xd20000 [0077.078] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0077.078] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea380798, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea380798, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x326c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="downloader.dll", cAlternateFileName="DOWNLO~1.DLL")) returned 1 [0077.078] lstrcmpiW (lpString1="downloader.dll", lpString2=".") returned 1 [0077.078] lstrcmpiW (lpString1="downloader.dll", lpString2="..") returned 1 [0077.078] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="downloader.dll" | out: lpString1="C:\\Windows10Upgrade\\downloader.dll") returned="C:\\Windows10Upgrade\\downloader.dll" [0077.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="downloader.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0077.078] GetProcessHeap () returned 0xd20000 [0077.078] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd445e8 [0077.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="downloader.dll", cchWideChar=-1, lpMultiByteStr=0xd445e8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="downloader.dll", lpUsedDefaultChar=0x0) returned 15 [0077.078] lstrlenA (lpString="downloader.dll") returned 14 [0077.078] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0077.078] lstrlenA (lpString="downloader.dll") returned 14 [0077.078] lstrlenA (lpString=".dll") returned 4 [0077.079] lstrlenA (lpString=".dll") returned 4 [0077.079] lstrlenA (lpString="downloader.dll") returned 14 [0077.079] lstrcmpiA (lpString1=".dll", lpString2=".dll") returned 0 [0077.079] GetProcessHeap () returned 0xd20000 [0077.079] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445e8 | out: hHeap=0xd20000) returned 1 [0077.079] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea381b2a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea381b2a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x9d2c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0077.079] lstrcmpiW (lpString1="DW20.EXE", lpString2=".") returned 1 [0077.079] lstrcmpiW (lpString1="DW20.EXE", lpString2="..") returned 1 [0077.079] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="DW20.EXE" | out: lpString1="C:\\Windows10Upgrade\\DW20.EXE") returned="C:\\Windows10Upgrade\\DW20.EXE" [0077.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DW20.EXE", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0077.079] GetProcessHeap () returned 0xd20000 [0077.079] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x9) returned 0xd445e8 [0077.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DW20.EXE", cchWideChar=-1, lpMultiByteStr=0xd445e8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DW20.EXE", lpUsedDefaultChar=0x0) returned 9 [0077.079] lstrlenA (lpString="DW20.EXE") returned 8 [0077.079] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0077.079] lstrlenA (lpString="DW20.EXE") returned 8 [0077.079] lstrlenA (lpString=".dll") returned 4 [0077.080] lstrlenA (lpString=".dll") returned 4 [0077.080] lstrlenA (lpString="DW20.EXE") returned 8 [0077.080] lstrcmpiA (lpString1=".EXE", lpString2=".dll") returned 1 [0077.080] lstrlenA (lpString="DW20.EXE") returned 8 [0077.080] lstrlenA (lpString=".ini") returned 4 [0077.080] lstrlenA (lpString=".ini") returned 4 [0077.080] lstrlenA (lpString="DW20.EXE") returned 8 [0077.080] lstrcmpiA (lpString1=".EXE", lpString2=".ini") returned -1 [0077.080] lstrlenA (lpString="DW20.EXE") returned 8 [0077.080] lstrlenA (lpString=".inc") returned 4 [0077.080] lstrlenA (lpString=".inc") returned 4 [0077.080] lstrlenA (lpString="DW20.EXE") returned 8 [0077.080] lstrcmpiA (lpString1=".EXE", lpString2=".inc") returned -1 [0077.080] lstrcmpiW (lpString1="DW20.EXE", lpString2="HOW_RECOVER.html") returned -1 [0077.080] lstrcmpiW (lpString1="DW20.EXE", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0077.080] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0077.080] lstrcmpiW (lpString1="DW20.EXE", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0077.080] GetProcessHeap () returned 0xd20000 [0077.080] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42850 [0077.080] CreateFileW (lpFileName="C:\\Windows10Upgrade\\DW20.EXE" (normalized: "c:\\windows10upgrade\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0077.082] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=643784) returned 1 [0077.082] GetProcessHeap () returned 0xd20000 [0077.083] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd2e898 [0077.083] GetProcessHeap () returned 0xd20000 [0077.083] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0077.083] lstrlenW (lpString="C:\\Windows10Upgrade\\DW20.EXE") returned 28 [0077.083] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0077.083] GetProcessHeap () returned 0xd20000 [0077.083] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0077.083] GetProcessHeap () returned 0xd20000 [0077.083] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x388) returned 0xd49478 [0077.083] lstrlenA (lpString="rsa_encrypt") returned 11 [0077.083] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0077.086] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0077.086] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0077.086] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0077.086] GetProcessHeap () returned 0xd20000 [0077.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0077.086] lstrlenA (lpString="010001") returned 6 [0077.086] GetProcessHeap () returned 0xd20000 [0077.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cdb8 [0077.087] GetProcessHeap () returned 0xd20000 [0077.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0077.087] GetProcessHeap () returned 0xd20000 [0077.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd30f70 [0077.087] GetProcessHeap () returned 0xd20000 [0077.087] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0077.087] GetProcessHeap () returned 0xd20000 [0077.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd2f820 [0077.087] GetProcessHeap () returned 0xd20000 [0077.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd2fbe0 [0077.087] GetProcessHeap () returned 0xd20000 [0077.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc48 [0077.087] GetProcessHeap () returned 0xd20000 [0077.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd31c30 [0077.087] GetProcessHeap () returned 0xd20000 [0077.087] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0077.087] GetProcessHeap () returned 0xd20000 [0077.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd31998 [0077.087] GetProcessHeap () returned 0xd20000 [0077.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd328d8 [0077.087] GetProcessHeap () returned 0xd20000 [0077.088] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd451e0 [0077.088] GetProcessHeap () returned 0xd20000 [0077.088] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0077.088] GetProcessHeap () returned 0xd20000 [0077.088] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445d0 [0077.088] GetProcessHeap () returned 0xd20000 [0077.088] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd31810 [0077.088] GetProcessHeap () returned 0xd20000 [0077.088] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd328d8 | out: hHeap=0xd20000) returned 1 [0077.088] GetProcessHeap () returned 0xd20000 [0077.088] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd2f9c0 [0077.088] GetProcessHeap () returned 0xd20000 [0077.088] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31810 | out: hHeap=0xd20000) returned 1 [0077.088] GetProcessHeap () returned 0xd20000 [0077.088] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0077.088] GetProcessHeap () returned 0xd20000 [0077.088] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44600 [0077.088] GetProcessHeap () returned 0xd20000 [0077.088] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0077.088] GetProcessHeap () returned 0xd20000 [0077.088] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0077.088] GetProcessHeap () returned 0xd20000 [0077.088] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0077.089] GetProcessHeap () returned 0xd20000 [0077.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0077.089] GetProcessHeap () returned 0xd20000 [0077.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0077.089] GetProcessHeap () returned 0xd20000 [0077.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0077.089] GetProcessHeap () returned 0xd20000 [0077.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd31810 [0077.089] GetProcessHeap () returned 0xd20000 [0077.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44600 | out: hHeap=0xd20000) returned 1 [0077.089] GetProcessHeap () returned 0xd20000 [0077.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd3ddb0 [0077.089] GetProcessHeap () returned 0xd20000 [0077.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31810 | out: hHeap=0xd20000) returned 1 [0077.089] GetProcessHeap () returned 0xd20000 [0077.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0077.089] GetProcessHeap () returned 0xd20000 [0077.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0077.089] GetProcessHeap () returned 0xd20000 [0077.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0077.089] GetProcessHeap () returned 0xd20000 [0077.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0077.089] GetProcessHeap () returned 0xd20000 [0077.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0077.090] GetProcessHeap () returned 0xd20000 [0077.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0077.090] GetProcessHeap () returned 0xd20000 [0077.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0077.090] GetProcessHeap () returned 0xd20000 [0077.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0077.090] GetProcessHeap () returned 0xd20000 [0077.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0077.090] GetProcessHeap () returned 0xd20000 [0077.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0077.090] GetProcessHeap () returned 0xd20000 [0077.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0077.090] GetProcessHeap () returned 0xd20000 [0077.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0077.090] GetProcessHeap () returned 0xd20000 [0077.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0077.090] GetProcessHeap () returned 0xd20000 [0077.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0077.090] GetProcessHeap () returned 0xd20000 [0077.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0077.091] GetProcessHeap () returned 0xd20000 [0077.091] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0077.091] GetProcessHeap () returned 0xd20000 [0077.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0077.091] GetProcessHeap () returned 0xd20000 [0077.091] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0077.091] GetProcessHeap () returned 0xd20000 [0077.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0077.091] GetProcessHeap () returned 0xd20000 [0077.091] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0077.091] GetProcessHeap () returned 0xd20000 [0077.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0077.091] GetProcessHeap () returned 0xd20000 [0077.091] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0077.091] GetProcessHeap () returned 0xd20000 [0077.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0077.091] GetProcessHeap () returned 0xd20000 [0077.091] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0077.091] GetProcessHeap () returned 0xd20000 [0077.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0077.091] GetProcessHeap () returned 0xd20000 [0077.092] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0077.092] GetProcessHeap () returned 0xd20000 [0077.092] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0077.092] GetProcessHeap () returned 0xd20000 [0077.092] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0077.092] GetProcessHeap () returned 0xd20000 [0077.092] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0077.092] GetProcessHeap () returned 0xd20000 [0077.093] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0077.093] GetProcessHeap () returned 0xd20000 [0077.093] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0077.093] GetProcessHeap () returned 0xd20000 [0077.093] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0077.093] GetProcessHeap () returned 0xd20000 [0077.093] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0077.093] GetProcessHeap () returned 0xd20000 [0077.093] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0077.093] GetProcessHeap () returned 0xd20000 [0077.093] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0077.093] GetProcessHeap () returned 0xd20000 [0077.093] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0077.093] GetProcessHeap () returned 0xd20000 [0077.093] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0077.093] GetProcessHeap () returned 0xd20000 [0077.093] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0077.093] GetProcessHeap () returned 0xd20000 [0077.093] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0077.093] GetProcessHeap () returned 0xd20000 [0077.093] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0077.094] GetProcessHeap () returned 0xd20000 [0077.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0077.094] GetProcessHeap () returned 0xd20000 [0077.094] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0077.094] GetProcessHeap () returned 0xd20000 [0077.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0077.094] GetProcessHeap () returned 0xd20000 [0077.094] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0077.094] GetProcessHeap () returned 0xd20000 [0077.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0077.094] GetProcessHeap () returned 0xd20000 [0077.094] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0077.094] GetProcessHeap () returned 0xd20000 [0077.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0077.094] GetProcessHeap () returned 0xd20000 [0077.094] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0077.094] GetProcessHeap () returned 0xd20000 [0077.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0077.094] GetProcessHeap () returned 0xd20000 [0077.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0077.095] GetProcessHeap () returned 0xd20000 [0077.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0077.095] GetProcessHeap () returned 0xd20000 [0077.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0077.095] GetProcessHeap () returned 0xd20000 [0077.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0077.095] GetProcessHeap () returned 0xd20000 [0077.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0077.095] GetProcessHeap () returned 0xd20000 [0077.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0077.095] GetProcessHeap () returned 0xd20000 [0077.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0077.095] GetProcessHeap () returned 0xd20000 [0077.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0077.095] GetProcessHeap () returned 0xd20000 [0077.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0077.095] GetProcessHeap () returned 0xd20000 [0077.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0077.096] GetProcessHeap () returned 0xd20000 [0077.096] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0077.096] GetProcessHeap () returned 0xd20000 [0077.096] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0077.096] GetProcessHeap () returned 0xd20000 [0077.096] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0077.096] GetProcessHeap () returned 0xd20000 [0077.096] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0077.096] GetProcessHeap () returned 0xd20000 [0077.096] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0077.096] GetProcessHeap () returned 0xd20000 [0077.096] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0077.096] GetProcessHeap () returned 0xd20000 [0077.096] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0077.096] GetProcessHeap () returned 0xd20000 [0077.096] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0077.096] GetProcessHeap () returned 0xd20000 [0077.096] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0077.096] GetProcessHeap () returned 0xd20000 [0077.096] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0077.096] GetProcessHeap () returned 0xd20000 [0077.097] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0077.097] GetProcessHeap () returned 0xd20000 [0077.097] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0077.097] GetProcessHeap () returned 0xd20000 [0077.097] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0077.097] GetProcessHeap () returned 0xd20000 [0077.097] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0077.097] GetProcessHeap () returned 0xd20000 [0077.097] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0077.097] GetProcessHeap () returned 0xd20000 [0077.097] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0077.097] GetProcessHeap () returned 0xd20000 [0077.097] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0077.097] GetProcessHeap () returned 0xd20000 [0077.097] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0077.097] GetProcessHeap () returned 0xd20000 [0077.097] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0077.097] GetProcessHeap () returned 0xd20000 [0077.097] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0077.097] GetProcessHeap () returned 0xd20000 [0077.098] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0077.098] GetProcessHeap () returned 0xd20000 [0077.098] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0077.098] GetProcessHeap () returned 0xd20000 [0077.098] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0077.098] GetProcessHeap () returned 0xd20000 [0077.098] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0077.098] GetProcessHeap () returned 0xd20000 [0077.098] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0077.098] GetProcessHeap () returned 0xd20000 [0077.098] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0077.098] GetProcessHeap () returned 0xd20000 [0077.098] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0077.098] GetProcessHeap () returned 0xd20000 [0077.098] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0077.098] GetProcessHeap () returned 0xd20000 [0077.098] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0077.098] GetProcessHeap () returned 0xd20000 [0077.098] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0077.098] GetProcessHeap () returned 0xd20000 [0077.098] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0077.099] GetProcessHeap () returned 0xd20000 [0077.099] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0077.099] GetProcessHeap () returned 0xd20000 [0077.099] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0077.099] GetProcessHeap () returned 0xd20000 [0077.099] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0077.099] GetProcessHeap () returned 0xd20000 [0077.099] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0077.099] GetProcessHeap () returned 0xd20000 [0077.099] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0077.099] GetProcessHeap () returned 0xd20000 [0077.099] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0077.099] GetProcessHeap () returned 0xd20000 [0077.099] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0077.099] GetProcessHeap () returned 0xd20000 [0077.099] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0077.099] GetProcessHeap () returned 0xd20000 [0077.099] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0077.099] GetProcessHeap () returned 0xd20000 [0077.099] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0077.100] GetProcessHeap () returned 0xd20000 [0077.100] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0077.100] GetProcessHeap () returned 0xd20000 [0077.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0077.100] GetProcessHeap () returned 0xd20000 [0077.100] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0077.100] GetProcessHeap () returned 0xd20000 [0077.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0077.100] GetProcessHeap () returned 0xd20000 [0077.100] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0077.100] GetProcessHeap () returned 0xd20000 [0077.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0077.100] GetProcessHeap () returned 0xd20000 [0077.100] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0077.100] GetProcessHeap () returned 0xd20000 [0077.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0077.100] GetProcessHeap () returned 0xd20000 [0077.100] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0077.101] GetProcessHeap () returned 0xd20000 [0077.101] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0077.101] GetProcessHeap () returned 0xd20000 [0077.101] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0077.101] GetProcessHeap () returned 0xd20000 [0077.101] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0077.101] GetProcessHeap () returned 0xd20000 [0077.101] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0077.101] GetProcessHeap () returned 0xd20000 [0077.101] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0077.101] GetProcessHeap () returned 0xd20000 [0077.101] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0077.101] GetProcessHeap () returned 0xd20000 [0077.101] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0077.101] GetProcessHeap () returned 0xd20000 [0077.101] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0077.101] GetProcessHeap () returned 0xd20000 [0077.101] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0077.101] GetProcessHeap () returned 0xd20000 [0077.101] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0077.101] GetProcessHeap () returned 0xd20000 [0077.102] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0077.102] GetProcessHeap () returned 0xd20000 [0077.102] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0077.102] GetProcessHeap () returned 0xd20000 [0077.102] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0077.102] GetProcessHeap () returned 0xd20000 [0077.102] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0077.102] GetProcessHeap () returned 0xd20000 [0077.102] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0077.102] GetProcessHeap () returned 0xd20000 [0077.102] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0077.102] GetProcessHeap () returned 0xd20000 [0077.102] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0077.102] GetProcessHeap () returned 0xd20000 [0077.102] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0077.102] GetProcessHeap () returned 0xd20000 [0077.102] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0077.102] GetProcessHeap () returned 0xd20000 [0077.102] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0077.102] GetProcessHeap () returned 0xd20000 [0077.102] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0077.103] GetProcessHeap () returned 0xd20000 [0077.103] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0077.103] GetProcessHeap () returned 0xd20000 [0077.103] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0077.103] GetProcessHeap () returned 0xd20000 [0077.103] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0077.103] GetProcessHeap () returned 0xd20000 [0077.103] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0077.103] GetProcessHeap () returned 0xd20000 [0077.103] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0077.103] GetProcessHeap () returned 0xd20000 [0077.103] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0077.103] GetProcessHeap () returned 0xd20000 [0077.103] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0077.103] GetProcessHeap () returned 0xd20000 [0077.103] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0077.103] GetProcessHeap () returned 0xd20000 [0077.103] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0077.103] GetProcessHeap () returned 0xd20000 [0077.103] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0077.104] GetProcessHeap () returned 0xd20000 [0077.104] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0077.104] GetProcessHeap () returned 0xd20000 [0077.104] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0077.104] GetProcessHeap () returned 0xd20000 [0077.104] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0077.104] GetProcessHeap () returned 0xd20000 [0077.104] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0077.104] GetProcessHeap () returned 0xd20000 [0077.104] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0077.104] GetProcessHeap () returned 0xd20000 [0077.104] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0077.104] GetProcessHeap () returned 0xd20000 [0077.104] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0077.104] GetProcessHeap () returned 0xd20000 [0077.104] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0077.104] GetProcessHeap () returned 0xd20000 [0077.104] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0077.104] GetProcessHeap () returned 0xd20000 [0077.104] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0077.104] GetProcessHeap () returned 0xd20000 [0077.104] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0077.105] GetProcessHeap () returned 0xd20000 [0077.105] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0077.105] GetProcessHeap () returned 0xd20000 [0077.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0077.105] GetProcessHeap () returned 0xd20000 [0077.105] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0077.105] GetProcessHeap () returned 0xd20000 [0077.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0077.105] GetProcessHeap () returned 0xd20000 [0077.105] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0077.105] GetProcessHeap () returned 0xd20000 [0077.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0077.105] GetProcessHeap () returned 0xd20000 [0077.105] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0077.105] GetProcessHeap () returned 0xd20000 [0077.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0077.105] GetProcessHeap () returned 0xd20000 [0077.105] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0077.105] GetProcessHeap () returned 0xd20000 [0077.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0077.105] GetProcessHeap () returned 0xd20000 [0077.106] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0077.106] GetProcessHeap () returned 0xd20000 [0077.106] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0077.106] GetProcessHeap () returned 0xd20000 [0077.106] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0077.106] GetProcessHeap () returned 0xd20000 [0077.106] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0077.106] GetProcessHeap () returned 0xd20000 [0077.106] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0077.106] GetProcessHeap () returned 0xd20000 [0077.106] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0077.106] GetProcessHeap () returned 0xd20000 [0077.106] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0077.106] GetProcessHeap () returned 0xd20000 [0077.106] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0077.106] GetProcessHeap () returned 0xd20000 [0077.106] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0077.106] GetProcessHeap () returned 0xd20000 [0077.106] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31998 | out: hHeap=0xd20000) returned 1 [0077.106] GetProcessHeap () returned 0xd20000 [0077.106] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f9c0 | out: hHeap=0xd20000) returned 1 [0077.107] GetProcessHeap () returned 0xd20000 [0077.107] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0077.107] GetProcessHeap () returned 0xd20000 [0077.107] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ddb0 | out: hHeap=0xd20000) returned 1 [0077.107] GetProcessHeap () returned 0xd20000 [0077.107] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445d0 | out: hHeap=0xd20000) returned 1 [0077.107] GetProcessHeap () returned 0xd20000 [0077.107] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0077.107] GetProcessHeap () returned 0xd20000 [0077.107] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2fbe0 | out: hHeap=0xd20000) returned 1 [0077.107] GetProcessHeap () returned 0xd20000 [0077.107] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd30f70 | out: hHeap=0xd20000) returned 1 [0077.107] GetProcessHeap () returned 0xd20000 [0077.107] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31c30 | out: hHeap=0xd20000) returned 1 [0077.107] GetProcessHeap () returned 0xd20000 [0077.107] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0077.107] GetProcessHeap () returned 0xd20000 [0077.107] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0077.107] WriteFile (in: hFile=0x230, lpBuffer=0xd49478*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd49478*, lpNumberOfBytesWritten=0x299d864*=0x388, lpOverlapped=0x0) returned 1 [0077.549] GetProcessHeap () returned 0xd20000 [0077.550] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd49478, Size=0x30) returned 0xd49478 [0077.550] GetProcessHeap () returned 0xd20000 [0077.551] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0077.551] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.551] GetProcessHeap () returned 0xd20000 [0077.556] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x9d2d0) returned 0x2d5e020 [0077.647] ReadFile (in: hFile=0x230, lpBuffer=0x2d5e020, nNumberOfBytesToRead=0x9d2d0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x2d5e020*, lpNumberOfBytesRead=0x299d7e8*=0x9d2d0, lpOverlapped=0x0) returned 1 [0077.767] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0077.767] WriteFile (in: hFile=0x230, lpBuffer=0x2d5e020*, nNumberOfBytesToWrite=0x9d2d0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0x2d5e020*, lpNumberOfBytesWritten=0x299d7e4*=0x9d2d0, lpOverlapped=0x0) returned 1 [0078.041] GetProcessHeap () returned 0xd20000 [0078.041] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0x2d5e020 | out: hHeap=0xd20000) returned 1 [0078.041] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0078.041] WriteFile (in: hFile=0x230, lpBuffer=0xd49478*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd49478*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0078.043] CloseHandle (hObject=0x230) returned 1 [0078.065] GetProcessHeap () returned 0xd20000 [0078.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42850 | out: hHeap=0xd20000) returned 1 [0078.065] GetProcessHeap () returned 0xd20000 [0078.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2e898 | out: hHeap=0xd20000) returned 1 [0078.065] GetProcessHeap () returned 0xd20000 [0078.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0078.065] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\DW20.EXE" | out: lpString1="C:\\Windows10Upgrade\\DW20.EXE") returned="C:\\Windows10Upgrade\\DW20.EXE" [0078.065] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\DW20.EXE", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\DW20.EXE.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\DW20.EXE.[ponce.lorena@aol.com]" [0078.065] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\DW20.EXE" (normalized: "c:\\windows10upgrade\\dw20.exe"), lpNewFileName="C:\\Windows10Upgrade\\DW20.EXE.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\dw20.exe.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0078.066] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\DW20.EXE" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0078.066] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0078.066] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\HOW_RECOVER.html" [0078.066] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\how_recover.html")) returned 0x20 [0078.067] GetProcessHeap () returned 0xd20000 [0078.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445e8 | out: hHeap=0xd20000) returned 1 [0078.067] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea385605, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea385605, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xc2c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DWDCW20.DLL", cAlternateFileName="")) returned 1 [0078.067] lstrcmpiW (lpString1="DWDCW20.DLL", lpString2=".") returned 1 [0078.067] lstrcmpiW (lpString1="DWDCW20.DLL", lpString2="..") returned 1 [0078.067] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="DWDCW20.DLL" | out: lpString1="C:\\Windows10Upgrade\\DWDCW20.DLL") returned="C:\\Windows10Upgrade\\DWDCW20.DLL" [0078.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DWDCW20.DLL", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0078.067] GetProcessHeap () returned 0xd20000 [0078.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd44528 [0078.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DWDCW20.DLL", cchWideChar=-1, lpMultiByteStr=0xd44528, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DWDCW20.DLL", lpUsedDefaultChar=0x0) returned 12 [0078.068] lstrlenA (lpString="DWDCW20.DLL") returned 11 [0078.068] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0078.068] lstrlenA (lpString="DWDCW20.DLL") returned 11 [0078.068] lstrlenA (lpString=".dll") returned 4 [0078.068] lstrlenA (lpString=".dll") returned 4 [0078.068] lstrlenA (lpString="DWDCW20.DLL") returned 11 [0078.068] lstrcmpiA (lpString1=".DLL", lpString2=".dll") returned 0 [0078.068] GetProcessHeap () returned 0xd20000 [0078.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44528 | out: hHeap=0xd20000) returned 1 [0078.068] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea386943, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea386943, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xb2c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0078.068] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2=".") returned 1 [0078.068] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="..") returned 1 [0078.068] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="DWTRIG20.EXE" | out: lpString1="C:\\Windows10Upgrade\\DWTRIG20.EXE") returned="C:\\Windows10Upgrade\\DWTRIG20.EXE" [0078.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DWTRIG20.EXE", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.068] GetProcessHeap () returned 0xd20000 [0078.069] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xd) returned 0xd44468 [0078.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DWTRIG20.EXE", cchWideChar=-1, lpMultiByteStr=0xd44468, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DWTRIG20.EXE", lpUsedDefaultChar=0x0) returned 13 [0078.069] lstrlenA (lpString="DWTRIG20.EXE") returned 12 [0078.069] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0078.069] lstrlenA (lpString="DWTRIG20.EXE") returned 12 [0078.069] lstrlenA (lpString=".dll") returned 4 [0078.069] lstrlenA (lpString=".dll") returned 4 [0078.069] lstrlenA (lpString="DWTRIG20.EXE") returned 12 [0078.069] lstrcmpiA (lpString1=".EXE", lpString2=".dll") returned 1 [0078.069] lstrlenA (lpString="DWTRIG20.EXE") returned 12 [0078.069] lstrlenA (lpString=".ini") returned 4 [0078.069] lstrlenA (lpString=".ini") returned 4 [0078.069] lstrlenA (lpString="DWTRIG20.EXE") returned 12 [0078.069] lstrcmpiA (lpString1=".EXE", lpString2=".ini") returned -1 [0078.069] lstrlenA (lpString="DWTRIG20.EXE") returned 12 [0078.069] lstrlenA (lpString=".inc") returned 4 [0078.069] lstrlenA (lpString=".inc") returned 4 [0078.069] lstrlenA (lpString="DWTRIG20.EXE") returned 12 [0078.069] lstrcmpiA (lpString1=".EXE", lpString2=".inc") returned -1 [0078.069] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="HOW_RECOVER.html") returned -1 [0078.069] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0078.070] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0078.070] lstrcmpiW (lpString1="DWTRIG20.EXE", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0078.070] GetProcessHeap () returned 0xd20000 [0078.070] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd428a0 [0078.070] CreateFileW (lpFileName="C:\\Windows10Upgrade\\DWTRIG20.EXE" (normalized: "c:\\windows10upgrade\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0078.071] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=45768) returned 1 [0078.071] GetProcessHeap () returned 0xd20000 [0078.071] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd2e898 [0078.071] GetProcessHeap () returned 0xd20000 [0078.071] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0078.072] lstrlenW (lpString="C:\\Windows10Upgrade\\DWTRIG20.EXE") returned 32 [0078.072] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0078.072] GetProcessHeap () returned 0xd20000 [0078.072] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0078.072] GetProcessHeap () returned 0xd20000 [0078.072] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd494b0 [0078.072] lstrlenA (lpString="rsa_encrypt") returned 11 [0078.072] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0078.074] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0078.074] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0078.074] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0078.074] GetProcessHeap () returned 0xd20000 [0078.074] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0078.074] lstrlenA (lpString="010001") returned 6 [0078.074] GetProcessHeap () returned 0xd20000 [0078.075] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd88 [0078.075] GetProcessHeap () returned 0xd20000 [0078.075] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0078.075] GetProcessHeap () returned 0xd20000 [0078.075] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd30f70 [0078.075] GetProcessHeap () returned 0xd20000 [0078.075] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0078.075] GetProcessHeap () returned 0xd20000 [0078.075] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd2f820 [0078.075] GetProcessHeap () returned 0xd20000 [0078.075] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd31c30 [0078.075] GetProcessHeap () returned 0xd20000 [0078.075] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0078.075] GetProcessHeap () returned 0xd20000 [0078.075] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd2fbe0 [0078.075] GetProcessHeap () returned 0xd20000 [0078.075] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.075] GetProcessHeap () returned 0xd20000 [0078.075] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd31998 [0078.076] GetProcessHeap () returned 0xd20000 [0078.076] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd31810 [0078.076] GetProcessHeap () returned 0xd20000 [0078.076] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44808 [0078.076] GetProcessHeap () returned 0xd20000 [0078.076] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.076] GetProcessHeap () returned 0xd20000 [0078.076] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44528 [0078.076] GetProcessHeap () returned 0xd20000 [0078.076] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd328d8 [0078.076] GetProcessHeap () returned 0xd20000 [0078.076] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31810 | out: hHeap=0xd20000) returned 1 [0078.076] GetProcessHeap () returned 0xd20000 [0078.076] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0078.076] GetProcessHeap () returned 0xd20000 [0078.076] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd328d8 | out: hHeap=0xd20000) returned 1 [0078.076] GetProcessHeap () returned 0xd20000 [0078.076] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0078.076] GetProcessHeap () returned 0xd20000 [0078.076] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446c0 [0078.077] GetProcessHeap () returned 0xd20000 [0078.077] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.077] GetProcessHeap () returned 0xd20000 [0078.077] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0078.077] GetProcessHeap () returned 0xd20000 [0078.077] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0078.077] GetProcessHeap () returned 0xd20000 [0078.077] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0078.077] GetProcessHeap () returned 0xd20000 [0078.077] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0078.077] GetProcessHeap () returned 0xd20000 [0078.077] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0078.077] GetProcessHeap () returned 0xd20000 [0078.077] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd328d8 [0078.077] GetProcessHeap () returned 0xd20000 [0078.077] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446c0 | out: hHeap=0xd20000) returned 1 [0078.077] GetProcessHeap () returned 0xd20000 [0078.077] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0078.077] GetProcessHeap () returned 0xd20000 [0078.077] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd328d8 | out: hHeap=0xd20000) returned 1 [0078.078] GetProcessHeap () returned 0xd20000 [0078.078] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.078] GetProcessHeap () returned 0xd20000 [0078.078] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.078] GetProcessHeap () returned 0xd20000 [0078.078] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0078.078] GetProcessHeap () returned 0xd20000 [0078.078] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0078.078] GetProcessHeap () returned 0xd20000 [0078.078] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.078] GetProcessHeap () returned 0xd20000 [0078.078] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.078] GetProcessHeap () returned 0xd20000 [0078.078] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.078] GetProcessHeap () returned 0xd20000 [0078.078] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.078] GetProcessHeap () returned 0xd20000 [0078.078] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.078] GetProcessHeap () returned 0xd20000 [0078.078] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.078] GetProcessHeap () returned 0xd20000 [0078.079] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.079] GetProcessHeap () returned 0xd20000 [0078.079] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.079] GetProcessHeap () returned 0xd20000 [0078.079] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0078.079] GetProcessHeap () returned 0xd20000 [0078.079] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0078.079] GetProcessHeap () returned 0xd20000 [0078.079] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0078.079] GetProcessHeap () returned 0xd20000 [0078.079] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0078.079] GetProcessHeap () returned 0xd20000 [0078.079] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0078.079] GetProcessHeap () returned 0xd20000 [0078.079] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0078.079] GetProcessHeap () returned 0xd20000 [0078.079] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0078.079] GetProcessHeap () returned 0xd20000 [0078.079] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0078.080] GetProcessHeap () returned 0xd20000 [0078.080] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0078.080] GetProcessHeap () returned 0xd20000 [0078.080] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0078.080] GetProcessHeap () returned 0xd20000 [0078.080] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0078.080] GetProcessHeap () returned 0xd20000 [0078.080] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0078.080] GetProcessHeap () returned 0xd20000 [0078.080] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0078.080] GetProcessHeap () returned 0xd20000 [0078.080] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0078.080] GetProcessHeap () returned 0xd20000 [0078.080] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0078.080] GetProcessHeap () returned 0xd20000 [0078.080] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0078.080] GetProcessHeap () returned 0xd20000 [0078.080] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0078.080] GetProcessHeap () returned 0xd20000 [0078.080] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0078.080] GetProcessHeap () returned 0xd20000 [0078.081] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0078.081] GetProcessHeap () returned 0xd20000 [0078.081] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0078.081] GetProcessHeap () returned 0xd20000 [0078.081] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0078.081] GetProcessHeap () returned 0xd20000 [0078.081] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0078.081] GetProcessHeap () returned 0xd20000 [0078.081] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0078.081] GetProcessHeap () returned 0xd20000 [0078.081] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0078.081] GetProcessHeap () returned 0xd20000 [0078.081] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0078.081] GetProcessHeap () returned 0xd20000 [0078.081] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0078.081] GetProcessHeap () returned 0xd20000 [0078.081] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0078.081] GetProcessHeap () returned 0xd20000 [0078.081] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0078.081] GetProcessHeap () returned 0xd20000 [0078.082] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0078.082] GetProcessHeap () returned 0xd20000 [0078.082] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0078.082] GetProcessHeap () returned 0xd20000 [0078.082] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.082] GetProcessHeap () returned 0xd20000 [0078.082] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.082] GetProcessHeap () returned 0xd20000 [0078.082] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0078.082] GetProcessHeap () returned 0xd20000 [0078.082] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0078.082] GetProcessHeap () returned 0xd20000 [0078.082] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0078.082] GetProcessHeap () returned 0xd20000 [0078.082] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0078.082] GetProcessHeap () returned 0xd20000 [0078.082] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0078.082] GetProcessHeap () returned 0xd20000 [0078.082] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0078.082] GetProcessHeap () returned 0xd20000 [0078.082] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.083] GetProcessHeap () returned 0xd20000 [0078.083] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.083] GetProcessHeap () returned 0xd20000 [0078.083] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0078.083] GetProcessHeap () returned 0xd20000 [0078.083] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0078.083] GetProcessHeap () returned 0xd20000 [0078.084] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0078.084] GetProcessHeap () returned 0xd20000 [0078.084] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0078.084] GetProcessHeap () returned 0xd20000 [0078.084] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0078.084] GetProcessHeap () returned 0xd20000 [0078.084] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0078.084] GetProcessHeap () returned 0xd20000 [0078.084] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0078.084] GetProcessHeap () returned 0xd20000 [0078.084] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0078.084] GetProcessHeap () returned 0xd20000 [0078.084] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0078.084] GetProcessHeap () returned 0xd20000 [0078.084] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0078.084] GetProcessHeap () returned 0xd20000 [0078.084] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0078.084] GetProcessHeap () returned 0xd20000 [0078.084] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0078.085] GetProcessHeap () returned 0xd20000 [0078.085] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0078.085] GetProcessHeap () returned 0xd20000 [0078.085] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0078.085] GetProcessHeap () returned 0xd20000 [0078.085] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0078.085] GetProcessHeap () returned 0xd20000 [0078.085] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0078.085] GetProcessHeap () returned 0xd20000 [0078.085] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.085] GetProcessHeap () returned 0xd20000 [0078.085] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.085] GetProcessHeap () returned 0xd20000 [0078.085] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0078.085] GetProcessHeap () returned 0xd20000 [0078.085] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0078.085] GetProcessHeap () returned 0xd20000 [0078.085] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0078.085] GetProcessHeap () returned 0xd20000 [0078.085] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0078.086] GetProcessHeap () returned 0xd20000 [0078.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.086] GetProcessHeap () returned 0xd20000 [0078.086] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.086] GetProcessHeap () returned 0xd20000 [0078.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0078.086] GetProcessHeap () returned 0xd20000 [0078.086] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0078.086] GetProcessHeap () returned 0xd20000 [0078.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0078.086] GetProcessHeap () returned 0xd20000 [0078.086] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0078.086] GetProcessHeap () returned 0xd20000 [0078.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.086] GetProcessHeap () returned 0xd20000 [0078.086] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.086] GetProcessHeap () returned 0xd20000 [0078.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0078.086] GetProcessHeap () returned 0xd20000 [0078.086] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0078.086] GetProcessHeap () returned 0xd20000 [0078.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0078.087] GetProcessHeap () returned 0xd20000 [0078.087] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0078.087] GetProcessHeap () returned 0xd20000 [0078.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0078.087] GetProcessHeap () returned 0xd20000 [0078.087] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0078.087] GetProcessHeap () returned 0xd20000 [0078.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0078.087] GetProcessHeap () returned 0xd20000 [0078.087] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0078.087] GetProcessHeap () returned 0xd20000 [0078.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.087] GetProcessHeap () returned 0xd20000 [0078.087] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.087] GetProcessHeap () returned 0xd20000 [0078.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0078.087] GetProcessHeap () returned 0xd20000 [0078.087] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0078.087] GetProcessHeap () returned 0xd20000 [0078.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0078.088] GetProcessHeap () returned 0xd20000 [0078.088] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0078.088] GetProcessHeap () returned 0xd20000 [0078.088] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.088] GetProcessHeap () returned 0xd20000 [0078.088] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.088] GetProcessHeap () returned 0xd20000 [0078.088] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.088] GetProcessHeap () returned 0xd20000 [0078.088] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.088] GetProcessHeap () returned 0xd20000 [0078.088] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0078.088] GetProcessHeap () returned 0xd20000 [0078.088] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0078.088] GetProcessHeap () returned 0xd20000 [0078.088] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.088] GetProcessHeap () returned 0xd20000 [0078.088] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.088] GetProcessHeap () returned 0xd20000 [0078.088] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0078.089] GetProcessHeap () returned 0xd20000 [0078.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0078.089] GetProcessHeap () returned 0xd20000 [0078.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0078.089] GetProcessHeap () returned 0xd20000 [0078.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0078.089] GetProcessHeap () returned 0xd20000 [0078.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0078.089] GetProcessHeap () returned 0xd20000 [0078.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0078.089] GetProcessHeap () returned 0xd20000 [0078.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.089] GetProcessHeap () returned 0xd20000 [0078.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.089] GetProcessHeap () returned 0xd20000 [0078.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.089] GetProcessHeap () returned 0xd20000 [0078.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.089] GetProcessHeap () returned 0xd20000 [0078.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0078.089] GetProcessHeap () returned 0xd20000 [0078.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0078.090] GetProcessHeap () returned 0xd20000 [0078.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.090] GetProcessHeap () returned 0xd20000 [0078.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.090] GetProcessHeap () returned 0xd20000 [0078.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.090] GetProcessHeap () returned 0xd20000 [0078.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.090] GetProcessHeap () returned 0xd20000 [0078.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.090] GetProcessHeap () returned 0xd20000 [0078.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.090] GetProcessHeap () returned 0xd20000 [0078.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.090] GetProcessHeap () returned 0xd20000 [0078.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.090] GetProcessHeap () returned 0xd20000 [0078.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0078.090] GetProcessHeap () returned 0xd20000 [0078.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0078.090] GetProcessHeap () returned 0xd20000 [0078.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0078.091] GetProcessHeap () returned 0xd20000 [0078.091] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0078.091] GetProcessHeap () returned 0xd20000 [0078.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.091] GetProcessHeap () returned 0xd20000 [0078.091] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.091] GetProcessHeap () returned 0xd20000 [0078.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0078.091] GetProcessHeap () returned 0xd20000 [0078.091] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0078.091] GetProcessHeap () returned 0xd20000 [0078.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0078.091] GetProcessHeap () returned 0xd20000 [0078.091] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0078.091] GetProcessHeap () returned 0xd20000 [0078.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0078.091] GetProcessHeap () returned 0xd20000 [0078.091] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0078.091] GetProcessHeap () returned 0xd20000 [0078.092] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0078.092] GetProcessHeap () returned 0xd20000 [0078.092] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0078.092] GetProcessHeap () returned 0xd20000 [0078.092] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0078.092] GetProcessHeap () returned 0xd20000 [0078.092] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0078.092] GetProcessHeap () returned 0xd20000 [0078.092] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0078.092] GetProcessHeap () returned 0xd20000 [0078.092] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0078.092] GetProcessHeap () returned 0xd20000 [0078.092] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.092] GetProcessHeap () returned 0xd20000 [0078.092] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.092] GetProcessHeap () returned 0xd20000 [0078.092] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.092] GetProcessHeap () returned 0xd20000 [0078.092] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.092] GetProcessHeap () returned 0xd20000 [0078.092] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.093] GetProcessHeap () returned 0xd20000 [0078.093] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.093] GetProcessHeap () returned 0xd20000 [0078.093] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0078.093] GetProcessHeap () returned 0xd20000 [0078.093] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0078.093] GetProcessHeap () returned 0xd20000 [0078.093] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0078.093] GetProcessHeap () returned 0xd20000 [0078.093] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0078.093] GetProcessHeap () returned 0xd20000 [0078.093] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0078.093] GetProcessHeap () returned 0xd20000 [0078.093] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0078.093] GetProcessHeap () returned 0xd20000 [0078.093] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.093] GetProcessHeap () returned 0xd20000 [0078.093] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.093] GetProcessHeap () returned 0xd20000 [0078.093] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0078.094] GetProcessHeap () returned 0xd20000 [0078.094] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0078.094] GetProcessHeap () returned 0xd20000 [0078.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0078.094] GetProcessHeap () returned 0xd20000 [0078.094] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0078.094] GetProcessHeap () returned 0xd20000 [0078.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0078.094] GetProcessHeap () returned 0xd20000 [0078.094] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0078.094] GetProcessHeap () returned 0xd20000 [0078.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0078.094] GetProcessHeap () returned 0xd20000 [0078.094] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0078.094] GetProcessHeap () returned 0xd20000 [0078.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0078.094] GetProcessHeap () returned 0xd20000 [0078.094] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0078.094] GetProcessHeap () returned 0xd20000 [0078.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0078.095] GetProcessHeap () returned 0xd20000 [0078.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0078.095] GetProcessHeap () returned 0xd20000 [0078.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0078.095] GetProcessHeap () returned 0xd20000 [0078.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0078.095] GetProcessHeap () returned 0xd20000 [0078.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31998 | out: hHeap=0xd20000) returned 1 [0078.095] GetProcessHeap () returned 0xd20000 [0078.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0078.095] GetProcessHeap () returned 0xd20000 [0078.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0078.095] GetProcessHeap () returned 0xd20000 [0078.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0078.095] GetProcessHeap () returned 0xd20000 [0078.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44528 | out: hHeap=0xd20000) returned 1 [0078.095] GetProcessHeap () returned 0xd20000 [0078.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0078.095] GetProcessHeap () returned 0xd20000 [0078.096] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31c30 | out: hHeap=0xd20000) returned 1 [0078.096] GetProcessHeap () returned 0xd20000 [0078.096] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd30f70 | out: hHeap=0xd20000) returned 1 [0078.096] GetProcessHeap () returned 0xd20000 [0078.096] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2fbe0 | out: hHeap=0xd20000) returned 1 [0078.096] GetProcessHeap () returned 0xd20000 [0078.096] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.096] GetProcessHeap () returned 0xd20000 [0078.096] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0078.096] WriteFile (in: hFile=0x230, lpBuffer=0xd494b0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd494b0*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0078.406] GetProcessHeap () returned 0xd20000 [0078.407] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd494b0, Size=0x30) returned 0xd494b0 [0078.407] GetProcessHeap () returned 0xd20000 [0078.408] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0078.408] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0078.408] GetProcessHeap () returned 0xd20000 [0078.408] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xb2c8) returned 0xd494e8 [0078.409] ReadFile (in: hFile=0x230, lpBuffer=0xd494e8, nNumberOfBytesToRead=0xb2c8, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd494e8*, lpNumberOfBytesRead=0x299d7e8*=0xb2c8, lpOverlapped=0x0) returned 1 [0078.412] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0078.413] WriteFile (in: hFile=0x230, lpBuffer=0xd494e8*, nNumberOfBytesToWrite=0xb2c8, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd494e8*, lpNumberOfBytesWritten=0x299d7e4*=0xb2c8, lpOverlapped=0x0) returned 1 [0078.622] GetProcessHeap () returned 0xd20000 [0078.622] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd494e8 | out: hHeap=0xd20000) returned 1 [0078.623] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0078.623] WriteFile (in: hFile=0x230, lpBuffer=0xd494b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd494b0*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0078.625] CloseHandle (hObject=0x230) returned 1 [0078.629] GetProcessHeap () returned 0xd20000 [0078.629] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd428a0 | out: hHeap=0xd20000) returned 1 [0078.629] GetProcessHeap () returned 0xd20000 [0078.629] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2e898 | out: hHeap=0xd20000) returned 1 [0078.630] GetProcessHeap () returned 0xd20000 [0078.630] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0078.630] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\DWTRIG20.EXE" | out: lpString1="C:\\Windows10Upgrade\\DWTRIG20.EXE") returned="C:\\Windows10Upgrade\\DWTRIG20.EXE" [0078.630] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\DWTRIG20.EXE", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\DWTRIG20.EXE.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\DWTRIG20.EXE.[ponce.lorena@aol.com]" [0078.630] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\DWTRIG20.EXE" (normalized: "c:\\windows10upgrade\\dwtrig20.exe"), lpNewFileName="C:\\Windows10Upgrade\\DWTRIG20.EXE.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\dwtrig20.exe.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0078.631] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\DWTRIG20.EXE" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0078.631] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0078.631] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\HOW_RECOVER.html" [0078.631] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\how_recover.html")) returned 0x20 [0078.632] GetProcessHeap () returned 0xd20000 [0078.632] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44468 | out: hHeap=0xd20000) returned 1 [0078.632] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea387cd0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea387cd0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x2652, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EnableWiFiTracing.cmd", cAlternateFileName="ENABLE~1.CMD")) returned 1 [0078.632] lstrcmpiW (lpString1="EnableWiFiTracing.cmd", lpString2=".") returned 1 [0078.632] lstrcmpiW (lpString1="EnableWiFiTracing.cmd", lpString2="..") returned 1 [0078.632] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="EnableWiFiTracing.cmd" | out: lpString1="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd") returned="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd" [0078.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EnableWiFiTracing.cmd", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0078.632] GetProcessHeap () returned 0xd20000 [0078.632] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x16) returned 0xd36648 [0078.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EnableWiFiTracing.cmd", cchWideChar=-1, lpMultiByteStr=0xd36648, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EnableWiFiTracing.cmd", lpUsedDefaultChar=0x0) returned 22 [0078.632] lstrlenA (lpString="EnableWiFiTracing.cmd") returned 21 [0078.632] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0078.633] lstrlenA (lpString="EnableWiFiTracing.cmd") returned 21 [0078.633] lstrlenA (lpString=".dll") returned 4 [0078.633] lstrlenA (lpString=".dll") returned 4 [0078.633] lstrlenA (lpString="EnableWiFiTracing.cmd") returned 21 [0078.633] lstrcmpiA (lpString1=".cmd", lpString2=".dll") returned -1 [0078.633] lstrlenA (lpString="EnableWiFiTracing.cmd") returned 21 [0078.633] lstrlenA (lpString=".ini") returned 4 [0078.633] lstrlenA (lpString=".ini") returned 4 [0078.633] lstrlenA (lpString="EnableWiFiTracing.cmd") returned 21 [0078.633] lstrcmpiA (lpString1=".cmd", lpString2=".ini") returned -1 [0078.633] lstrlenA (lpString="EnableWiFiTracing.cmd") returned 21 [0078.633] lstrlenA (lpString=".inc") returned 4 [0078.633] lstrlenA (lpString=".inc") returned 4 [0078.633] lstrlenA (lpString="EnableWiFiTracing.cmd") returned 21 [0078.633] lstrcmpiA (lpString1=".cmd", lpString2=".inc") returned -1 [0078.633] lstrcmpiW (lpString1="EnableWiFiTracing.cmd", lpString2="HOW_RECOVER.html") returned -1 [0078.633] lstrcmpiW (lpString1="EnableWiFiTracing.cmd", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0078.633] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0078.634] lstrcmpiW (lpString1="EnableWiFiTracing.cmd", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0078.634] GetProcessHeap () returned 0xd20000 [0078.634] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42490 [0078.634] CreateFileW (lpFileName="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd" (normalized: "c:\\windows10upgrade\\enablewifitracing.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0078.634] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=9810) returned 1 [0078.634] GetProcessHeap () returned 0xd20000 [0078.635] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd2e898 [0078.635] GetProcessHeap () returned 0xd20000 [0078.635] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0078.635] lstrlenW (lpString="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd") returned 41 [0078.635] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0078.635] GetProcessHeap () returned 0xd20000 [0078.635] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0078.635] GetProcessHeap () returned 0xd20000 [0078.635] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd494e8 [0078.635] lstrlenA (lpString="rsa_encrypt") returned 11 [0078.635] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0078.639] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0078.639] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0078.639] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0078.639] GetProcessHeap () returned 0xd20000 [0078.639] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0078.639] lstrlenA (lpString="010001") returned 6 [0078.640] GetProcessHeap () returned 0xd20000 [0078.640] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd18 [0078.640] GetProcessHeap () returned 0xd20000 [0078.640] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0078.640] GetProcessHeap () returned 0xd20000 [0078.640] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd30f70 [0078.640] GetProcessHeap () returned 0xd20000 [0078.640] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0078.640] GetProcessHeap () returned 0xd20000 [0078.640] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd2f820 [0078.640] GetProcessHeap () returned 0xd20000 [0078.640] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44920 [0078.640] GetProcessHeap () returned 0xd20000 [0078.640] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc48 [0078.640] GetProcessHeap () returned 0xd20000 [0078.640] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0078.640] GetProcessHeap () returned 0xd20000 [0078.640] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0078.640] GetProcessHeap () returned 0xd20000 [0078.640] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0078.641] GetProcessHeap () returned 0xd20000 [0078.641] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd328d8 [0078.641] GetProcessHeap () returned 0xd20000 [0078.641] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd45410 [0078.641] GetProcessHeap () returned 0xd20000 [0078.641] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0078.641] GetProcessHeap () returned 0xd20000 [0078.641] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44660 [0078.641] GetProcessHeap () returned 0xd20000 [0078.641] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd31810 [0078.641] GetProcessHeap () returned 0xd20000 [0078.641] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd328d8 | out: hHeap=0xd20000) returned 1 [0078.641] GetProcessHeap () returned 0xd20000 [0078.641] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0078.641] GetProcessHeap () returned 0xd20000 [0078.641] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31810 | out: hHeap=0xd20000) returned 1 [0078.641] GetProcessHeap () returned 0xd20000 [0078.641] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0078.641] GetProcessHeap () returned 0xd20000 [0078.641] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44618 [0078.642] GetProcessHeap () returned 0xd20000 [0078.642] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0078.642] GetProcessHeap () returned 0xd20000 [0078.642] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0078.642] GetProcessHeap () returned 0xd20000 [0078.642] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0078.642] GetProcessHeap () returned 0xd20000 [0078.642] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0078.642] GetProcessHeap () returned 0xd20000 [0078.642] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.642] GetProcessHeap () returned 0xd20000 [0078.642] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.642] GetProcessHeap () returned 0xd20000 [0078.642] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd31810 [0078.642] GetProcessHeap () returned 0xd20000 [0078.642] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44618 | out: hHeap=0xd20000) returned 1 [0078.642] GetProcessHeap () returned 0xd20000 [0078.642] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0078.642] GetProcessHeap () returned 0xd20000 [0078.642] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31810 | out: hHeap=0xd20000) returned 1 [0078.643] GetProcessHeap () returned 0xd20000 [0078.643] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.643] GetProcessHeap () returned 0xd20000 [0078.643] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.643] GetProcessHeap () returned 0xd20000 [0078.643] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0078.643] GetProcessHeap () returned 0xd20000 [0078.643] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0078.643] GetProcessHeap () returned 0xd20000 [0078.643] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.643] GetProcessHeap () returned 0xd20000 [0078.643] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.643] GetProcessHeap () returned 0xd20000 [0078.643] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.643] GetProcessHeap () returned 0xd20000 [0078.643] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.643] GetProcessHeap () returned 0xd20000 [0078.643] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.643] GetProcessHeap () returned 0xd20000 [0078.643] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.644] GetProcessHeap () returned 0xd20000 [0078.644] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0078.644] GetProcessHeap () returned 0xd20000 [0078.644] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0078.644] GetProcessHeap () returned 0xd20000 [0078.644] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0078.644] GetProcessHeap () returned 0xd20000 [0078.644] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0078.644] GetProcessHeap () returned 0xd20000 [0078.644] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.644] GetProcessHeap () returned 0xd20000 [0078.644] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.644] GetProcessHeap () returned 0xd20000 [0078.644] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0078.644] GetProcessHeap () returned 0xd20000 [0078.644] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0078.644] GetProcessHeap () returned 0xd20000 [0078.644] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.644] GetProcessHeap () returned 0xd20000 [0078.644] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.644] GetProcessHeap () returned 0xd20000 [0078.645] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0078.645] GetProcessHeap () returned 0xd20000 [0078.645] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0078.645] GetProcessHeap () returned 0xd20000 [0078.645] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.645] GetProcessHeap () returned 0xd20000 [0078.645] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.645] GetProcessHeap () returned 0xd20000 [0078.645] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0078.645] GetProcessHeap () returned 0xd20000 [0078.645] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0078.645] GetProcessHeap () returned 0xd20000 [0078.645] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.645] GetProcessHeap () returned 0xd20000 [0078.645] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.645] GetProcessHeap () returned 0xd20000 [0078.645] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.645] GetProcessHeap () returned 0xd20000 [0078.645] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.645] GetProcessHeap () returned 0xd20000 [0078.645] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0078.646] GetProcessHeap () returned 0xd20000 [0078.646] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0078.646] GetProcessHeap () returned 0xd20000 [0078.646] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.646] GetProcessHeap () returned 0xd20000 [0078.646] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.646] GetProcessHeap () returned 0xd20000 [0078.646] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.646] GetProcessHeap () returned 0xd20000 [0078.646] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.646] GetProcessHeap () returned 0xd20000 [0078.646] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0078.646] GetProcessHeap () returned 0xd20000 [0078.646] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0078.646] GetProcessHeap () returned 0xd20000 [0078.646] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0078.646] GetProcessHeap () returned 0xd20000 [0078.646] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0078.646] GetProcessHeap () returned 0xd20000 [0078.647] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0078.647] GetProcessHeap () returned 0xd20000 [0078.647] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0078.647] GetProcessHeap () returned 0xd20000 [0078.647] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0078.647] GetProcessHeap () returned 0xd20000 [0078.647] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0078.647] GetProcessHeap () returned 0xd20000 [0078.647] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.647] GetProcessHeap () returned 0xd20000 [0078.647] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.647] GetProcessHeap () returned 0xd20000 [0078.647] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0078.647] GetProcessHeap () returned 0xd20000 [0078.647] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0078.647] GetProcessHeap () returned 0xd20000 [0078.647] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.647] GetProcessHeap () returned 0xd20000 [0078.647] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.647] GetProcessHeap () returned 0xd20000 [0078.648] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.648] GetProcessHeap () returned 0xd20000 [0078.648] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.648] GetProcessHeap () returned 0xd20000 [0078.648] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0078.648] GetProcessHeap () returned 0xd20000 [0078.648] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0078.648] GetProcessHeap () returned 0xd20000 [0078.648] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.648] GetProcessHeap () returned 0xd20000 [0078.648] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.648] GetProcessHeap () returned 0xd20000 [0078.648] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.648] GetProcessHeap () returned 0xd20000 [0078.648] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.648] GetProcessHeap () returned 0xd20000 [0078.648] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0078.648] GetProcessHeap () returned 0xd20000 [0078.648] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0078.649] GetProcessHeap () returned 0xd20000 [0078.649] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0078.649] GetProcessHeap () returned 0xd20000 [0078.649] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0078.649] GetProcessHeap () returned 0xd20000 [0078.649] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0078.649] GetProcessHeap () returned 0xd20000 [0078.649] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0078.649] GetProcessHeap () returned 0xd20000 [0078.649] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.649] GetProcessHeap () returned 0xd20000 [0078.649] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.649] GetProcessHeap () returned 0xd20000 [0078.649] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.649] GetProcessHeap () returned 0xd20000 [0078.649] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.649] GetProcessHeap () returned 0xd20000 [0078.649] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0078.649] GetProcessHeap () returned 0xd20000 [0078.650] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0078.650] GetProcessHeap () returned 0xd20000 [0078.650] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0078.650] GetProcessHeap () returned 0xd20000 [0078.650] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0078.650] GetProcessHeap () returned 0xd20000 [0078.650] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0078.650] GetProcessHeap () returned 0xd20000 [0078.650] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0078.650] GetProcessHeap () returned 0xd20000 [0078.650] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.650] GetProcessHeap () returned 0xd20000 [0078.650] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.650] GetProcessHeap () returned 0xd20000 [0078.650] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0078.650] GetProcessHeap () returned 0xd20000 [0078.650] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0078.650] GetProcessHeap () returned 0xd20000 [0078.650] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.651] GetProcessHeap () returned 0xd20000 [0078.651] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.651] GetProcessHeap () returned 0xd20000 [0078.651] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0078.651] GetProcessHeap () returned 0xd20000 [0078.651] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0078.651] GetProcessHeap () returned 0xd20000 [0078.651] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.651] GetProcessHeap () returned 0xd20000 [0078.651] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.651] GetProcessHeap () returned 0xd20000 [0078.651] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0078.651] GetProcessHeap () returned 0xd20000 [0078.651] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0078.651] GetProcessHeap () returned 0xd20000 [0078.651] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.651] GetProcessHeap () returned 0xd20000 [0078.651] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.652] GetProcessHeap () returned 0xd20000 [0078.652] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.652] GetProcessHeap () returned 0xd20000 [0078.652] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.652] GetProcessHeap () returned 0xd20000 [0078.652] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0078.652] GetProcessHeap () returned 0xd20000 [0078.652] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0078.652] GetProcessHeap () returned 0xd20000 [0078.653] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.653] GetProcessHeap () returned 0xd20000 [0078.653] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.653] GetProcessHeap () returned 0xd20000 [0078.653] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.653] GetProcessHeap () returned 0xd20000 [0078.653] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.653] GetProcessHeap () returned 0xd20000 [0078.653] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.653] GetProcessHeap () returned 0xd20000 [0078.653] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.653] GetProcessHeap () returned 0xd20000 [0078.653] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0078.653] GetProcessHeap () returned 0xd20000 [0078.653] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0078.653] GetProcessHeap () returned 0xd20000 [0078.653] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.653] GetProcessHeap () returned 0xd20000 [0078.653] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.654] GetProcessHeap () returned 0xd20000 [0078.654] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.654] GetProcessHeap () returned 0xd20000 [0078.654] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.654] GetProcessHeap () returned 0xd20000 [0078.654] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.654] GetProcessHeap () returned 0xd20000 [0078.654] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.654] GetProcessHeap () returned 0xd20000 [0078.654] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0078.654] GetProcessHeap () returned 0xd20000 [0078.654] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0078.654] GetProcessHeap () returned 0xd20000 [0078.654] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0078.654] GetProcessHeap () returned 0xd20000 [0078.654] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0078.654] GetProcessHeap () returned 0xd20000 [0078.655] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0078.655] GetProcessHeap () returned 0xd20000 [0078.655] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0078.655] GetProcessHeap () returned 0xd20000 [0078.655] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.655] GetProcessHeap () returned 0xd20000 [0078.655] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.655] GetProcessHeap () returned 0xd20000 [0078.655] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0078.655] GetProcessHeap () returned 0xd20000 [0078.655] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0078.655] GetProcessHeap () returned 0xd20000 [0078.655] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0078.655] GetProcessHeap () returned 0xd20000 [0078.655] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0078.655] GetProcessHeap () returned 0xd20000 [0078.655] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.655] GetProcessHeap () returned 0xd20000 [0078.656] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.656] GetProcessHeap () returned 0xd20000 [0078.656] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0078.656] GetProcessHeap () returned 0xd20000 [0078.656] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0078.656] GetProcessHeap () returned 0xd20000 [0078.656] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0078.656] GetProcessHeap () returned 0xd20000 [0078.656] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0078.656] GetProcessHeap () returned 0xd20000 [0078.656] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.656] GetProcessHeap () returned 0xd20000 [0078.656] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.656] GetProcessHeap () returned 0xd20000 [0078.656] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0078.656] GetProcessHeap () returned 0xd20000 [0078.656] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0078.656] GetProcessHeap () returned 0xd20000 [0078.657] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0078.657] GetProcessHeap () returned 0xd20000 [0078.657] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0078.657] GetProcessHeap () returned 0xd20000 [0078.657] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0078.657] GetProcessHeap () returned 0xd20000 [0078.657] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0078.657] GetProcessHeap () returned 0xd20000 [0078.657] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.657] GetProcessHeap () returned 0xd20000 [0078.657] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.657] GetProcessHeap () returned 0xd20000 [0078.657] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0078.657] GetProcessHeap () returned 0xd20000 [0078.657] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0078.657] GetProcessHeap () returned 0xd20000 [0078.657] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.657] GetProcessHeap () returned 0xd20000 [0078.657] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.658] GetProcessHeap () returned 0xd20000 [0078.658] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0078.658] GetProcessHeap () returned 0xd20000 [0078.658] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0078.658] GetProcessHeap () returned 0xd20000 [0078.658] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0078.658] GetProcessHeap () returned 0xd20000 [0078.658] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0078.658] GetProcessHeap () returned 0xd20000 [0078.658] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0078.658] GetProcessHeap () returned 0xd20000 [0078.658] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0078.658] GetProcessHeap () returned 0xd20000 [0078.658] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0078.658] GetProcessHeap () returned 0xd20000 [0078.658] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0078.658] GetProcessHeap () returned 0xd20000 [0078.658] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.659] GetProcessHeap () returned 0xd20000 [0078.659] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.659] GetProcessHeap () returned 0xd20000 [0078.659] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0078.659] GetProcessHeap () returned 0xd20000 [0078.659] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0078.659] GetProcessHeap () returned 0xd20000 [0078.659] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0078.659] GetProcessHeap () returned 0xd20000 [0078.659] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0078.659] GetProcessHeap () returned 0xd20000 [0078.659] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.659] GetProcessHeap () returned 0xd20000 [0078.659] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.659] GetProcessHeap () returned 0xd20000 [0078.659] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0078.659] GetProcessHeap () returned 0xd20000 [0078.659] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0078.660] GetProcessHeap () returned 0xd20000 [0078.660] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0078.660] GetProcessHeap () returned 0xd20000 [0078.660] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0078.660] GetProcessHeap () returned 0xd20000 [0078.660] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0078.660] GetProcessHeap () returned 0xd20000 [0078.660] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0078.660] GetProcessHeap () returned 0xd20000 [0078.660] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.660] GetProcessHeap () returned 0xd20000 [0078.660] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.660] GetProcessHeap () returned 0xd20000 [0078.660] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.660] GetProcessHeap () returned 0xd20000 [0078.660] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.660] GetProcessHeap () returned 0xd20000 [0078.660] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.660] GetProcessHeap () returned 0xd20000 [0078.661] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.661] GetProcessHeap () returned 0xd20000 [0078.661] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.661] GetProcessHeap () returned 0xd20000 [0078.661] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.661] GetProcessHeap () returned 0xd20000 [0078.661] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.661] GetProcessHeap () returned 0xd20000 [0078.661] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.661] GetProcessHeap () returned 0xd20000 [0078.661] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0078.661] GetProcessHeap () returned 0xd20000 [0078.661] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0078.661] GetProcessHeap () returned 0xd20000 [0078.661] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0078.661] GetProcessHeap () returned 0xd20000 [0078.661] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0078.661] GetProcessHeap () returned 0xd20000 [0078.661] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44660 | out: hHeap=0xd20000) returned 1 [0078.662] GetProcessHeap () returned 0xd20000 [0078.662] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0078.662] GetProcessHeap () returned 0xd20000 [0078.662] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0078.662] GetProcessHeap () returned 0xd20000 [0078.662] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd30f70 | out: hHeap=0xd20000) returned 1 [0078.662] GetProcessHeap () returned 0xd20000 [0078.662] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0078.662] GetProcessHeap () returned 0xd20000 [0078.662] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0078.662] GetProcessHeap () returned 0xd20000 [0078.662] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0078.662] WriteFile (in: hFile=0x230, lpBuffer=0xd494e8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd494e8*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0078.736] GetProcessHeap () returned 0xd20000 [0078.736] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd494e8, Size=0x30) returned 0xd494e8 [0078.736] GetProcessHeap () returned 0xd20000 [0078.736] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0078.736] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0078.736] GetProcessHeap () returned 0xd20000 [0078.737] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x2652) returned 0xd49520 [0078.737] ReadFile (in: hFile=0x230, lpBuffer=0xd49520, nNumberOfBytesToRead=0x2652, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd49520*, lpNumberOfBytesRead=0x299d7e8*=0x2652, lpOverlapped=0x0) returned 1 [0078.738] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0078.738] WriteFile (in: hFile=0x230, lpBuffer=0xd49520*, nNumberOfBytesToWrite=0x2652, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd49520*, lpNumberOfBytesWritten=0x299d7e4*=0x2652, lpOverlapped=0x0) returned 1 [0078.740] GetProcessHeap () returned 0xd20000 [0078.740] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd49520 | out: hHeap=0xd20000) returned 1 [0078.740] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0078.740] WriteFile (in: hFile=0x230, lpBuffer=0xd494e8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd494e8*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0078.742] CloseHandle (hObject=0x230) returned 1 [0078.747] GetProcessHeap () returned 0xd20000 [0078.747] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42490 | out: hHeap=0xd20000) returned 1 [0078.747] GetProcessHeap () returned 0xd20000 [0078.747] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2e898 | out: hHeap=0xd20000) returned 1 [0078.747] GetProcessHeap () returned 0xd20000 [0078.747] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0078.747] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd" | out: lpString1="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd") returned="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd" [0078.747] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd.[ponce.lorena@aol.com]" [0078.747] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd" (normalized: "c:\\windows10upgrade\\enablewifitracing.cmd"), lpNewFileName="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\enablewifitracing.cmd.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0078.748] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\EnableWiFiTracing.cmd" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0078.748] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0078.748] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\HOW_RECOVER.html" [0078.748] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\how_recover.html")) returned 0x20 [0078.749] GetProcessHeap () returned 0xd20000 [0078.749] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36648 | out: hHeap=0xd20000) returned 1 [0078.749] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea389060, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea389060, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x10cc8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESDHelper.dll", cAlternateFileName="ESDHEL~1.DLL")) returned 1 [0078.749] lstrcmpiW (lpString1="ESDHelper.dll", lpString2=".") returned 1 [0078.749] lstrcmpiW (lpString1="ESDHelper.dll", lpString2="..") returned 1 [0078.749] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="ESDHelper.dll" | out: lpString1="C:\\Windows10Upgrade\\ESDHelper.dll") returned="C:\\Windows10Upgrade\\ESDHelper.dll" [0078.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ESDHelper.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0078.749] GetProcessHeap () returned 0xd20000 [0078.749] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xe) returned 0xd445b8 [0078.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ESDHelper.dll", cchWideChar=-1, lpMultiByteStr=0xd445b8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ESDHelper.dll", lpUsedDefaultChar=0x0) returned 14 [0078.749] lstrlenA (lpString="ESDHelper.dll") returned 13 [0078.749] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0078.749] lstrlenA (lpString="ESDHelper.dll") returned 13 [0078.749] lstrlenA (lpString=".dll") returned 4 [0078.749] lstrlenA (lpString=".dll") returned 4 [0078.749] lstrlenA (lpString="ESDHelper.dll") returned 13 [0078.749] lstrcmpiA (lpString1=".dll", lpString2=".dll") returned 0 [0078.749] GetProcessHeap () returned 0xd20000 [0078.750] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445b8 | out: hHeap=0xd20000) returned 1 [0078.750] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea38cadd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea38cadd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x9ec8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="esdstub.dll", cAlternateFileName="")) returned 1 [0078.750] lstrcmpiW (lpString1="esdstub.dll", lpString2=".") returned 1 [0078.750] lstrcmpiW (lpString1="esdstub.dll", lpString2="..") returned 1 [0078.750] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="esdstub.dll" | out: lpString1="C:\\Windows10Upgrade\\esdstub.dll") returned="C:\\Windows10Upgrade\\esdstub.dll" [0078.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esdstub.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0078.750] GetProcessHeap () returned 0xd20000 [0078.750] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd44420 [0078.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="esdstub.dll", cchWideChar=-1, lpMultiByteStr=0xd44420, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="esdstub.dll", lpUsedDefaultChar=0x0) returned 12 [0078.750] lstrlenA (lpString="esdstub.dll") returned 11 [0078.750] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0078.750] lstrlenA (lpString="esdstub.dll") returned 11 [0078.750] lstrlenA (lpString=".dll") returned 4 [0078.750] lstrlenA (lpString=".dll") returned 4 [0078.750] lstrlenA (lpString="esdstub.dll") returned 11 [0078.750] lstrcmpiA (lpString1=".dll", lpString2=".dll") returned 0 [0078.751] GetProcessHeap () returned 0xd20000 [0078.751] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44420 | out: hHeap=0xd20000) returned 1 [0078.751] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea38de7f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea38de7f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x89ec8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GatherOSState.EXE", cAlternateFileName="GATHER~1.EXE")) returned 1 [0078.751] lstrcmpiW (lpString1="GatherOSState.EXE", lpString2=".") returned 1 [0078.751] lstrcmpiW (lpString1="GatherOSState.EXE", lpString2="..") returned 1 [0078.751] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="GatherOSState.EXE" | out: lpString1="C:\\Windows10Upgrade\\GatherOSState.EXE") returned="C:\\Windows10Upgrade\\GatherOSState.EXE" [0078.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GatherOSState.EXE", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0078.751] GetProcessHeap () returned 0xd20000 [0078.751] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x12) returned 0xd365c8 [0078.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GatherOSState.EXE", cchWideChar=-1, lpMultiByteStr=0xd365c8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GatherOSState.EXE", lpUsedDefaultChar=0x0) returned 18 [0078.751] lstrlenA (lpString="GatherOSState.EXE") returned 17 [0078.751] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0078.751] lstrlenA (lpString="GatherOSState.EXE") returned 17 [0078.751] lstrlenA (lpString=".dll") returned 4 [0078.751] lstrlenA (lpString=".dll") returned 4 [0078.751] lstrlenA (lpString="GatherOSState.EXE") returned 17 [0078.751] lstrcmpiA (lpString1=".EXE", lpString2=".dll") returned 1 [0078.752] lstrlenA (lpString="GatherOSState.EXE") returned 17 [0078.752] lstrlenA (lpString=".ini") returned 4 [0078.752] lstrlenA (lpString=".ini") returned 4 [0078.752] lstrlenA (lpString="GatherOSState.EXE") returned 17 [0078.752] lstrcmpiA (lpString1=".EXE", lpString2=".ini") returned -1 [0078.752] lstrlenA (lpString="GatherOSState.EXE") returned 17 [0078.752] lstrlenA (lpString=".inc") returned 4 [0078.752] lstrlenA (lpString=".inc") returned 4 [0078.752] lstrlenA (lpString="GatherOSState.EXE") returned 17 [0078.752] lstrcmpiA (lpString1=".EXE", lpString2=".inc") returned -1 [0078.752] lstrcmpiW (lpString1="GatherOSState.EXE", lpString2="HOW_RECOVER.html") returned -1 [0078.752] lstrcmpiW (lpString1="GatherOSState.EXE", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0078.752] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0078.752] lstrcmpiW (lpString1="GatherOSState.EXE", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0078.752] GetProcessHeap () returned 0xd20000 [0078.752] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd426c0 [0078.752] CreateFileW (lpFileName="C:\\Windows10Upgrade\\GatherOSState.EXE" (normalized: "c:\\windows10upgrade\\gatherosstate.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0078.754] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=564936) returned 1 [0078.754] GetProcessHeap () returned 0xd20000 [0078.754] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd2e898 [0078.754] GetProcessHeap () returned 0xd20000 [0078.754] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0078.754] lstrlenW (lpString="C:\\Windows10Upgrade\\GatherOSState.EXE") returned 37 [0078.754] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0078.755] GetProcessHeap () returned 0xd20000 [0078.755] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0078.755] GetProcessHeap () returned 0xd20000 [0078.755] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x388) returned 0xd49520 [0078.755] lstrlenA (lpString="rsa_encrypt") returned 11 [0078.755] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0078.757] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0078.757] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0078.757] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0078.757] GetProcessHeap () returned 0xd20000 [0078.757] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0078.757] lstrlenA (lpString="010001") returned 6 [0078.758] GetProcessHeap () returned 0xd20000 [0078.758] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc58 [0078.758] GetProcessHeap () returned 0xd20000 [0078.758] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0078.758] GetProcessHeap () returned 0xd20000 [0078.758] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd30f70 [0078.758] GetProcessHeap () returned 0xd20000 [0078.758] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0078.758] GetProcessHeap () returned 0xd20000 [0078.758] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd2f820 [0078.758] GetProcessHeap () returned 0xd20000 [0078.758] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd451e0 [0078.758] GetProcessHeap () returned 0xd20000 [0078.758] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd88 [0078.758] GetProcessHeap () returned 0xd20000 [0078.758] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0078.758] GetProcessHeap () returned 0xd20000 [0078.759] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.759] GetProcessHeap () returned 0xd20000 [0078.759] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0078.759] GetProcessHeap () returned 0xd20000 [0078.759] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd31810 [0078.759] GetProcessHeap () returned 0xd20000 [0078.759] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44e98 [0078.759] GetProcessHeap () returned 0xd20000 [0078.759] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.759] GetProcessHeap () returned 0xd20000 [0078.759] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445d0 [0078.759] GetProcessHeap () returned 0xd20000 [0078.759] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd328d8 [0078.759] GetProcessHeap () returned 0xd20000 [0078.759] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31810 | out: hHeap=0xd20000) returned 1 [0078.759] GetProcessHeap () returned 0xd20000 [0078.759] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0078.759] GetProcessHeap () returned 0xd20000 [0078.759] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd328d8 | out: hHeap=0xd20000) returned 1 [0078.760] GetProcessHeap () returned 0xd20000 [0078.760] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0078.760] GetProcessHeap () returned 0xd20000 [0078.760] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44678 [0078.760] GetProcessHeap () returned 0xd20000 [0078.760] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.760] GetProcessHeap () returned 0xd20000 [0078.760] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0078.760] GetProcessHeap () returned 0xd20000 [0078.760] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.760] GetProcessHeap () returned 0xd20000 [0078.760] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.760] GetProcessHeap () returned 0xd20000 [0078.760] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.760] GetProcessHeap () returned 0xd20000 [0078.760] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.760] GetProcessHeap () returned 0xd20000 [0078.760] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd328d8 [0078.761] GetProcessHeap () returned 0xd20000 [0078.761] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44678 | out: hHeap=0xd20000) returned 1 [0078.761] GetProcessHeap () returned 0xd20000 [0078.761] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0078.761] GetProcessHeap () returned 0xd20000 [0078.761] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd328d8 | out: hHeap=0xd20000) returned 1 [0078.761] GetProcessHeap () returned 0xd20000 [0078.761] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0078.761] GetProcessHeap () returned 0xd20000 [0078.761] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0078.761] GetProcessHeap () returned 0xd20000 [0078.761] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.761] GetProcessHeap () returned 0xd20000 [0078.761] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.761] GetProcessHeap () returned 0xd20000 [0078.762] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.762] GetProcessHeap () returned 0xd20000 [0078.762] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.762] GetProcessHeap () returned 0xd20000 [0078.762] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.762] GetProcessHeap () returned 0xd20000 [0078.762] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.762] GetProcessHeap () returned 0xd20000 [0078.762] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.762] GetProcessHeap () returned 0xd20000 [0078.762] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.762] GetProcessHeap () returned 0xd20000 [0078.762] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0078.762] GetProcessHeap () returned 0xd20000 [0078.762] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0078.762] GetProcessHeap () returned 0xd20000 [0078.762] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0078.763] GetProcessHeap () returned 0xd20000 [0078.763] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0078.763] GetProcessHeap () returned 0xd20000 [0078.763] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0078.763] GetProcessHeap () returned 0xd20000 [0078.763] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0078.763] GetProcessHeap () returned 0xd20000 [0078.763] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0078.763] GetProcessHeap () returned 0xd20000 [0078.763] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0078.763] GetProcessHeap () returned 0xd20000 [0078.763] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0078.763] GetProcessHeap () returned 0xd20000 [0078.763] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0078.763] GetProcessHeap () returned 0xd20000 [0078.763] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.764] GetProcessHeap () returned 0xd20000 [0078.764] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.764] GetProcessHeap () returned 0xd20000 [0078.764] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.764] GetProcessHeap () returned 0xd20000 [0078.764] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.764] GetProcessHeap () returned 0xd20000 [0078.764] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0078.764] GetProcessHeap () returned 0xd20000 [0078.764] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0078.764] GetProcessHeap () returned 0xd20000 [0078.764] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0078.764] GetProcessHeap () returned 0xd20000 [0078.764] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0078.764] GetProcessHeap () returned 0xd20000 [0078.764] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0078.764] GetProcessHeap () returned 0xd20000 [0078.764] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0078.765] GetProcessHeap () returned 0xd20000 [0078.765] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.765] GetProcessHeap () returned 0xd20000 [0078.765] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.765] GetProcessHeap () returned 0xd20000 [0078.765] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.765] GetProcessHeap () returned 0xd20000 [0078.765] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.765] GetProcessHeap () returned 0xd20000 [0078.765] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.765] GetProcessHeap () returned 0xd20000 [0078.765] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.765] GetProcessHeap () returned 0xd20000 [0078.765] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0078.765] GetProcessHeap () returned 0xd20000 [0078.765] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0078.765] GetProcessHeap () returned 0xd20000 [0078.765] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.766] GetProcessHeap () returned 0xd20000 [0078.766] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.766] GetProcessHeap () returned 0xd20000 [0078.766] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.766] GetProcessHeap () returned 0xd20000 [0078.766] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.766] GetProcessHeap () returned 0xd20000 [0078.766] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.766] GetProcessHeap () returned 0xd20000 [0078.766] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.766] GetProcessHeap () returned 0xd20000 [0078.766] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0078.766] GetProcessHeap () returned 0xd20000 [0078.766] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0078.766] GetProcessHeap () returned 0xd20000 [0078.766] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0078.766] GetProcessHeap () returned 0xd20000 [0078.766] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0078.767] GetProcessHeap () returned 0xd20000 [0078.767] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.767] GetProcessHeap () returned 0xd20000 [0078.767] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.767] GetProcessHeap () returned 0xd20000 [0078.767] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.767] GetProcessHeap () returned 0xd20000 [0078.767] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.767] GetProcessHeap () returned 0xd20000 [0078.767] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0078.767] GetProcessHeap () returned 0xd20000 [0078.767] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0078.767] GetProcessHeap () returned 0xd20000 [0078.767] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.767] GetProcessHeap () returned 0xd20000 [0078.767] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.768] GetProcessHeap () returned 0xd20000 [0078.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0078.768] GetProcessHeap () returned 0xd20000 [0078.768] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0078.768] GetProcessHeap () returned 0xd20000 [0078.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0078.768] GetProcessHeap () returned 0xd20000 [0078.768] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0078.768] GetProcessHeap () returned 0xd20000 [0078.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0078.768] GetProcessHeap () returned 0xd20000 [0078.768] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0078.768] GetProcessHeap () returned 0xd20000 [0078.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.768] GetProcessHeap () returned 0xd20000 [0078.768] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.768] GetProcessHeap () returned 0xd20000 [0078.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0078.769] GetProcessHeap () returned 0xd20000 [0078.769] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0078.769] GetProcessHeap () returned 0xd20000 [0078.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.769] GetProcessHeap () returned 0xd20000 [0078.769] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.769] GetProcessHeap () returned 0xd20000 [0078.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0078.769] GetProcessHeap () returned 0xd20000 [0078.769] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0078.769] GetProcessHeap () returned 0xd20000 [0078.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0078.769] GetProcessHeap () returned 0xd20000 [0078.769] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0078.769] GetProcessHeap () returned 0xd20000 [0078.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.769] GetProcessHeap () returned 0xd20000 [0078.769] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.770] GetProcessHeap () returned 0xd20000 [0078.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.770] GetProcessHeap () returned 0xd20000 [0078.770] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.770] GetProcessHeap () returned 0xd20000 [0078.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0078.770] GetProcessHeap () returned 0xd20000 [0078.770] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0078.770] GetProcessHeap () returned 0xd20000 [0078.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.770] GetProcessHeap () returned 0xd20000 [0078.770] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.770] GetProcessHeap () returned 0xd20000 [0078.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.770] GetProcessHeap () returned 0xd20000 [0078.770] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.770] GetProcessHeap () returned 0xd20000 [0078.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0078.771] GetProcessHeap () returned 0xd20000 [0078.771] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0078.771] GetProcessHeap () returned 0xd20000 [0078.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0078.771] GetProcessHeap () returned 0xd20000 [0078.771] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0078.771] GetProcessHeap () returned 0xd20000 [0078.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0078.771] GetProcessHeap () returned 0xd20000 [0078.771] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0078.771] GetProcessHeap () returned 0xd20000 [0078.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.771] GetProcessHeap () returned 0xd20000 [0078.771] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.771] GetProcessHeap () returned 0xd20000 [0078.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0078.771] GetProcessHeap () returned 0xd20000 [0078.772] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0078.772] GetProcessHeap () returned 0xd20000 [0078.772] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0078.772] GetProcessHeap () returned 0xd20000 [0078.772] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0078.772] GetProcessHeap () returned 0xd20000 [0078.772] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.772] GetProcessHeap () returned 0xd20000 [0078.772] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.772] GetProcessHeap () returned 0xd20000 [0078.772] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.772] GetProcessHeap () returned 0xd20000 [0078.772] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.772] GetProcessHeap () returned 0xd20000 [0078.772] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0078.772] GetProcessHeap () returned 0xd20000 [0078.772] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0078.772] GetProcessHeap () returned 0xd20000 [0078.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.773] GetProcessHeap () returned 0xd20000 [0078.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.773] GetProcessHeap () returned 0xd20000 [0078.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0078.773] GetProcessHeap () returned 0xd20000 [0078.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0078.773] GetProcessHeap () returned 0xd20000 [0078.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0078.773] GetProcessHeap () returned 0xd20000 [0078.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0078.773] GetProcessHeap () returned 0xd20000 [0078.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0078.773] GetProcessHeap () returned 0xd20000 [0078.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0078.773] GetProcessHeap () returned 0xd20000 [0078.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.774] GetProcessHeap () returned 0xd20000 [0078.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.774] GetProcessHeap () returned 0xd20000 [0078.774] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.774] GetProcessHeap () returned 0xd20000 [0078.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.774] GetProcessHeap () returned 0xd20000 [0078.774] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0078.774] GetProcessHeap () returned 0xd20000 [0078.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0078.774] GetProcessHeap () returned 0xd20000 [0078.774] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.774] GetProcessHeap () returned 0xd20000 [0078.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.774] GetProcessHeap () returned 0xd20000 [0078.774] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.774] GetProcessHeap () returned 0xd20000 [0078.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.775] GetProcessHeap () returned 0xd20000 [0078.775] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.775] GetProcessHeap () returned 0xd20000 [0078.775] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.775] GetProcessHeap () returned 0xd20000 [0078.775] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.775] GetProcessHeap () returned 0xd20000 [0078.775] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.775] GetProcessHeap () returned 0xd20000 [0078.775] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0078.775] GetProcessHeap () returned 0xd20000 [0078.775] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0078.775] GetProcessHeap () returned 0xd20000 [0078.775] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0078.775] GetProcessHeap () returned 0xd20000 [0078.775] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0078.775] GetProcessHeap () returned 0xd20000 [0078.776] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.776] GetProcessHeap () returned 0xd20000 [0078.776] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.776] GetProcessHeap () returned 0xd20000 [0078.776] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0078.776] GetProcessHeap () returned 0xd20000 [0078.776] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0078.776] GetProcessHeap () returned 0xd20000 [0078.776] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0078.776] GetProcessHeap () returned 0xd20000 [0078.776] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0078.776] GetProcessHeap () returned 0xd20000 [0078.776] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.776] GetProcessHeap () returned 0xd20000 [0078.776] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.776] GetProcessHeap () returned 0xd20000 [0078.776] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0078.776] GetProcessHeap () returned 0xd20000 [0078.776] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0078.777] GetProcessHeap () returned 0xd20000 [0078.777] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.777] GetProcessHeap () returned 0xd20000 [0078.777] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.777] GetProcessHeap () returned 0xd20000 [0078.777] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0078.778] GetProcessHeap () returned 0xd20000 [0078.778] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0078.778] GetProcessHeap () returned 0xd20000 [0078.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.778] GetProcessHeap () returned 0xd20000 [0078.778] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.778] GetProcessHeap () returned 0xd20000 [0078.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.778] GetProcessHeap () returned 0xd20000 [0078.778] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.778] GetProcessHeap () returned 0xd20000 [0078.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0078.778] GetProcessHeap () returned 0xd20000 [0078.778] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0078.778] GetProcessHeap () returned 0xd20000 [0078.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0078.778] GetProcessHeap () returned 0xd20000 [0078.778] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0078.779] GetProcessHeap () returned 0xd20000 [0078.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0078.779] GetProcessHeap () returned 0xd20000 [0078.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0078.779] GetProcessHeap () returned 0xd20000 [0078.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0078.779] GetProcessHeap () returned 0xd20000 [0078.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0078.779] GetProcessHeap () returned 0xd20000 [0078.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.779] GetProcessHeap () returned 0xd20000 [0078.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.779] GetProcessHeap () returned 0xd20000 [0078.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0078.779] GetProcessHeap () returned 0xd20000 [0078.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0078.779] GetProcessHeap () returned 0xd20000 [0078.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0078.780] GetProcessHeap () returned 0xd20000 [0078.780] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0078.780] GetProcessHeap () returned 0xd20000 [0078.780] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0078.780] GetProcessHeap () returned 0xd20000 [0078.780] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0078.780] GetProcessHeap () returned 0xd20000 [0078.780] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0078.780] GetProcessHeap () returned 0xd20000 [0078.780] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0078.780] GetProcessHeap () returned 0xd20000 [0078.780] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.780] GetProcessHeap () returned 0xd20000 [0078.780] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.780] GetProcessHeap () returned 0xd20000 [0078.780] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0078.780] GetProcessHeap () returned 0xd20000 [0078.781] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0078.781] GetProcessHeap () returned 0xd20000 [0078.781] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0078.781] GetProcessHeap () returned 0xd20000 [0078.781] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0078.781] GetProcessHeap () returned 0xd20000 [0078.781] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0078.781] GetProcessHeap () returned 0xd20000 [0078.781] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0078.781] GetProcessHeap () returned 0xd20000 [0078.781] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0078.781] GetProcessHeap () returned 0xd20000 [0078.781] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0078.781] GetProcessHeap () returned 0xd20000 [0078.781] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0078.781] GetProcessHeap () returned 0xd20000 [0078.781] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0078.781] GetProcessHeap () returned 0xd20000 [0078.781] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445d0 | out: hHeap=0xd20000) returned 1 [0078.782] GetProcessHeap () returned 0xd20000 [0078.782] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0078.782] GetProcessHeap () returned 0xd20000 [0078.782] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0078.782] GetProcessHeap () returned 0xd20000 [0078.782] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd30f70 | out: hHeap=0xd20000) returned 1 [0078.782] GetProcessHeap () returned 0xd20000 [0078.782] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0078.782] GetProcessHeap () returned 0xd20000 [0078.782] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0078.782] GetProcessHeap () returned 0xd20000 [0078.782] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0078.782] WriteFile (in: hFile=0x230, lpBuffer=0xd49520*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd49520*, lpNumberOfBytesWritten=0x299d864*=0x388, lpOverlapped=0x0) returned 1 [0078.790] GetProcessHeap () returned 0xd20000 [0078.790] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd49520, Size=0x30) returned 0xd49520 [0078.790] GetProcessHeap () returned 0xd20000 [0078.790] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0078.790] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0078.791] GetProcessHeap () returned 0xd20000 [0078.791] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x89ed0) returned 0x2d56020 [0078.801] ReadFile (in: hFile=0x230, lpBuffer=0x2d56020, nNumberOfBytesToRead=0x89ed0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x2d56020*, lpNumberOfBytesRead=0x299d7e8*=0x89ed0, lpOverlapped=0x0) returned 1 [0078.823] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0078.823] WriteFile (in: hFile=0x230, lpBuffer=0x2d56020*, nNumberOfBytesToWrite=0x89ed0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0x2d56020*, lpNumberOfBytesWritten=0x299d7e4*=0x89ed0, lpOverlapped=0x0) returned 1 [0079.015] GetProcessHeap () returned 0xd20000 [0079.015] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0x2d56020 | out: hHeap=0xd20000) returned 1 [0079.015] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0079.015] WriteFile (in: hFile=0x230, lpBuffer=0xd49520*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd49520*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0079.017] CloseHandle (hObject=0x230) returned 1 [0079.039] GetProcessHeap () returned 0xd20000 [0079.039] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd426c0 | out: hHeap=0xd20000) returned 1 [0079.040] GetProcessHeap () returned 0xd20000 [0079.040] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2e898 | out: hHeap=0xd20000) returned 1 [0079.040] GetProcessHeap () returned 0xd20000 [0079.040] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0079.040] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\GatherOSState.EXE" | out: lpString1="C:\\Windows10Upgrade\\GatherOSState.EXE") returned="C:\\Windows10Upgrade\\GatherOSState.EXE" [0079.040] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\GatherOSState.EXE", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\GatherOSState.EXE.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\GatherOSState.EXE.[ponce.lorena@aol.com]" [0079.040] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\GatherOSState.EXE" (normalized: "c:\\windows10upgrade\\gatherosstate.exe"), lpNewFileName="C:\\Windows10Upgrade\\GatherOSState.EXE.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\gatherosstate.exe.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0079.041] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\GatherOSState.EXE" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0079.041] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0079.041] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\HOW_RECOVER.html" [0079.041] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\how_recover.html")) returned 0x20 [0079.041] GetProcessHeap () returned 0xd20000 [0079.041] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd365c8 | out: hHeap=0xd20000) returned 1 [0079.041] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39058e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39058e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x83cc8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GetCurrentDeploy.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0079.041] lstrcmpiW (lpString1="GetCurrentDeploy.dll", lpString2=".") returned 1 [0079.041] lstrcmpiW (lpString1="GetCurrentDeploy.dll", lpString2="..") returned 1 [0079.042] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="GetCurrentDeploy.dll" | out: lpString1="C:\\Windows10Upgrade\\GetCurrentDeploy.dll") returned="C:\\Windows10Upgrade\\GetCurrentDeploy.dll" [0079.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentDeploy.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0079.042] GetProcessHeap () returned 0xd20000 [0079.042] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x15) returned 0xd36748 [0079.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentDeploy.dll", cchWideChar=-1, lpMultiByteStr=0xd36748, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentDeploy.dll", lpUsedDefaultChar=0x0) returned 21 [0079.042] lstrlenA (lpString="GetCurrentDeploy.dll") returned 20 [0079.042] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0079.042] lstrlenA (lpString="GetCurrentDeploy.dll") returned 20 [0079.042] lstrlenA (lpString=".dll") returned 4 [0079.042] lstrlenA (lpString=".dll") returned 4 [0079.042] lstrlenA (lpString="GetCurrentDeploy.dll") returned 20 [0079.042] lstrcmpiA (lpString1=".dll", lpString2=".dll") returned 0 [0079.042] GetProcessHeap () returned 0xd20000 [0079.042] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36748 | out: hHeap=0xd20000) returned 1 [0079.042] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea392ca4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea392ca4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~2.DLL")) returned 1 [0079.042] lstrcmpiW (lpString1="GetCurrentOOBE.dll", lpString2=".") returned 1 [0079.042] lstrcmpiW (lpString1="GetCurrentOOBE.dll", lpString2="..") returned 1 [0079.043] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="GetCurrentOOBE.dll" | out: lpString1="C:\\Windows10Upgrade\\GetCurrentOOBE.dll") returned="C:\\Windows10Upgrade\\GetCurrentOOBE.dll" [0079.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentOOBE.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0079.043] GetProcessHeap () returned 0xd20000 [0079.043] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x13) returned 0xd365a8 [0079.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentOOBE.dll", cchWideChar=-1, lpMultiByteStr=0xd365a8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentOOBE.dll", lpUsedDefaultChar=0x0) returned 19 [0079.043] lstrlenA (lpString="GetCurrentOOBE.dll") returned 18 [0079.043] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0079.044] lstrlenA (lpString="GetCurrentOOBE.dll") returned 18 [0079.044] lstrlenA (lpString=".dll") returned 4 [0079.044] lstrlenA (lpString=".dll") returned 4 [0079.044] lstrlenA (lpString="GetCurrentOOBE.dll") returned 18 [0079.044] lstrcmpiA (lpString1=".dll", lpString2=".dll") returned 0 [0079.044] GetProcessHeap () returned 0xd20000 [0079.044] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd365a8 | out: hHeap=0xd20000) returned 1 [0079.044] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39539e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39539e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x11ec8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GetCurrentRollback.EXE", cAlternateFileName="GETCUR~1.EXE")) returned 1 [0079.044] lstrcmpiW (lpString1="GetCurrentRollback.EXE", lpString2=".") returned 1 [0079.044] lstrcmpiW (lpString1="GetCurrentRollback.EXE", lpString2="..") returned 1 [0079.044] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="GetCurrentRollback.EXE" | out: lpString1="C:\\Windows10Upgrade\\GetCurrentRollback.EXE") returned="C:\\Windows10Upgrade\\GetCurrentRollback.EXE" [0079.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentRollback.EXE", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0079.044] GetProcessHeap () returned 0xd20000 [0079.044] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x17) returned 0xd36448 [0079.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentRollback.EXE", cchWideChar=-1, lpMultiByteStr=0xd36448, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentRollback.EXE", lpUsedDefaultChar=0x0) returned 23 [0079.044] lstrlenA (lpString="GetCurrentRollback.EXE") returned 22 [0079.044] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0079.044] lstrlenA (lpString="GetCurrentRollback.EXE") returned 22 [0079.045] lstrlenA (lpString=".dll") returned 4 [0079.045] lstrlenA (lpString=".dll") returned 4 [0079.045] lstrlenA (lpString="GetCurrentRollback.EXE") returned 22 [0079.045] lstrcmpiA (lpString1=".EXE", lpString2=".dll") returned 1 [0079.045] lstrlenA (lpString="GetCurrentRollback.EXE") returned 22 [0079.045] lstrlenA (lpString=".ini") returned 4 [0079.045] lstrlenA (lpString=".ini") returned 4 [0079.045] lstrlenA (lpString="GetCurrentRollback.EXE") returned 22 [0079.045] lstrcmpiA (lpString1=".EXE", lpString2=".ini") returned -1 [0079.045] lstrlenA (lpString="GetCurrentRollback.EXE") returned 22 [0079.045] lstrlenA (lpString=".inc") returned 4 [0079.045] lstrlenA (lpString=".inc") returned 4 [0079.045] lstrlenA (lpString="GetCurrentRollback.EXE") returned 22 [0079.045] lstrcmpiA (lpString1=".EXE", lpString2=".inc") returned -1 [0079.045] lstrcmpiW (lpString1="GetCurrentRollback.EXE", lpString2="HOW_RECOVER.html") returned -1 [0079.045] lstrcmpiW (lpString1="GetCurrentRollback.EXE", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0079.045] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0079.045] lstrcmpiW (lpString1="GetCurrentRollback.EXE", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0079.046] GetProcessHeap () returned 0xd20000 [0079.046] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd426c0 [0079.046] CreateFileW (lpFileName="C:\\Windows10Upgrade\\GetCurrentRollback.EXE" (normalized: "c:\\windows10upgrade\\getcurrentrollback.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0079.047] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=73416) returned 1 [0079.047] GetProcessHeap () returned 0xd20000 [0079.047] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd2e898 [0079.048] GetProcessHeap () returned 0xd20000 [0079.048] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0079.048] lstrlenW (lpString="C:\\Windows10Upgrade\\GetCurrentRollback.EXE") returned 42 [0079.048] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0079.048] GetProcessHeap () returned 0xd20000 [0079.048] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0079.048] GetProcessHeap () returned 0xd20000 [0079.048] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x388) returned 0xd4a560 [0079.048] lstrlenA (lpString="rsa_encrypt") returned 11 [0079.048] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0079.051] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0079.051] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0079.051] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0079.051] GetProcessHeap () returned 0xd20000 [0079.051] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0079.051] lstrlenA (lpString="010001") returned 6 [0079.051] GetProcessHeap () returned 0xd20000 [0079.051] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd88 [0079.051] GetProcessHeap () returned 0xd20000 [0079.051] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0079.051] GetProcessHeap () returned 0xd20000 [0079.051] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd30f70 [0079.051] GetProcessHeap () returned 0xd20000 [0079.052] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0079.052] GetProcessHeap () returned 0xd20000 [0079.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd2f820 [0079.052] GetProcessHeap () returned 0xd20000 [0079.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45640 [0079.052] GetProcessHeap () returned 0xd20000 [0079.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc48 [0079.052] GetProcessHeap () returned 0xd20000 [0079.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0079.052] GetProcessHeap () returned 0xd20000 [0079.052] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0079.052] GetProcessHeap () returned 0xd20000 [0079.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0079.052] GetProcessHeap () returned 0xd20000 [0079.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd328d8 [0079.052] GetProcessHeap () returned 0xd20000 [0079.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd450c8 [0079.052] GetProcessHeap () returned 0xd20000 [0079.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0079.053] GetProcessHeap () returned 0xd20000 [0079.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445d0 [0079.053] GetProcessHeap () returned 0xd20000 [0079.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd31810 [0079.053] GetProcessHeap () returned 0xd20000 [0079.053] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd328d8 | out: hHeap=0xd20000) returned 1 [0079.053] GetProcessHeap () returned 0xd20000 [0079.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0079.053] GetProcessHeap () returned 0xd20000 [0079.053] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31810 | out: hHeap=0xd20000) returned 1 [0079.053] GetProcessHeap () returned 0xd20000 [0079.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0079.053] GetProcessHeap () returned 0xd20000 [0079.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445a0 [0079.053] GetProcessHeap () returned 0xd20000 [0079.053] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0079.053] GetProcessHeap () returned 0xd20000 [0079.054] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0079.054] GetProcessHeap () returned 0xd20000 [0079.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0079.054] GetProcessHeap () returned 0xd20000 [0079.054] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0079.054] GetProcessHeap () returned 0xd20000 [0079.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0079.054] GetProcessHeap () returned 0xd20000 [0079.054] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0079.054] GetProcessHeap () returned 0xd20000 [0079.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd31810 [0079.054] GetProcessHeap () returned 0xd20000 [0079.054] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445a0 | out: hHeap=0xd20000) returned 1 [0079.054] GetProcessHeap () returned 0xd20000 [0079.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0079.054] GetProcessHeap () returned 0xd20000 [0079.054] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31810 | out: hHeap=0xd20000) returned 1 [0079.054] GetProcessHeap () returned 0xd20000 [0079.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0079.055] GetProcessHeap () returned 0xd20000 [0079.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0079.055] GetProcessHeap () returned 0xd20000 [0079.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0079.055] GetProcessHeap () returned 0xd20000 [0079.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0079.055] GetProcessHeap () returned 0xd20000 [0079.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0079.055] GetProcessHeap () returned 0xd20000 [0079.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0079.055] GetProcessHeap () returned 0xd20000 [0079.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0079.055] GetProcessHeap () returned 0xd20000 [0079.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0079.055] GetProcessHeap () returned 0xd20000 [0079.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0079.056] GetProcessHeap () returned 0xd20000 [0079.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0079.056] GetProcessHeap () returned 0xd20000 [0079.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0079.056] GetProcessHeap () returned 0xd20000 [0079.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0079.056] GetProcessHeap () returned 0xd20000 [0079.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0079.056] GetProcessHeap () returned 0xd20000 [0079.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0079.056] GetProcessHeap () returned 0xd20000 [0079.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0079.056] GetProcessHeap () returned 0xd20000 [0079.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0079.056] GetProcessHeap () returned 0xd20000 [0079.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0079.056] GetProcessHeap () returned 0xd20000 [0079.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0079.057] GetProcessHeap () returned 0xd20000 [0079.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.057] GetProcessHeap () returned 0xd20000 [0079.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.057] GetProcessHeap () returned 0xd20000 [0079.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.057] GetProcessHeap () returned 0xd20000 [0079.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.057] GetProcessHeap () returned 0xd20000 [0079.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0079.057] GetProcessHeap () returned 0xd20000 [0079.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0079.057] GetProcessHeap () returned 0xd20000 [0079.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0079.057] GetProcessHeap () returned 0xd20000 [0079.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0079.058] GetProcessHeap () returned 0xd20000 [0079.058] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0079.058] GetProcessHeap () returned 0xd20000 [0079.058] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0079.058] GetProcessHeap () returned 0xd20000 [0079.058] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0079.058] GetProcessHeap () returned 0xd20000 [0079.058] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0079.058] GetProcessHeap () returned 0xd20000 [0079.058] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0079.058] GetProcessHeap () returned 0xd20000 [0079.058] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0079.059] GetProcessHeap () returned 0xd20000 [0079.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0079.059] GetProcessHeap () returned 0xd20000 [0079.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0079.059] GetProcessHeap () returned 0xd20000 [0079.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0079.059] GetProcessHeap () returned 0xd20000 [0079.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0079.059] GetProcessHeap () returned 0xd20000 [0079.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0079.059] GetProcessHeap () returned 0xd20000 [0079.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0079.059] GetProcessHeap () returned 0xd20000 [0079.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0079.059] GetProcessHeap () returned 0xd20000 [0079.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0079.060] GetProcessHeap () returned 0xd20000 [0079.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.060] GetProcessHeap () returned 0xd20000 [0079.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.060] GetProcessHeap () returned 0xd20000 [0079.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.060] GetProcessHeap () returned 0xd20000 [0079.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.060] GetProcessHeap () returned 0xd20000 [0079.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0079.060] GetProcessHeap () returned 0xd20000 [0079.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0079.060] GetProcessHeap () returned 0xd20000 [0079.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0079.060] GetProcessHeap () returned 0xd20000 [0079.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0079.060] GetProcessHeap () returned 0xd20000 [0079.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0079.061] GetProcessHeap () returned 0xd20000 [0079.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0079.061] GetProcessHeap () returned 0xd20000 [0079.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0079.061] GetProcessHeap () returned 0xd20000 [0079.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0079.061] GetProcessHeap () returned 0xd20000 [0079.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0079.061] GetProcessHeap () returned 0xd20000 [0079.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0079.061] GetProcessHeap () returned 0xd20000 [0079.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0079.061] GetProcessHeap () returned 0xd20000 [0079.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0079.061] GetProcessHeap () returned 0xd20000 [0079.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0079.061] GetProcessHeap () returned 0xd20000 [0079.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0079.062] GetProcessHeap () returned 0xd20000 [0079.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0079.062] GetProcessHeap () returned 0xd20000 [0079.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0079.062] GetProcessHeap () returned 0xd20000 [0079.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.062] GetProcessHeap () returned 0xd20000 [0079.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.062] GetProcessHeap () returned 0xd20000 [0079.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0079.062] GetProcessHeap () returned 0xd20000 [0079.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0079.062] GetProcessHeap () returned 0xd20000 [0079.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0079.062] GetProcessHeap () returned 0xd20000 [0079.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0079.062] GetProcessHeap () returned 0xd20000 [0079.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0079.063] GetProcessHeap () returned 0xd20000 [0079.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0079.063] GetProcessHeap () returned 0xd20000 [0079.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.063] GetProcessHeap () returned 0xd20000 [0079.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.063] GetProcessHeap () returned 0xd20000 [0079.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0079.063] GetProcessHeap () returned 0xd20000 [0079.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0079.063] GetProcessHeap () returned 0xd20000 [0079.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0079.063] GetProcessHeap () returned 0xd20000 [0079.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0079.063] GetProcessHeap () returned 0xd20000 [0079.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.064] GetProcessHeap () returned 0xd20000 [0079.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.064] GetProcessHeap () returned 0xd20000 [0079.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0079.064] GetProcessHeap () returned 0xd20000 [0079.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0079.064] GetProcessHeap () returned 0xd20000 [0079.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.064] GetProcessHeap () returned 0xd20000 [0079.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.064] GetProcessHeap () returned 0xd20000 [0079.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.064] GetProcessHeap () returned 0xd20000 [0079.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.064] GetProcessHeap () returned 0xd20000 [0079.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.064] GetProcessHeap () returned 0xd20000 [0079.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.065] GetProcessHeap () returned 0xd20000 [0079.065] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0079.065] GetProcessHeap () returned 0xd20000 [0079.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0079.065] GetProcessHeap () returned 0xd20000 [0079.065] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0079.065] GetProcessHeap () returned 0xd20000 [0079.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0079.065] GetProcessHeap () returned 0xd20000 [0079.065] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0079.065] GetProcessHeap () returned 0xd20000 [0079.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0079.065] GetProcessHeap () returned 0xd20000 [0079.065] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0079.065] GetProcessHeap () returned 0xd20000 [0079.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0079.065] GetProcessHeap () returned 0xd20000 [0079.065] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0079.066] GetProcessHeap () returned 0xd20000 [0079.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0079.066] GetProcessHeap () returned 0xd20000 [0079.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0079.066] GetProcessHeap () returned 0xd20000 [0079.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0079.066] GetProcessHeap () returned 0xd20000 [0079.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0079.066] GetProcessHeap () returned 0xd20000 [0079.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0079.066] GetProcessHeap () returned 0xd20000 [0079.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0079.066] GetProcessHeap () returned 0xd20000 [0079.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0079.066] GetProcessHeap () returned 0xd20000 [0079.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0079.066] GetProcessHeap () returned 0xd20000 [0079.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0079.067] GetProcessHeap () returned 0xd20000 [0079.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0079.067] GetProcessHeap () returned 0xd20000 [0079.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0079.067] GetProcessHeap () returned 0xd20000 [0079.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.067] GetProcessHeap () returned 0xd20000 [0079.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.067] GetProcessHeap () returned 0xd20000 [0079.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0079.067] GetProcessHeap () returned 0xd20000 [0079.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0079.067] GetProcessHeap () returned 0xd20000 [0079.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0079.067] GetProcessHeap () returned 0xd20000 [0079.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0079.068] GetProcessHeap () returned 0xd20000 [0079.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0079.068] GetProcessHeap () returned 0xd20000 [0079.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0079.068] GetProcessHeap () returned 0xd20000 [0079.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0079.068] GetProcessHeap () returned 0xd20000 [0079.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0079.068] GetProcessHeap () returned 0xd20000 [0079.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0079.068] GetProcessHeap () returned 0xd20000 [0079.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0079.068] GetProcessHeap () returned 0xd20000 [0079.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0079.068] GetProcessHeap () returned 0xd20000 [0079.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0079.069] GetProcessHeap () returned 0xd20000 [0079.069] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.069] GetProcessHeap () returned 0xd20000 [0079.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.069] GetProcessHeap () returned 0xd20000 [0079.069] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0079.069] GetProcessHeap () returned 0xd20000 [0079.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0079.069] GetProcessHeap () returned 0xd20000 [0079.069] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0079.069] GetProcessHeap () returned 0xd20000 [0079.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0079.069] GetProcessHeap () returned 0xd20000 [0079.069] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0079.069] GetProcessHeap () returned 0xd20000 [0079.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0079.069] GetProcessHeap () returned 0xd20000 [0079.070] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0079.070] GetProcessHeap () returned 0xd20000 [0079.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0079.070] GetProcessHeap () returned 0xd20000 [0079.070] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0079.070] GetProcessHeap () returned 0xd20000 [0079.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0079.070] GetProcessHeap () returned 0xd20000 [0079.070] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0079.070] GetProcessHeap () returned 0xd20000 [0079.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0079.070] GetProcessHeap () returned 0xd20000 [0079.070] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0079.070] GetProcessHeap () returned 0xd20000 [0079.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0079.070] GetProcessHeap () returned 0xd20000 [0079.070] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0079.070] GetProcessHeap () returned 0xd20000 [0079.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0079.071] GetProcessHeap () returned 0xd20000 [0079.071] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0079.071] GetProcessHeap () returned 0xd20000 [0079.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0079.071] GetProcessHeap () returned 0xd20000 [0079.071] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.071] GetProcessHeap () returned 0xd20000 [0079.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.071] GetProcessHeap () returned 0xd20000 [0079.071] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0079.071] GetProcessHeap () returned 0xd20000 [0079.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0079.071] GetProcessHeap () returned 0xd20000 [0079.071] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0079.071] GetProcessHeap () returned 0xd20000 [0079.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0079.071] GetProcessHeap () returned 0xd20000 [0079.072] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0079.072] GetProcessHeap () returned 0xd20000 [0079.072] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0079.072] GetProcessHeap () returned 0xd20000 [0079.072] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.072] GetProcessHeap () returned 0xd20000 [0079.072] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.072] GetProcessHeap () returned 0xd20000 [0079.072] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.072] GetProcessHeap () returned 0xd20000 [0079.072] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.072] GetProcessHeap () returned 0xd20000 [0079.072] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.072] GetProcessHeap () returned 0xd20000 [0079.072] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.072] GetProcessHeap () returned 0xd20000 [0079.072] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0079.072] GetProcessHeap () returned 0xd20000 [0079.072] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0079.073] GetProcessHeap () returned 0xd20000 [0079.073] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0079.073] GetProcessHeap () returned 0xd20000 [0079.073] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0079.073] GetProcessHeap () returned 0xd20000 [0079.073] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0079.073] GetProcessHeap () returned 0xd20000 [0079.073] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0079.073] GetProcessHeap () returned 0xd20000 [0079.073] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.073] GetProcessHeap () returned 0xd20000 [0079.073] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.073] GetProcessHeap () returned 0xd20000 [0079.073] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0079.073] GetProcessHeap () returned 0xd20000 [0079.073] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0079.073] GetProcessHeap () returned 0xd20000 [0079.073] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.073] GetProcessHeap () returned 0xd20000 [0079.074] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.074] GetProcessHeap () returned 0xd20000 [0079.074] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.074] GetProcessHeap () returned 0xd20000 [0079.099] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.099] GetProcessHeap () returned 0xd20000 [0079.099] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0079.100] GetProcessHeap () returned 0xd20000 [0079.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0079.100] GetProcessHeap () returned 0xd20000 [0079.100] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0079.100] GetProcessHeap () returned 0xd20000 [0079.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0079.100] GetProcessHeap () returned 0xd20000 [0079.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0079.100] GetProcessHeap () returned 0xd20000 [0079.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0079.100] GetProcessHeap () returned 0xd20000 [0079.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0079.100] GetProcessHeap () returned 0xd20000 [0079.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0079.100] GetProcessHeap () returned 0xd20000 [0079.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445d0 | out: hHeap=0xd20000) returned 1 [0079.100] GetProcessHeap () returned 0xd20000 [0079.101] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0079.101] GetProcessHeap () returned 0xd20000 [0079.101] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0079.101] GetProcessHeap () returned 0xd20000 [0079.101] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd30f70 | out: hHeap=0xd20000) returned 1 [0079.101] GetProcessHeap () returned 0xd20000 [0079.101] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0079.101] GetProcessHeap () returned 0xd20000 [0079.101] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0079.101] GetProcessHeap () returned 0xd20000 [0079.101] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0079.101] WriteFile (in: hFile=0x230, lpBuffer=0xd4a560*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4a560*, lpNumberOfBytesWritten=0x299d864*=0x388, lpOverlapped=0x0) returned 1 [0079.122] GetProcessHeap () returned 0xd20000 [0079.123] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4a560, Size=0x30) returned 0xd4a560 [0079.123] GetProcessHeap () returned 0xd20000 [0079.123] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0079.123] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0079.123] GetProcessHeap () returned 0xd20000 [0079.123] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x11ed0) returned 0xd4a598 [0079.125] ReadFile (in: hFile=0x230, lpBuffer=0xd4a598, nNumberOfBytesToRead=0x11ed0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4a598*, lpNumberOfBytesRead=0x299d7e8*=0x11ed0, lpOverlapped=0x0) returned 1 [0079.128] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0079.128] WriteFile (in: hFile=0x230, lpBuffer=0xd4a598*, nNumberOfBytesToWrite=0x11ed0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4a598*, lpNumberOfBytesWritten=0x299d7e4*=0x11ed0, lpOverlapped=0x0) returned 1 [0079.401] GetProcessHeap () returned 0xd20000 [0079.401] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a598 | out: hHeap=0xd20000) returned 1 [0079.401] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0079.402] WriteFile (in: hFile=0x230, lpBuffer=0xd4a560*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4a560*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0079.406] CloseHandle (hObject=0x230) returned 1 [0079.410] GetProcessHeap () returned 0xd20000 [0079.410] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd426c0 | out: hHeap=0xd20000) returned 1 [0079.410] GetProcessHeap () returned 0xd20000 [0079.410] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2e898 | out: hHeap=0xd20000) returned 1 [0079.410] GetProcessHeap () returned 0xd20000 [0079.410] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0079.410] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\GetCurrentRollback.EXE" | out: lpString1="C:\\Windows10Upgrade\\GetCurrentRollback.EXE") returned="C:\\Windows10Upgrade\\GetCurrentRollback.EXE" [0079.410] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\GetCurrentRollback.EXE", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\GetCurrentRollback.EXE.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\GetCurrentRollback.EXE.[ponce.lorena@aol.com]" [0079.410] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\GetCurrentRollback.EXE" (normalized: "c:\\windows10upgrade\\getcurrentrollback.exe"), lpNewFileName="C:\\Windows10Upgrade\\GetCurrentRollback.EXE.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\getcurrentrollback.exe.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0079.411] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\GetCurrentRollback.EXE" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0079.411] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0079.411] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\HOW_RECOVER.html" [0079.411] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\how_recover.html")) returned 0x20 [0079.411] GetProcessHeap () returned 0xd20000 [0079.411] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36448 | out: hHeap=0xd20000) returned 1 [0079.411] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39673d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39673d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x6cc8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HttpHelper.exe", cAlternateFileName="HTTPHE~1.EXE")) returned 1 [0079.411] lstrcmpiW (lpString1="HttpHelper.exe", lpString2=".") returned 1 [0079.411] lstrcmpiW (lpString1="HttpHelper.exe", lpString2="..") returned 1 [0079.411] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="HttpHelper.exe" | out: lpString1="C:\\Windows10Upgrade\\HttpHelper.exe") returned="C:\\Windows10Upgrade\\HttpHelper.exe" [0079.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HttpHelper.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0079.412] GetProcessHeap () returned 0xd20000 [0079.412] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd44648 [0079.412] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HttpHelper.exe", cchWideChar=-1, lpMultiByteStr=0xd44648, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HttpHelper.exe", lpUsedDefaultChar=0x0) returned 15 [0079.412] lstrlenA (lpString="HttpHelper.exe") returned 14 [0079.412] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0079.412] lstrlenA (lpString="HttpHelper.exe") returned 14 [0079.412] lstrlenA (lpString=".dll") returned 4 [0079.412] lstrlenA (lpString=".dll") returned 4 [0079.412] lstrlenA (lpString="HttpHelper.exe") returned 14 [0079.412] lstrcmpiA (lpString1=".exe", lpString2=".dll") returned 1 [0079.412] lstrlenA (lpString="HttpHelper.exe") returned 14 [0079.412] lstrlenA (lpString=".ini") returned 4 [0079.412] lstrlenA (lpString=".ini") returned 4 [0079.412] lstrlenA (lpString="HttpHelper.exe") returned 14 [0079.412] lstrcmpiA (lpString1=".exe", lpString2=".ini") returned -1 [0079.412] lstrlenA (lpString="HttpHelper.exe") returned 14 [0079.412] lstrlenA (lpString=".inc") returned 4 [0079.412] lstrlenA (lpString=".inc") returned 4 [0079.413] lstrlenA (lpString="HttpHelper.exe") returned 14 [0079.413] lstrcmpiA (lpString1=".exe", lpString2=".inc") returned -1 [0079.413] lstrcmpiW (lpString1="HttpHelper.exe", lpString2="HOW_RECOVER.html") returned 1 [0079.413] lstrcmpiW (lpString1="HttpHelper.exe", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0079.413] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0079.413] lstrcmpiW (lpString1="HttpHelper.exe", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0079.413] GetProcessHeap () returned 0xd20000 [0079.413] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42620 [0079.413] CreateFileW (lpFileName="C:\\Windows10Upgrade\\HttpHelper.exe" (normalized: "c:\\windows10upgrade\\httphelper.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0079.413] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=27848) returned 1 [0079.414] GetProcessHeap () returned 0xd20000 [0079.414] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd2e898 [0079.414] GetProcessHeap () returned 0xd20000 [0079.414] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0079.414] lstrlenW (lpString="C:\\Windows10Upgrade\\HttpHelper.exe") returned 34 [0079.414] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0079.414] GetProcessHeap () returned 0xd20000 [0079.414] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0079.414] GetProcessHeap () returned 0xd20000 [0079.414] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4a598 [0079.414] lstrlenA (lpString="rsa_encrypt") returned 11 [0079.414] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0079.416] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0079.417] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0079.417] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0079.417] GetProcessHeap () returned 0xd20000 [0079.417] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0079.417] lstrlenA (lpString="010001") returned 6 [0079.417] GetProcessHeap () returned 0xd20000 [0079.417] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc98 [0079.417] GetProcessHeap () returned 0xd20000 [0079.417] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0079.417] GetProcessHeap () returned 0xd20000 [0079.417] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd30f70 [0079.417] GetProcessHeap () returned 0xd20000 [0079.417] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0079.417] GetProcessHeap () returned 0xd20000 [0079.417] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd2f820 [0079.417] GetProcessHeap () returned 0xd20000 [0079.418] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44d80 [0079.418] GetProcessHeap () returned 0xd20000 [0079.418] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0079.418] GetProcessHeap () returned 0xd20000 [0079.418] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0079.418] GetProcessHeap () returned 0xd20000 [0079.418] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.418] GetProcessHeap () returned 0xd20000 [0079.418] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0079.418] GetProcessHeap () returned 0xd20000 [0079.418] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd31810 [0079.418] GetProcessHeap () returned 0xd20000 [0079.418] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd45410 [0079.418] GetProcessHeap () returned 0xd20000 [0079.418] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0079.418] GetProcessHeap () returned 0xd20000 [0079.418] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44690 [0079.418] GetProcessHeap () returned 0xd20000 [0079.419] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd328d8 [0079.419] GetProcessHeap () returned 0xd20000 [0079.419] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31810 | out: hHeap=0xd20000) returned 1 [0079.419] GetProcessHeap () returned 0xd20000 [0079.419] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0079.419] GetProcessHeap () returned 0xd20000 [0079.419] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd328d8 | out: hHeap=0xd20000) returned 1 [0079.419] GetProcessHeap () returned 0xd20000 [0079.419] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0079.419] GetProcessHeap () returned 0xd20000 [0079.419] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44540 [0079.419] GetProcessHeap () returned 0xd20000 [0079.419] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0079.419] GetProcessHeap () returned 0xd20000 [0079.419] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0079.419] GetProcessHeap () returned 0xd20000 [0079.419] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.419] GetProcessHeap () returned 0xd20000 [0079.419] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.419] GetProcessHeap () returned 0xd20000 [0079.420] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.420] GetProcessHeap () returned 0xd20000 [0079.420] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.420] GetProcessHeap () returned 0xd20000 [0079.420] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4a948 [0079.420] GetProcessHeap () returned 0xd20000 [0079.420] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44540 | out: hHeap=0xd20000) returned 1 [0079.420] GetProcessHeap () returned 0xd20000 [0079.420] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0079.420] GetProcessHeap () returned 0xd20000 [0079.420] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a948 | out: hHeap=0xd20000) returned 1 [0079.420] GetProcessHeap () returned 0xd20000 [0079.420] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.420] GetProcessHeap () returned 0xd20000 [0079.420] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.420] GetProcessHeap () returned 0xd20000 [0079.420] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.420] GetProcessHeap () returned 0xd20000 [0079.420] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.420] GetProcessHeap () returned 0xd20000 [0079.420] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0079.420] GetProcessHeap () returned 0xd20000 [0079.421] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0079.421] GetProcessHeap () returned 0xd20000 [0079.421] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0079.421] GetProcessHeap () returned 0xd20000 [0079.421] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0079.421] GetProcessHeap () returned 0xd20000 [0079.421] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0079.421] GetProcessHeap () returned 0xd20000 [0079.421] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0079.421] GetProcessHeap () returned 0xd20000 [0079.421] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0079.421] GetProcessHeap () returned 0xd20000 [0079.421] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0079.421] GetProcessHeap () returned 0xd20000 [0079.421] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0079.421] GetProcessHeap () returned 0xd20000 [0079.421] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0079.421] GetProcessHeap () returned 0xd20000 [0079.421] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0079.422] GetProcessHeap () returned 0xd20000 [0079.422] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0079.422] GetProcessHeap () returned 0xd20000 [0079.422] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0079.422] GetProcessHeap () returned 0xd20000 [0079.422] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0079.422] GetProcessHeap () returned 0xd20000 [0079.422] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0079.422] GetProcessHeap () returned 0xd20000 [0079.422] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0079.422] GetProcessHeap () returned 0xd20000 [0079.422] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0079.422] GetProcessHeap () returned 0xd20000 [0079.422] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0079.422] GetProcessHeap () returned 0xd20000 [0079.422] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0079.422] GetProcessHeap () returned 0xd20000 [0079.422] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0079.422] GetProcessHeap () returned 0xd20000 [0079.422] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.423] GetProcessHeap () returned 0xd20000 [0079.423] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.423] GetProcessHeap () returned 0xd20000 [0079.423] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0079.423] GetProcessHeap () returned 0xd20000 [0079.423] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0079.423] GetProcessHeap () returned 0xd20000 [0079.423] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0079.423] GetProcessHeap () returned 0xd20000 [0079.423] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0079.423] GetProcessHeap () returned 0xd20000 [0079.423] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0079.423] GetProcessHeap () returned 0xd20000 [0079.423] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0079.423] GetProcessHeap () returned 0xd20000 [0079.423] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.423] GetProcessHeap () returned 0xd20000 [0079.423] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.423] GetProcessHeap () returned 0xd20000 [0079.423] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0079.423] GetProcessHeap () returned 0xd20000 [0079.424] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0079.424] GetProcessHeap () returned 0xd20000 [0079.424] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0079.424] GetProcessHeap () returned 0xd20000 [0079.424] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0079.424] GetProcessHeap () returned 0xd20000 [0079.424] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0079.424] GetProcessHeap () returned 0xd20000 [0079.424] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0079.424] GetProcessHeap () returned 0xd20000 [0079.424] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0079.424] GetProcessHeap () returned 0xd20000 [0079.424] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0079.424] GetProcessHeap () returned 0xd20000 [0079.424] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0079.424] GetProcessHeap () returned 0xd20000 [0079.424] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0079.424] GetProcessHeap () returned 0xd20000 [0079.424] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0079.424] GetProcessHeap () returned 0xd20000 [0079.425] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0079.425] GetProcessHeap () returned 0xd20000 [0079.425] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0079.425] GetProcessHeap () returned 0xd20000 [0079.425] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0079.425] GetProcessHeap () returned 0xd20000 [0079.425] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0079.425] GetProcessHeap () returned 0xd20000 [0079.425] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0079.425] GetProcessHeap () returned 0xd20000 [0079.425] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.425] GetProcessHeap () returned 0xd20000 [0079.425] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.425] GetProcessHeap () returned 0xd20000 [0079.425] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0079.425] GetProcessHeap () returned 0xd20000 [0079.425] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0079.425] GetProcessHeap () returned 0xd20000 [0079.425] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0079.425] GetProcessHeap () returned 0xd20000 [0079.426] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0079.426] GetProcessHeap () returned 0xd20000 [0079.426] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.426] GetProcessHeap () returned 0xd20000 [0079.426] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.426] GetProcessHeap () returned 0xd20000 [0079.426] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0079.426] GetProcessHeap () returned 0xd20000 [0079.426] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0079.426] GetProcessHeap () returned 0xd20000 [0079.426] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0079.426] GetProcessHeap () returned 0xd20000 [0079.426] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0079.426] GetProcessHeap () returned 0xd20000 [0079.426] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.426] GetProcessHeap () returned 0xd20000 [0079.426] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.426] GetProcessHeap () returned 0xd20000 [0079.426] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0079.426] GetProcessHeap () returned 0xd20000 [0079.427] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0079.427] GetProcessHeap () returned 0xd20000 [0079.427] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0079.427] GetProcessHeap () returned 0xd20000 [0079.427] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0079.427] GetProcessHeap () returned 0xd20000 [0079.427] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0079.427] GetProcessHeap () returned 0xd20000 [0079.427] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0079.427] GetProcessHeap () returned 0xd20000 [0079.427] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0079.427] GetProcessHeap () returned 0xd20000 [0079.427] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0079.427] GetProcessHeap () returned 0xd20000 [0079.427] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.427] GetProcessHeap () returned 0xd20000 [0079.427] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.427] GetProcessHeap () returned 0xd20000 [0079.427] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0079.427] GetProcessHeap () returned 0xd20000 [0079.428] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0079.428] GetProcessHeap () returned 0xd20000 [0079.428] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0079.428] GetProcessHeap () returned 0xd20000 [0079.428] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0079.428] GetProcessHeap () returned 0xd20000 [0079.428] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.428] GetProcessHeap () returned 0xd20000 [0079.428] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.428] GetProcessHeap () returned 0xd20000 [0079.428] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.428] GetProcessHeap () returned 0xd20000 [0079.428] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.428] GetProcessHeap () returned 0xd20000 [0079.428] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0079.428] GetProcessHeap () returned 0xd20000 [0079.428] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0079.428] GetProcessHeap () returned 0xd20000 [0079.428] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.429] GetProcessHeap () returned 0xd20000 [0079.429] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.429] GetProcessHeap () returned 0xd20000 [0079.429] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0079.429] GetProcessHeap () returned 0xd20000 [0079.429] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0079.429] GetProcessHeap () returned 0xd20000 [0079.429] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0079.429] GetProcessHeap () returned 0xd20000 [0079.429] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0079.429] GetProcessHeap () returned 0xd20000 [0079.429] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0079.429] GetProcessHeap () returned 0xd20000 [0079.429] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0079.429] GetProcessHeap () returned 0xd20000 [0079.429] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.429] GetProcessHeap () returned 0xd20000 [0079.429] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.430] GetProcessHeap () returned 0xd20000 [0079.430] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.430] GetProcessHeap () returned 0xd20000 [0079.430] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.430] GetProcessHeap () returned 0xd20000 [0079.430] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0079.430] GetProcessHeap () returned 0xd20000 [0079.430] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0079.430] GetProcessHeap () returned 0xd20000 [0079.430] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.430] GetProcessHeap () returned 0xd20000 [0079.430] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.430] GetProcessHeap () returned 0xd20000 [0079.430] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.430] GetProcessHeap () returned 0xd20000 [0079.430] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.430] GetProcessHeap () returned 0xd20000 [0079.430] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.430] GetProcessHeap () returned 0xd20000 [0079.431] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.431] GetProcessHeap () returned 0xd20000 [0079.431] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.431] GetProcessHeap () returned 0xd20000 [0079.431] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.431] GetProcessHeap () returned 0xd20000 [0079.431] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0079.431] GetProcessHeap () returned 0xd20000 [0079.431] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0079.431] GetProcessHeap () returned 0xd20000 [0079.431] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0079.431] GetProcessHeap () returned 0xd20000 [0079.431] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0079.431] GetProcessHeap () returned 0xd20000 [0079.431] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.431] GetProcessHeap () returned 0xd20000 [0079.431] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.431] GetProcessHeap () returned 0xd20000 [0079.431] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0079.432] GetProcessHeap () returned 0xd20000 [0079.432] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0079.432] GetProcessHeap () returned 0xd20000 [0079.432] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0079.432] GetProcessHeap () returned 0xd20000 [0079.432] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0079.432] GetProcessHeap () returned 0xd20000 [0079.432] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0079.432] GetProcessHeap () returned 0xd20000 [0079.432] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0079.432] GetProcessHeap () returned 0xd20000 [0079.432] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0079.432] GetProcessHeap () returned 0xd20000 [0079.432] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0079.432] GetProcessHeap () returned 0xd20000 [0079.432] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0079.432] GetProcessHeap () returned 0xd20000 [0079.432] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0079.432] GetProcessHeap () returned 0xd20000 [0079.433] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0079.433] GetProcessHeap () returned 0xd20000 [0079.433] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0079.433] GetProcessHeap () returned 0xd20000 [0079.433] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.433] GetProcessHeap () returned 0xd20000 [0079.433] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.433] GetProcessHeap () returned 0xd20000 [0079.433] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.433] GetProcessHeap () returned 0xd20000 [0079.433] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.433] GetProcessHeap () returned 0xd20000 [0079.434] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.434] GetProcessHeap () returned 0xd20000 [0079.434] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.434] GetProcessHeap () returned 0xd20000 [0079.434] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0079.434] GetProcessHeap () returned 0xd20000 [0079.434] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0079.434] GetProcessHeap () returned 0xd20000 [0079.434] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0079.434] GetProcessHeap () returned 0xd20000 [0079.434] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0079.434] GetProcessHeap () returned 0xd20000 [0079.434] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0079.434] GetProcessHeap () returned 0xd20000 [0079.434] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0079.434] GetProcessHeap () returned 0xd20000 [0079.434] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.435] GetProcessHeap () returned 0xd20000 [0079.435] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.435] GetProcessHeap () returned 0xd20000 [0079.435] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0079.435] GetProcessHeap () returned 0xd20000 [0079.435] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0079.435] GetProcessHeap () returned 0xd20000 [0079.435] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0079.435] GetProcessHeap () returned 0xd20000 [0079.435] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0079.435] GetProcessHeap () returned 0xd20000 [0079.435] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0079.435] GetProcessHeap () returned 0xd20000 [0079.435] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0079.435] GetProcessHeap () returned 0xd20000 [0079.435] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0079.435] GetProcessHeap () returned 0xd20000 [0079.435] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0079.435] GetProcessHeap () returned 0xd20000 [0079.435] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0079.436] GetProcessHeap () returned 0xd20000 [0079.436] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0079.436] GetProcessHeap () returned 0xd20000 [0079.436] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0079.436] GetProcessHeap () returned 0xd20000 [0079.436] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0079.436] GetProcessHeap () returned 0xd20000 [0079.436] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0079.436] GetProcessHeap () returned 0xd20000 [0079.436] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0079.436] GetProcessHeap () returned 0xd20000 [0079.436] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.436] GetProcessHeap () returned 0xd20000 [0079.436] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.436] GetProcessHeap () returned 0xd20000 [0079.436] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.436] GetProcessHeap () returned 0xd20000 [0079.436] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.436] GetProcessHeap () returned 0xd20000 [0079.436] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.437] GetProcessHeap () returned 0xd20000 [0079.437] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.437] GetProcessHeap () returned 0xd20000 [0079.437] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.437] GetProcessHeap () returned 0xd20000 [0079.437] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.437] GetProcessHeap () returned 0xd20000 [0079.437] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0079.437] GetProcessHeap () returned 0xd20000 [0079.437] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0079.437] GetProcessHeap () returned 0xd20000 [0079.437] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0079.437] GetProcessHeap () returned 0xd20000 [0079.437] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0079.437] GetProcessHeap () returned 0xd20000 [0079.437] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0079.437] GetProcessHeap () returned 0xd20000 [0079.437] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0079.437] GetProcessHeap () returned 0xd20000 [0079.437] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0079.437] GetProcessHeap () returned 0xd20000 [0079.438] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0079.438] GetProcessHeap () returned 0xd20000 [0079.438] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0079.438] GetProcessHeap () returned 0xd20000 [0079.438] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0079.438] GetProcessHeap () returned 0xd20000 [0079.438] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0079.438] GetProcessHeap () returned 0xd20000 [0079.438] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0079.438] GetProcessHeap () returned 0xd20000 [0079.438] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0079.438] GetProcessHeap () returned 0xd20000 [0079.438] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0079.438] GetProcessHeap () returned 0xd20000 [0079.438] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44690 | out: hHeap=0xd20000) returned 1 [0079.438] GetProcessHeap () returned 0xd20000 [0079.438] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0079.438] GetProcessHeap () returned 0xd20000 [0079.438] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0079.438] GetProcessHeap () returned 0xd20000 [0079.438] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd30f70 | out: hHeap=0xd20000) returned 1 [0079.439] GetProcessHeap () returned 0xd20000 [0079.439] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0079.439] GetProcessHeap () returned 0xd20000 [0079.439] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0079.439] GetProcessHeap () returned 0xd20000 [0079.439] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0079.439] WriteFile (in: hFile=0x230, lpBuffer=0xd4a598*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4a598*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0079.687] GetProcessHeap () returned 0xd20000 [0079.687] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4a598, Size=0x30) returned 0xd4a598 [0079.687] GetProcessHeap () returned 0xd20000 [0079.687] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0079.687] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0079.688] GetProcessHeap () returned 0xd20000 [0079.688] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x6cc8) returned 0xd4b928 [0079.688] ReadFile (in: hFile=0x230, lpBuffer=0xd4b928, nNumberOfBytesToRead=0x6cc8, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4b928*, lpNumberOfBytesRead=0x299d7e8*=0x6cc8, lpOverlapped=0x0) returned 1 [0079.690] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0079.690] WriteFile (in: hFile=0x230, lpBuffer=0xd4b928*, nNumberOfBytesToWrite=0x6cc8, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4b928*, lpNumberOfBytesWritten=0x299d7e4*=0x6cc8, lpOverlapped=0x0) returned 1 [0079.968] GetProcessHeap () returned 0xd20000 [0079.968] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b928 | out: hHeap=0xd20000) returned 1 [0079.968] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0079.969] WriteFile (in: hFile=0x230, lpBuffer=0xd4a598*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4a598*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0079.970] CloseHandle (hObject=0x230) returned 1 [0079.974] GetProcessHeap () returned 0xd20000 [0079.975] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42620 | out: hHeap=0xd20000) returned 1 [0079.975] GetProcessHeap () returned 0xd20000 [0079.975] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2e898 | out: hHeap=0xd20000) returned 1 [0079.975] GetProcessHeap () returned 0xd20000 [0079.975] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0079.975] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\HttpHelper.exe" | out: lpString1="C:\\Windows10Upgrade\\HttpHelper.exe") returned="C:\\Windows10Upgrade\\HttpHelper.exe" [0079.975] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\HttpHelper.exe", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\HttpHelper.exe.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\HttpHelper.exe.[ponce.lorena@aol.com]" [0079.975] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\HttpHelper.exe" (normalized: "c:\\windows10upgrade\\httphelper.exe"), lpNewFileName="C:\\Windows10Upgrade\\HttpHelper.exe.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\httphelper.exe.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0079.977] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\HttpHelper.exe" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0079.977] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0079.977] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\HOW_RECOVER.html" [0079.977] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\how_recover.html")) returned 0x20 [0079.977] GetProcessHeap () returned 0xd20000 [0079.977] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44648 | out: hHeap=0xd20000) returned 1 [0079.977] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PostOOBEScript.cmd", cAlternateFileName="POSTOO~1.CMD")) returned 1 [0079.977] lstrcmpiW (lpString1="PostOOBEScript.cmd", lpString2=".") returned 1 [0079.978] lstrcmpiW (lpString1="PostOOBEScript.cmd", lpString2="..") returned 1 [0079.978] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="PostOOBEScript.cmd" | out: lpString1="C:\\Windows10Upgrade\\PostOOBEScript.cmd") returned="C:\\Windows10Upgrade\\PostOOBEScript.cmd" [0079.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PostOOBEScript.cmd", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0079.978] GetProcessHeap () returned 0xd20000 [0079.978] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x13) returned 0xd36568 [0079.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PostOOBEScript.cmd", cchWideChar=-1, lpMultiByteStr=0xd36568, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PostOOBEScript.cmd", lpUsedDefaultChar=0x0) returned 19 [0079.978] lstrlenA (lpString="PostOOBEScript.cmd") returned 18 [0079.978] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0079.978] lstrlenA (lpString="PostOOBEScript.cmd") returned 18 [0079.978] lstrlenA (lpString=".dll") returned 4 [0079.978] lstrlenA (lpString=".dll") returned 4 [0079.978] lstrlenA (lpString="PostOOBEScript.cmd") returned 18 [0079.978] lstrcmpiA (lpString1=".cmd", lpString2=".dll") returned -1 [0079.978] lstrlenA (lpString="PostOOBEScript.cmd") returned 18 [0079.978] lstrlenA (lpString=".ini") returned 4 [0079.978] lstrlenA (lpString=".ini") returned 4 [0079.979] lstrlenA (lpString="PostOOBEScript.cmd") returned 18 [0079.979] lstrcmpiA (lpString1=".cmd", lpString2=".ini") returned -1 [0079.979] lstrlenA (lpString="PostOOBEScript.cmd") returned 18 [0079.979] lstrlenA (lpString=".inc") returned 4 [0079.979] lstrlenA (lpString=".inc") returned 4 [0079.979] lstrlenA (lpString="PostOOBEScript.cmd") returned 18 [0079.979] lstrcmpiA (lpString1=".cmd", lpString2=".inc") returned -1 [0079.979] lstrcmpiW (lpString1="PostOOBEScript.cmd", lpString2="HOW_RECOVER.html") returned 1 [0079.979] lstrcmpiW (lpString1="PostOOBEScript.cmd", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0079.979] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0079.979] lstrcmpiW (lpString1="PostOOBEScript.cmd", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0079.979] GetProcessHeap () returned 0xd20000 [0079.979] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd428a0 [0079.979] CreateFileW (lpFileName="C:\\Windows10Upgrade\\PostOOBEScript.cmd" (normalized: "c:\\windows10upgrade\\postoobescript.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0079.981] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=577) returned 1 [0079.982] GetProcessHeap () returned 0xd20000 [0079.982] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd2e898 [0079.982] GetProcessHeap () returned 0xd20000 [0079.982] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0079.982] lstrlenW (lpString="C:\\Windows10Upgrade\\PostOOBEScript.cmd") returned 38 [0079.982] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0079.982] GetProcessHeap () returned 0xd20000 [0079.982] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0079.982] GetProcessHeap () returned 0xd20000 [0079.982] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x38f) returned 0xd4b928 [0079.983] lstrlenA (lpString="rsa_encrypt") returned 11 [0079.983] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0079.986] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0079.986] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0079.986] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0079.986] GetProcessHeap () returned 0xd20000 [0079.986] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0079.986] lstrlenA (lpString="010001") returned 6 [0079.986] GetProcessHeap () returned 0xd20000 [0079.986] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0079.986] GetProcessHeap () returned 0xd20000 [0079.986] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0079.986] GetProcessHeap () returned 0xd20000 [0079.986] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aee8 [0079.986] GetProcessHeap () returned 0xd20000 [0079.986] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0079.987] GetProcessHeap () returned 0xd20000 [0079.987] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b2d8 [0079.987] GetProcessHeap () returned 0xd20000 [0079.987] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd451e0 [0079.987] GetProcessHeap () returned 0xd20000 [0079.987] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd88 [0079.987] GetProcessHeap () returned 0xd20000 [0079.987] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0079.987] GetProcessHeap () returned 0xd20000 [0079.987] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0079.987] GetProcessHeap () returned 0xd20000 [0079.987] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0079.987] GetProcessHeap () returned 0xd20000 [0079.987] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0079.987] GetProcessHeap () returned 0xd20000 [0079.987] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd452f8 [0079.987] GetProcessHeap () returned 0xd20000 [0079.987] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0079.987] GetProcessHeap () returned 0xd20000 [0079.988] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444f8 [0079.988] GetProcessHeap () returned 0xd20000 [0079.988] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aa68 [0079.988] GetProcessHeap () returned 0xd20000 [0079.988] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0079.988] GetProcessHeap () returned 0xd20000 [0079.988] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0079.988] GetProcessHeap () returned 0xd20000 [0079.988] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aa68 | out: hHeap=0xd20000) returned 1 [0079.988] GetProcessHeap () returned 0xd20000 [0079.988] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0079.988] GetProcessHeap () returned 0xd20000 [0079.988] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44528 [0079.988] GetProcessHeap () returned 0xd20000 [0079.988] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0079.988] GetProcessHeap () returned 0xd20000 [0079.988] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0079.988] GetProcessHeap () returned 0xd20000 [0079.989] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0079.989] GetProcessHeap () returned 0xd20000 [0079.989] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0079.989] GetProcessHeap () returned 0xd20000 [0079.989] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0079.989] GetProcessHeap () returned 0xd20000 [0079.989] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0079.989] GetProcessHeap () returned 0xd20000 [0079.989] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4af78 [0079.989] GetProcessHeap () returned 0xd20000 [0079.989] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44528 | out: hHeap=0xd20000) returned 1 [0079.989] GetProcessHeap () returned 0xd20000 [0079.989] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0079.989] GetProcessHeap () returned 0xd20000 [0079.989] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4af78 | out: hHeap=0xd20000) returned 1 [0079.989] GetProcessHeap () returned 0xd20000 [0079.989] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0079.989] GetProcessHeap () returned 0xd20000 [0079.989] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0079.990] GetProcessHeap () returned 0xd20000 [0079.990] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0079.990] GetProcessHeap () returned 0xd20000 [0079.990] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0079.990] GetProcessHeap () returned 0xd20000 [0079.990] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0079.990] GetProcessHeap () returned 0xd20000 [0079.990] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0079.990] GetProcessHeap () returned 0xd20000 [0079.990] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0079.990] GetProcessHeap () returned 0xd20000 [0079.990] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0079.990] GetProcessHeap () returned 0xd20000 [0079.990] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0079.990] GetProcessHeap () returned 0xd20000 [0079.990] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0079.990] GetProcessHeap () returned 0xd20000 [0079.990] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0079.991] GetProcessHeap () returned 0xd20000 [0079.991] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0079.991] GetProcessHeap () returned 0xd20000 [0079.991] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0079.991] GetProcessHeap () returned 0xd20000 [0079.991] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0079.991] GetProcessHeap () returned 0xd20000 [0079.991] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0079.991] GetProcessHeap () returned 0xd20000 [0079.991] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0079.991] GetProcessHeap () returned 0xd20000 [0079.991] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0079.991] GetProcessHeap () returned 0xd20000 [0079.991] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0079.991] GetProcessHeap () returned 0xd20000 [0079.991] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0079.991] GetProcessHeap () returned 0xd20000 [0079.991] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0079.991] GetProcessHeap () returned 0xd20000 [0079.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0079.992] GetProcessHeap () returned 0xd20000 [0079.992] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0079.992] GetProcessHeap () returned 0xd20000 [0079.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0079.992] GetProcessHeap () returned 0xd20000 [0079.992] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0079.992] GetProcessHeap () returned 0xd20000 [0079.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0079.992] GetProcessHeap () returned 0xd20000 [0079.992] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0079.992] GetProcessHeap () returned 0xd20000 [0079.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0079.992] GetProcessHeap () returned 0xd20000 [0079.992] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0079.992] GetProcessHeap () returned 0xd20000 [0079.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0079.992] GetProcessHeap () returned 0xd20000 [0079.992] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0079.992] GetProcessHeap () returned 0xd20000 [0079.993] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0079.993] GetProcessHeap () returned 0xd20000 [0079.993] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0079.993] GetProcessHeap () returned 0xd20000 [0079.993] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0079.993] GetProcessHeap () returned 0xd20000 [0079.993] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0079.993] GetProcessHeap () returned 0xd20000 [0079.993] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0079.993] GetProcessHeap () returned 0xd20000 [0079.993] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0079.993] GetProcessHeap () returned 0xd20000 [0079.993] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0079.993] GetProcessHeap () returned 0xd20000 [0079.993] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0079.993] GetProcessHeap () returned 0xd20000 [0079.993] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0079.993] GetProcessHeap () returned 0xd20000 [0079.993] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0079.993] GetProcessHeap () returned 0xd20000 [0079.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0079.994] GetProcessHeap () returned 0xd20000 [0079.994] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0079.994] GetProcessHeap () returned 0xd20000 [0079.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0079.994] GetProcessHeap () returned 0xd20000 [0079.994] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0079.994] GetProcessHeap () returned 0xd20000 [0079.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0079.994] GetProcessHeap () returned 0xd20000 [0079.994] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0079.994] GetProcessHeap () returned 0xd20000 [0079.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0079.994] GetProcessHeap () returned 0xd20000 [0079.994] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0079.994] GetProcessHeap () returned 0xd20000 [0079.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0079.994] GetProcessHeap () returned 0xd20000 [0079.994] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0079.994] GetProcessHeap () returned 0xd20000 [0079.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0079.995] GetProcessHeap () returned 0xd20000 [0079.995] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0079.995] GetProcessHeap () returned 0xd20000 [0079.995] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0079.995] GetProcessHeap () returned 0xd20000 [0079.995] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0079.995] GetProcessHeap () returned 0xd20000 [0079.995] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0079.995] GetProcessHeap () returned 0xd20000 [0079.995] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0079.995] GetProcessHeap () returned 0xd20000 [0079.995] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0079.995] GetProcessHeap () returned 0xd20000 [0079.995] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0079.995] GetProcessHeap () returned 0xd20000 [0079.995] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0079.995] GetProcessHeap () returned 0xd20000 [0079.995] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0079.995] GetProcessHeap () returned 0xd20000 [0079.996] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0079.996] GetProcessHeap () returned 0xd20000 [0079.996] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0079.996] GetProcessHeap () returned 0xd20000 [0079.996] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0079.996] GetProcessHeap () returned 0xd20000 [0079.996] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0079.996] GetProcessHeap () returned 0xd20000 [0079.996] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0079.996] GetProcessHeap () returned 0xd20000 [0079.996] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0079.996] GetProcessHeap () returned 0xd20000 [0079.996] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0079.996] GetProcessHeap () returned 0xd20000 [0079.996] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0079.996] GetProcessHeap () returned 0xd20000 [0079.996] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0079.997] GetProcessHeap () returned 0xd20000 [0079.997] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0079.997] GetProcessHeap () returned 0xd20000 [0079.997] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0079.997] GetProcessHeap () returned 0xd20000 [0079.997] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0079.997] GetProcessHeap () returned 0xd20000 [0079.997] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0079.997] GetProcessHeap () returned 0xd20000 [0079.997] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0079.997] GetProcessHeap () returned 0xd20000 [0079.997] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0079.997] GetProcessHeap () returned 0xd20000 [0079.997] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0079.997] GetProcessHeap () returned 0xd20000 [0079.997] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0079.997] GetProcessHeap () returned 0xd20000 [0079.997] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0079.997] GetProcessHeap () returned 0xd20000 [0079.998] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0079.998] GetProcessHeap () returned 0xd20000 [0079.998] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0079.998] GetProcessHeap () returned 0xd20000 [0079.998] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0079.998] GetProcessHeap () returned 0xd20000 [0079.998] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0079.998] GetProcessHeap () returned 0xd20000 [0079.998] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0079.998] GetProcessHeap () returned 0xd20000 [0079.998] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0079.998] GetProcessHeap () returned 0xd20000 [0079.998] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0079.998] GetProcessHeap () returned 0xd20000 [0079.998] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0079.998] GetProcessHeap () returned 0xd20000 [0079.998] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0079.998] GetProcessHeap () returned 0xd20000 [0079.998] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0079.998] GetProcessHeap () returned 0xd20000 [0079.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0079.999] GetProcessHeap () returned 0xd20000 [0079.999] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0079.999] GetProcessHeap () returned 0xd20000 [0079.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0079.999] GetProcessHeap () returned 0xd20000 [0079.999] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0079.999] GetProcessHeap () returned 0xd20000 [0079.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0079.999] GetProcessHeap () returned 0xd20000 [0079.999] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0079.999] GetProcessHeap () returned 0xd20000 [0079.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0079.999] GetProcessHeap () returned 0xd20000 [0079.999] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0079.999] GetProcessHeap () returned 0xd20000 [0079.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0079.999] GetProcessHeap () returned 0xd20000 [0079.999] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0080.000] GetProcessHeap () returned 0xd20000 [0080.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0080.000] GetProcessHeap () returned 0xd20000 [0080.000] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0080.000] GetProcessHeap () returned 0xd20000 [0080.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.000] GetProcessHeap () returned 0xd20000 [0080.000] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.000] GetProcessHeap () returned 0xd20000 [0080.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0080.000] GetProcessHeap () returned 0xd20000 [0080.000] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0080.000] GetProcessHeap () returned 0xd20000 [0080.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0080.000] GetProcessHeap () returned 0xd20000 [0080.000] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0080.000] GetProcessHeap () returned 0xd20000 [0080.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0080.000] GetProcessHeap () returned 0xd20000 [0080.001] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0080.001] GetProcessHeap () returned 0xd20000 [0080.001] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0080.001] GetProcessHeap () returned 0xd20000 [0080.001] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0080.001] GetProcessHeap () returned 0xd20000 [0080.001] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0080.001] GetProcessHeap () returned 0xd20000 [0080.001] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0080.001] GetProcessHeap () returned 0xd20000 [0080.001] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0080.001] GetProcessHeap () returned 0xd20000 [0080.001] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0080.001] GetProcessHeap () returned 0xd20000 [0080.001] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0080.001] GetProcessHeap () returned 0xd20000 [0080.001] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0080.001] GetProcessHeap () returned 0xd20000 [0080.001] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0080.001] GetProcessHeap () returned 0xd20000 [0080.002] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0080.002] GetProcessHeap () returned 0xd20000 [0080.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0080.002] GetProcessHeap () returned 0xd20000 [0080.002] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0080.002] GetProcessHeap () returned 0xd20000 [0080.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.002] GetProcessHeap () returned 0xd20000 [0080.002] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.002] GetProcessHeap () returned 0xd20000 [0080.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0080.002] GetProcessHeap () returned 0xd20000 [0080.002] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0080.002] GetProcessHeap () returned 0xd20000 [0080.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.002] GetProcessHeap () returned 0xd20000 [0080.002] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.002] GetProcessHeap () returned 0xd20000 [0080.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0080.002] GetProcessHeap () returned 0xd20000 [0080.002] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0080.003] GetProcessHeap () returned 0xd20000 [0080.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.003] GetProcessHeap () returned 0xd20000 [0080.003] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.003] GetProcessHeap () returned 0xd20000 [0080.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.003] GetProcessHeap () returned 0xd20000 [0080.003] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.003] GetProcessHeap () returned 0xd20000 [0080.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.003] GetProcessHeap () returned 0xd20000 [0080.003] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.003] GetProcessHeap () returned 0xd20000 [0080.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0080.003] GetProcessHeap () returned 0xd20000 [0080.003] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0080.003] GetProcessHeap () returned 0xd20000 [0080.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0080.003] GetProcessHeap () returned 0xd20000 [0080.003] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0080.004] GetProcessHeap () returned 0xd20000 [0080.004] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0080.004] GetProcessHeap () returned 0xd20000 [0080.004] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0080.004] GetProcessHeap () returned 0xd20000 [0080.004] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.004] GetProcessHeap () returned 0xd20000 [0080.004] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.004] GetProcessHeap () returned 0xd20000 [0080.004] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0080.004] GetProcessHeap () returned 0xd20000 [0080.004] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0080.004] GetProcessHeap () returned 0xd20000 [0080.004] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.004] GetProcessHeap () returned 0xd20000 [0080.004] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.004] GetProcessHeap () returned 0xd20000 [0080.004] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.004] GetProcessHeap () returned 0xd20000 [0080.005] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.005] GetProcessHeap () returned 0xd20000 [0080.005] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0080.005] GetProcessHeap () returned 0xd20000 [0080.005] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0080.005] GetProcessHeap () returned 0xd20000 [0080.005] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0080.005] GetProcessHeap () returned 0xd20000 [0080.005] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0080.005] GetProcessHeap () returned 0xd20000 [0080.005] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0080.005] GetProcessHeap () returned 0xd20000 [0080.005] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0080.005] GetProcessHeap () returned 0xd20000 [0080.005] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0080.005] GetProcessHeap () returned 0xd20000 [0080.005] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0080.005] GetProcessHeap () returned 0xd20000 [0080.005] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0080.005] GetProcessHeap () returned 0xd20000 [0080.005] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0080.006] GetProcessHeap () returned 0xd20000 [0080.006] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.006] GetProcessHeap () returned 0xd20000 [0080.006] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.006] GetProcessHeap () returned 0xd20000 [0080.006] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0080.006] GetProcessHeap () returned 0xd20000 [0080.006] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0080.006] GetProcessHeap () returned 0xd20000 [0080.006] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0080.006] GetProcessHeap () returned 0xd20000 [0080.006] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0080.006] GetProcessHeap () returned 0xd20000 [0080.006] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0080.006] GetProcessHeap () returned 0xd20000 [0080.006] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0080.006] GetProcessHeap () returned 0xd20000 [0080.006] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0080.006] GetProcessHeap () returned 0xd20000 [0080.007] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0080.007] GetProcessHeap () returned 0xd20000 [0080.007] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0080.007] GetProcessHeap () returned 0xd20000 [0080.007] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0080.007] GetProcessHeap () returned 0xd20000 [0080.007] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0080.007] GetProcessHeap () returned 0xd20000 [0080.007] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0080.007] GetProcessHeap () returned 0xd20000 [0080.007] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0080.007] GetProcessHeap () returned 0xd20000 [0080.007] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0080.007] GetProcessHeap () returned 0xd20000 [0080.007] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444f8 | out: hHeap=0xd20000) returned 1 [0080.007] GetProcessHeap () returned 0xd20000 [0080.007] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b2d8 | out: hHeap=0xd20000) returned 1 [0080.007] GetProcessHeap () returned 0xd20000 [0080.008] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0080.008] GetProcessHeap () returned 0xd20000 [0080.008] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aee8 | out: hHeap=0xd20000) returned 1 [0080.008] GetProcessHeap () returned 0xd20000 [0080.008] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0080.008] GetProcessHeap () returned 0xd20000 [0080.008] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0080.008] GetProcessHeap () returned 0xd20000 [0080.008] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0080.008] WriteFile (in: hFile=0x230, lpBuffer=0xd4b928*, nNumberOfBytesToWrite=0x38f, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4b928*, lpNumberOfBytesWritten=0x299d864*=0x38f, lpOverlapped=0x0) returned 1 [0080.016] GetProcessHeap () returned 0xd20000 [0080.016] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4b928, Size=0x30) returned 0xd4b928 [0080.016] GetProcessHeap () returned 0xd20000 [0080.016] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0080.016] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0080.016] GetProcessHeap () returned 0xd20000 [0080.016] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x250) returned 0xd4a5d0 [0080.016] ReadFile (in: hFile=0x230, lpBuffer=0xd4a5d0, nNumberOfBytesToRead=0x250, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4a5d0*, lpNumberOfBytesRead=0x299d7e8*=0x250, lpOverlapped=0x0) returned 1 [0080.017] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0080.017] WriteFile (in: hFile=0x230, lpBuffer=0xd4a5d0*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4a5d0*, lpNumberOfBytesWritten=0x299d7e4*=0x250, lpOverlapped=0x0) returned 1 [0080.018] GetProcessHeap () returned 0xd20000 [0080.018] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a5d0 | out: hHeap=0xd20000) returned 1 [0080.018] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0080.018] WriteFile (in: hFile=0x230, lpBuffer=0xd4b928*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4b928*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0080.020] CloseHandle (hObject=0x230) returned 1 [0080.022] GetProcessHeap () returned 0xd20000 [0080.022] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd428a0 | out: hHeap=0xd20000) returned 1 [0080.022] GetProcessHeap () returned 0xd20000 [0080.022] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2e898 | out: hHeap=0xd20000) returned 1 [0080.022] GetProcessHeap () returned 0xd20000 [0080.022] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0080.022] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\PostOOBEScript.cmd" | out: lpString1="C:\\Windows10Upgrade\\PostOOBEScript.cmd") returned="C:\\Windows10Upgrade\\PostOOBEScript.cmd" [0080.022] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\PostOOBEScript.cmd", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\PostOOBEScript.cmd.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\PostOOBEScript.cmd.[ponce.lorena@aol.com]" [0080.022] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\PostOOBEScript.cmd" (normalized: "c:\\windows10upgrade\\postoobescript.cmd"), lpNewFileName="C:\\Windows10Upgrade\\PostOOBEScript.cmd.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\postoobescript.cmd.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0080.023] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\PostOOBEScript.cmd" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0080.023] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0080.023] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\HOW_RECOVER.html" [0080.023] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\how_recover.html")) returned 0x20 [0080.023] GetProcessHeap () returned 0xd20000 [0080.023] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36568 | out: hHeap=0xd20000) returned 1 [0080.023] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b3c1b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b3c1b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="resources", cAlternateFileName="RESOUR~1")) returned 1 [0080.023] lstrcmpiW (lpString1="resources", lpString2=".") returned 1 [0080.023] lstrcmpiW (lpString1="resources", lpString2="..") returned 1 [0080.023] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="resources" | out: lpString1="C:\\Windows10Upgrade\\resources") returned="C:\\Windows10Upgrade\\resources" [0080.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="resources", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0080.023] GetProcessHeap () returned 0xd20000 [0080.023] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xa) returned 0xd44618 [0080.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="resources", cchWideChar=-1, lpMultiByteStr=0xd44618, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="resources", lpUsedDefaultChar=0x0) returned 10 [0080.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0080.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0080.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0080.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0080.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0080.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0080.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0080.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0080.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0080.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0080.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0080.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0080.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0080.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0080.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0080.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0080.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0080.025] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0080.025] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0080.025] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0080.025] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0080.025] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0080.025] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0080.025] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0080.025] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0080.025] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0080.025] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0080.025] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0080.025] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0080.025] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0080.025] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0080.025] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0080.025] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0080.025] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0080.025] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0080.025] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0080.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0080.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0080.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0080.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0080.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0080.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0080.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="resources", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0080.026] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\") returned="C:\\Windows10Upgrade\\resources\\" [0080.026] GetProcessHeap () returned 0xd20000 [0080.026] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3ccf8 [0080.026] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\") returned 30 [0080.026] GetProcessHeap () returned 0xd20000 [0080.026] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x3e) returned 0xd32218 [0080.026] lstrcpyW (in: lpString1=0xd32218, lpString2="C:\\Windows10Upgrade\\resources\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\") returned="C:\\Windows10Upgrade\\resources\\" [0080.026] GetProcessHeap () returned 0xd20000 [0080.026] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44618 | out: hHeap=0xd20000) returned 1 [0080.026] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea9ef415, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea9ef415, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x624407ed, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0x3d14a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="upgrader_default.log", cAlternateFileName="UPGRAD~1.LOG")) returned 1 [0080.026] lstrcmpiW (lpString1="upgrader_default.log", lpString2=".") returned 1 [0080.026] lstrcmpiW (lpString1="upgrader_default.log", lpString2="..") returned 1 [0080.027] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="upgrader_default.log" | out: lpString1="C:\\Windows10Upgrade\\upgrader_default.log") returned="C:\\Windows10Upgrade\\upgrader_default.log" [0080.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upgrader_default.log", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0080.027] GetProcessHeap () returned 0xd20000 [0080.027] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x15) returned 0xd363c8 [0080.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upgrader_default.log", cchWideChar=-1, lpMultiByteStr=0xd363c8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="upgrader_default.log", lpUsedDefaultChar=0x0) returned 21 [0080.027] lstrlenA (lpString="upgrader_default.log") returned 20 [0080.027] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0080.027] lstrlenA (lpString="upgrader_default.log") returned 20 [0080.027] lstrlenA (lpString=".dll") returned 4 [0080.027] lstrlenA (lpString=".dll") returned 4 [0080.027] lstrlenA (lpString="upgrader_default.log") returned 20 [0080.027] lstrcmpiA (lpString1=".log", lpString2=".dll") returned 1 [0080.027] lstrlenA (lpString="upgrader_default.log") returned 20 [0080.027] lstrlenA (lpString=".ini") returned 4 [0080.027] lstrlenA (lpString=".ini") returned 4 [0080.027] lstrlenA (lpString="upgrader_default.log") returned 20 [0080.028] lstrcmpiA (lpString1=".log", lpString2=".ini") returned 1 [0080.028] lstrlenA (lpString="upgrader_default.log") returned 20 [0080.028] lstrlenA (lpString=".inc") returned 4 [0080.028] lstrlenA (lpString=".inc") returned 4 [0080.028] lstrlenA (lpString="upgrader_default.log") returned 20 [0080.028] lstrcmpiA (lpString1=".log", lpString2=".inc") returned 1 [0080.028] lstrcmpiW (lpString1="upgrader_default.log", lpString2="HOW_RECOVER.html") returned 1 [0080.028] lstrcmpiW (lpString1="upgrader_default.log", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0080.028] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0080.028] lstrcmpiW (lpString1="upgrader_default.log", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0080.028] GetProcessHeap () returned 0xd20000 [0080.028] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd424e0 [0080.028] CreateFileW (lpFileName="C:\\Windows10Upgrade\\upgrader_default.log" (normalized: "c:\\windows10upgrade\\upgrader_default.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0080.029] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=250186) returned 1 [0080.029] GetProcessHeap () returned 0xd20000 [0080.030] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd2e898 [0080.030] GetProcessHeap () returned 0xd20000 [0080.030] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0080.030] lstrlenW (lpString="C:\\Windows10Upgrade\\upgrader_default.log") returned 40 [0080.030] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0080.030] GetProcessHeap () returned 0xd20000 [0080.030] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0080.030] GetProcessHeap () returned 0xd20000 [0080.030] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x386) returned 0xd4b960 [0080.030] lstrlenA (lpString="rsa_encrypt") returned 11 [0080.030] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0080.032] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0080.032] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0080.032] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0080.032] GetProcessHeap () returned 0xd20000 [0080.033] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0080.033] lstrlenA (lpString="010001") returned 6 [0080.033] GetProcessHeap () returned 0xd20000 [0080.033] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd98 [0080.033] GetProcessHeap () returned 0xd20000 [0080.033] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0080.033] GetProcessHeap () returned 0xd20000 [0080.033] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4a948 [0080.033] GetProcessHeap () returned 0xd20000 [0080.033] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0080.033] GetProcessHeap () returned 0xd20000 [0080.033] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0080.033] GetProcessHeap () returned 0xd20000 [0080.033] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44d80 [0080.033] GetProcessHeap () returned 0xd20000 [0080.033] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd18 [0080.033] GetProcessHeap () returned 0xd20000 [0080.033] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0080.034] GetProcessHeap () returned 0xd20000 [0080.034] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.034] GetProcessHeap () returned 0xd20000 [0080.034] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0080.034] GetProcessHeap () returned 0xd20000 [0080.034] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0080.034] GetProcessHeap () returned 0xd20000 [0080.034] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd45410 [0080.034] GetProcessHeap () returned 0xd20000 [0080.034] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0080.034] GetProcessHeap () returned 0xd20000 [0080.034] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44408 [0080.034] GetProcessHeap () returned 0xd20000 [0080.034] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b5a8 [0080.034] GetProcessHeap () returned 0xd20000 [0080.034] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0080.034] GetProcessHeap () returned 0xd20000 [0080.034] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0080.034] GetProcessHeap () returned 0xd20000 [0080.034] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b5a8 | out: hHeap=0xd20000) returned 1 [0080.035] GetProcessHeap () returned 0xd20000 [0080.035] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0080.035] GetProcessHeap () returned 0xd20000 [0080.035] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44420 [0080.035] GetProcessHeap () returned 0xd20000 [0080.035] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0080.035] GetProcessHeap () returned 0xd20000 [0080.035] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0080.035] GetProcessHeap () returned 0xd20000 [0080.035] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0080.035] GetProcessHeap () returned 0xd20000 [0080.035] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0080.035] GetProcessHeap () returned 0xd20000 [0080.035] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0080.035] GetProcessHeap () returned 0xd20000 [0080.035] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0080.035] GetProcessHeap () returned 0xd20000 [0080.035] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b758 [0080.035] GetProcessHeap () returned 0xd20000 [0080.035] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44420 | out: hHeap=0xd20000) returned 1 [0080.035] GetProcessHeap () returned 0xd20000 [0080.036] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0080.036] GetProcessHeap () returned 0xd20000 [0080.036] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b758 | out: hHeap=0xd20000) returned 1 [0080.036] GetProcessHeap () returned 0xd20000 [0080.036] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0080.036] GetProcessHeap () returned 0xd20000 [0080.036] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0080.036] GetProcessHeap () returned 0xd20000 [0080.036] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.036] GetProcessHeap () returned 0xd20000 [0080.036] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.036] GetProcessHeap () returned 0xd20000 [0080.036] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0080.036] GetProcessHeap () returned 0xd20000 [0080.036] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0080.036] GetProcessHeap () returned 0xd20000 [0080.036] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0080.036] GetProcessHeap () returned 0xd20000 [0080.036] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0080.036] GetProcessHeap () returned 0xd20000 [0080.037] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0080.037] GetProcessHeap () returned 0xd20000 [0080.037] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0080.037] GetProcessHeap () returned 0xd20000 [0080.037] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0080.037] GetProcessHeap () returned 0xd20000 [0080.037] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0080.037] GetProcessHeap () returned 0xd20000 [0080.037] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0080.037] GetProcessHeap () returned 0xd20000 [0080.037] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0080.037] GetProcessHeap () returned 0xd20000 [0080.037] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0080.037] GetProcessHeap () returned 0xd20000 [0080.037] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0080.037] GetProcessHeap () returned 0xd20000 [0080.037] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0080.037] GetProcessHeap () returned 0xd20000 [0080.037] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0080.037] GetProcessHeap () returned 0xd20000 [0080.038] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0080.038] GetProcessHeap () returned 0xd20000 [0080.038] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0080.038] GetProcessHeap () returned 0xd20000 [0080.038] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0080.038] GetProcessHeap () returned 0xd20000 [0080.038] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0080.038] GetProcessHeap () returned 0xd20000 [0080.038] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0080.038] GetProcessHeap () returned 0xd20000 [0080.038] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0080.038] GetProcessHeap () returned 0xd20000 [0080.038] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0080.038] GetProcessHeap () returned 0xd20000 [0080.038] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0080.038] GetProcessHeap () returned 0xd20000 [0080.038] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.038] GetProcessHeap () returned 0xd20000 [0080.038] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.039] GetProcessHeap () returned 0xd20000 [0080.039] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0080.039] GetProcessHeap () returned 0xd20000 [0080.039] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0080.039] GetProcessHeap () returned 0xd20000 [0080.039] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0080.039] GetProcessHeap () returned 0xd20000 [0080.039] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0080.039] GetProcessHeap () returned 0xd20000 [0080.039] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0080.039] GetProcessHeap () returned 0xd20000 [0080.039] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0080.039] GetProcessHeap () returned 0xd20000 [0080.039] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0080.039] GetProcessHeap () returned 0xd20000 [0080.039] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0080.039] GetProcessHeap () returned 0xd20000 [0080.039] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.039] GetProcessHeap () returned 0xd20000 [0080.039] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.040] GetProcessHeap () returned 0xd20000 [0080.040] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0080.040] GetProcessHeap () returned 0xd20000 [0080.040] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0080.040] GetProcessHeap () returned 0xd20000 [0080.040] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.040] GetProcessHeap () returned 0xd20000 [0080.040] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.040] GetProcessHeap () returned 0xd20000 [0080.040] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.040] GetProcessHeap () returned 0xd20000 [0080.040] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.040] GetProcessHeap () returned 0xd20000 [0080.040] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0080.040] GetProcessHeap () returned 0xd20000 [0080.040] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0080.040] GetProcessHeap () returned 0xd20000 [0080.040] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0080.040] GetProcessHeap () returned 0xd20000 [0080.040] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0080.041] GetProcessHeap () returned 0xd20000 [0080.041] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.041] GetProcessHeap () returned 0xd20000 [0080.041] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.041] GetProcessHeap () returned 0xd20000 [0080.041] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.041] GetProcessHeap () returned 0xd20000 [0080.041] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.041] GetProcessHeap () returned 0xd20000 [0080.041] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0080.041] GetProcessHeap () returned 0xd20000 [0080.041] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0080.041] GetProcessHeap () returned 0xd20000 [0080.041] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.041] GetProcessHeap () returned 0xd20000 [0080.041] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.041] GetProcessHeap () returned 0xd20000 [0080.041] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0080.041] GetProcessHeap () returned 0xd20000 [0080.041] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0080.042] GetProcessHeap () returned 0xd20000 [0080.042] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0080.042] GetProcessHeap () returned 0xd20000 [0080.042] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0080.042] GetProcessHeap () returned 0xd20000 [0080.042] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0080.042] GetProcessHeap () returned 0xd20000 [0080.042] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0080.042] GetProcessHeap () returned 0xd20000 [0080.042] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.042] GetProcessHeap () returned 0xd20000 [0080.042] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.042] GetProcessHeap () returned 0xd20000 [0080.042] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.042] GetProcessHeap () returned 0xd20000 [0080.042] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.042] GetProcessHeap () returned 0xd20000 [0080.042] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0080.042] GetProcessHeap () returned 0xd20000 [0080.049] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0080.049] GetProcessHeap () returned 0xd20000 [0080.049] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0080.049] GetProcessHeap () returned 0xd20000 [0080.049] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0080.049] GetProcessHeap () returned 0xd20000 [0080.049] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0080.049] GetProcessHeap () returned 0xd20000 [0080.049] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0080.049] GetProcessHeap () returned 0xd20000 [0080.049] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0080.049] GetProcessHeap () returned 0xd20000 [0080.049] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0080.049] GetProcessHeap () returned 0xd20000 [0080.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.050] GetProcessHeap () returned 0xd20000 [0080.050] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.050] GetProcessHeap () returned 0xd20000 [0080.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0080.050] GetProcessHeap () returned 0xd20000 [0080.050] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0080.050] GetProcessHeap () returned 0xd20000 [0080.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0080.050] GetProcessHeap () returned 0xd20000 [0080.050] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0080.050] GetProcessHeap () returned 0xd20000 [0080.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0080.050] GetProcessHeap () returned 0xd20000 [0080.050] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0080.050] GetProcessHeap () returned 0xd20000 [0080.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0080.050] GetProcessHeap () returned 0xd20000 [0080.050] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0080.050] GetProcessHeap () returned 0xd20000 [0080.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0080.051] GetProcessHeap () returned 0xd20000 [0080.051] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0080.051] GetProcessHeap () returned 0xd20000 [0080.051] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0080.051] GetProcessHeap () returned 0xd20000 [0080.051] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0080.051] GetProcessHeap () returned 0xd20000 [0080.051] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0080.051] GetProcessHeap () returned 0xd20000 [0080.051] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0080.051] GetProcessHeap () returned 0xd20000 [0080.051] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0080.051] GetProcessHeap () returned 0xd20000 [0080.051] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0080.051] GetProcessHeap () returned 0xd20000 [0080.051] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0080.051] GetProcessHeap () returned 0xd20000 [0080.051] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0080.051] GetProcessHeap () returned 0xd20000 [0080.051] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.052] GetProcessHeap () returned 0xd20000 [0080.052] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.052] GetProcessHeap () returned 0xd20000 [0080.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.052] GetProcessHeap () returned 0xd20000 [0080.052] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.052] GetProcessHeap () returned 0xd20000 [0080.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.052] GetProcessHeap () returned 0xd20000 [0080.052] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.052] GetProcessHeap () returned 0xd20000 [0080.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0080.052] GetProcessHeap () returned 0xd20000 [0080.052] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0080.052] GetProcessHeap () returned 0xd20000 [0080.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0080.052] GetProcessHeap () returned 0xd20000 [0080.052] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0080.052] GetProcessHeap () returned 0xd20000 [0080.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0080.053] GetProcessHeap () returned 0xd20000 [0080.053] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0080.053] GetProcessHeap () returned 0xd20000 [0080.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0080.053] GetProcessHeap () returned 0xd20000 [0080.053] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0080.053] GetProcessHeap () returned 0xd20000 [0080.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0080.053] GetProcessHeap () returned 0xd20000 [0080.053] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0080.053] GetProcessHeap () returned 0xd20000 [0080.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0080.053] GetProcessHeap () returned 0xd20000 [0080.053] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0080.053] GetProcessHeap () returned 0xd20000 [0080.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0080.053] GetProcessHeap () returned 0xd20000 [0080.053] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0080.053] GetProcessHeap () returned 0xd20000 [0080.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0080.054] GetProcessHeap () returned 0xd20000 [0080.054] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0080.054] GetProcessHeap () returned 0xd20000 [0080.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0080.054] GetProcessHeap () returned 0xd20000 [0080.054] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0080.054] GetProcessHeap () returned 0xd20000 [0080.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0080.054] GetProcessHeap () returned 0xd20000 [0080.054] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0080.054] GetProcessHeap () returned 0xd20000 [0080.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0080.054] GetProcessHeap () returned 0xd20000 [0080.054] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0080.055] GetProcessHeap () returned 0xd20000 [0080.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0080.055] GetProcessHeap () returned 0xd20000 [0080.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0080.055] GetProcessHeap () returned 0xd20000 [0080.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.055] GetProcessHeap () returned 0xd20000 [0080.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.055] GetProcessHeap () returned 0xd20000 [0080.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0080.055] GetProcessHeap () returned 0xd20000 [0080.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0080.055] GetProcessHeap () returned 0xd20000 [0080.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.055] GetProcessHeap () returned 0xd20000 [0080.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.055] GetProcessHeap () returned 0xd20000 [0080.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0080.056] GetProcessHeap () returned 0xd20000 [0080.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0080.056] GetProcessHeap () returned 0xd20000 [0080.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0080.056] GetProcessHeap () returned 0xd20000 [0080.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0080.056] GetProcessHeap () returned 0xd20000 [0080.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0080.056] GetProcessHeap () returned 0xd20000 [0080.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0080.056] GetProcessHeap () returned 0xd20000 [0080.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.056] GetProcessHeap () returned 0xd20000 [0080.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.056] GetProcessHeap () returned 0xd20000 [0080.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0080.056] GetProcessHeap () returned 0xd20000 [0080.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0080.056] GetProcessHeap () returned 0xd20000 [0080.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.057] GetProcessHeap () returned 0xd20000 [0080.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.057] GetProcessHeap () returned 0xd20000 [0080.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0080.057] GetProcessHeap () returned 0xd20000 [0080.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0080.057] GetProcessHeap () returned 0xd20000 [0080.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0080.057] GetProcessHeap () returned 0xd20000 [0080.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0080.057] GetProcessHeap () returned 0xd20000 [0080.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0080.057] GetProcessHeap () returned 0xd20000 [0080.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0080.057] GetProcessHeap () returned 0xd20000 [0080.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.057] GetProcessHeap () returned 0xd20000 [0080.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.057] GetProcessHeap () returned 0xd20000 [0080.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0080.058] GetProcessHeap () returned 0xd20000 [0080.058] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0080.058] GetProcessHeap () returned 0xd20000 [0080.058] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0080.058] GetProcessHeap () returned 0xd20000 [0080.058] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0080.058] GetProcessHeap () returned 0xd20000 [0080.058] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0080.058] GetProcessHeap () returned 0xd20000 [0080.058] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0080.058] GetProcessHeap () returned 0xd20000 [0080.058] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0080.059] GetProcessHeap () returned 0xd20000 [0080.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0080.059] GetProcessHeap () returned 0xd20000 [0080.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0080.059] GetProcessHeap () returned 0xd20000 [0080.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0080.059] GetProcessHeap () returned 0xd20000 [0080.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.059] GetProcessHeap () returned 0xd20000 [0080.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.059] GetProcessHeap () returned 0xd20000 [0080.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.059] GetProcessHeap () returned 0xd20000 [0080.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.059] GetProcessHeap () returned 0xd20000 [0080.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.059] GetProcessHeap () returned 0xd20000 [0080.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.059] GetProcessHeap () returned 0xd20000 [0080.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0080.060] GetProcessHeap () returned 0xd20000 [0080.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0080.060] GetProcessHeap () returned 0xd20000 [0080.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.060] GetProcessHeap () returned 0xd20000 [0080.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.060] GetProcessHeap () returned 0xd20000 [0080.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0080.060] GetProcessHeap () returned 0xd20000 [0080.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0080.060] GetProcessHeap () returned 0xd20000 [0080.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0080.060] GetProcessHeap () returned 0xd20000 [0080.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0080.060] GetProcessHeap () returned 0xd20000 [0080.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44408 | out: hHeap=0xd20000) returned 1 [0080.060] GetProcessHeap () returned 0xd20000 [0080.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0080.060] GetProcessHeap () returned 0xd20000 [0080.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0080.061] GetProcessHeap () returned 0xd20000 [0080.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a948 | out: hHeap=0xd20000) returned 1 [0080.061] GetProcessHeap () returned 0xd20000 [0080.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0080.061] GetProcessHeap () returned 0xd20000 [0080.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0080.061] GetProcessHeap () returned 0xd20000 [0080.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0080.061] WriteFile (in: hFile=0x230, lpBuffer=0xd4b960*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4b960*, lpNumberOfBytesWritten=0x299d864*=0x386, lpOverlapped=0x0) returned 1 [0080.104] GetProcessHeap () returned 0xd20000 [0080.104] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4b960, Size=0x30) returned 0xd4b960 [0080.104] GetProcessHeap () returned 0xd20000 [0080.104] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0080.104] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0080.105] GetProcessHeap () returned 0xd20000 [0080.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x3d150) returned 0xd4b998 [0080.113] ReadFile (in: hFile=0x230, lpBuffer=0xd4b998, nNumberOfBytesToRead=0x3d150, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4b998*, lpNumberOfBytesRead=0x299d7e8*=0x3d150, lpOverlapped=0x0) returned 1 [0080.197] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0080.197] WriteFile (in: hFile=0x230, lpBuffer=0xd4b998*, nNumberOfBytesToWrite=0x3d150, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4b998*, lpNumberOfBytesWritten=0x299d7e4*=0x3d150, lpOverlapped=0x0) returned 1 [0080.664] GetProcessHeap () returned 0xd20000 [0080.664] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b998 | out: hHeap=0xd20000) returned 1 [0080.664] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0080.664] WriteFile (in: hFile=0x230, lpBuffer=0xd4b960*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4b960*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0080.666] CloseHandle (hObject=0x230) returned 1 [0080.675] GetProcessHeap () returned 0xd20000 [0080.675] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd424e0 | out: hHeap=0xd20000) returned 1 [0080.675] GetProcessHeap () returned 0xd20000 [0080.675] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2e898 | out: hHeap=0xd20000) returned 1 [0080.675] GetProcessHeap () returned 0xd20000 [0080.675] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0080.676] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\upgrader_default.log" | out: lpString1="C:\\Windows10Upgrade\\upgrader_default.log") returned="C:\\Windows10Upgrade\\upgrader_default.log" [0080.676] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\upgrader_default.log", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\upgrader_default.log.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\upgrader_default.log.[ponce.lorena@aol.com]" [0080.676] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\upgrader_default.log" (normalized: "c:\\windows10upgrade\\upgrader_default.log"), lpNewFileName="C:\\Windows10Upgrade\\upgrader_default.log.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\upgrader_default.log.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0080.676] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\upgrader_default.log" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0080.677] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0080.677] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\HOW_RECOVER.html" [0080.677] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\how_recover.html")) returned 0x20 [0080.677] GetProcessHeap () returned 0xd20000 [0080.677] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd363c8 | out: hHeap=0xd20000) returned 1 [0080.677] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccdc86a8, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x32fe02cc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x5044, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="upgrader_win10.log", cAlternateFileName="UPGRAD~2.LOG")) returned 1 [0080.677] lstrcmpiW (lpString1="upgrader_win10.log", lpString2=".") returned 1 [0080.677] lstrcmpiW (lpString1="upgrader_win10.log", lpString2="..") returned 1 [0080.677] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="upgrader_win10.log" | out: lpString1="C:\\Windows10Upgrade\\upgrader_win10.log") returned="C:\\Windows10Upgrade\\upgrader_win10.log" [0080.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upgrader_win10.log", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0080.677] GetProcessHeap () returned 0xd20000 [0080.677] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x13) returned 0xd36648 [0080.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="upgrader_win10.log", cchWideChar=-1, lpMultiByteStr=0xd36648, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="upgrader_win10.log", lpUsedDefaultChar=0x0) returned 19 [0080.677] lstrlenA (lpString="upgrader_win10.log") returned 18 [0080.677] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0080.678] lstrlenA (lpString="upgrader_win10.log") returned 18 [0080.678] lstrlenA (lpString=".dll") returned 4 [0080.678] lstrlenA (lpString=".dll") returned 4 [0080.678] lstrlenA (lpString="upgrader_win10.log") returned 18 [0080.678] lstrcmpiA (lpString1=".log", lpString2=".dll") returned 1 [0080.678] lstrlenA (lpString="upgrader_win10.log") returned 18 [0080.678] lstrlenA (lpString=".ini") returned 4 [0080.678] lstrlenA (lpString=".ini") returned 4 [0080.678] lstrlenA (lpString="upgrader_win10.log") returned 18 [0080.678] lstrcmpiA (lpString1=".log", lpString2=".ini") returned 1 [0080.678] lstrlenA (lpString="upgrader_win10.log") returned 18 [0080.678] lstrlenA (lpString=".inc") returned 4 [0080.678] lstrlenA (lpString=".inc") returned 4 [0080.678] lstrlenA (lpString="upgrader_win10.log") returned 18 [0080.678] lstrcmpiA (lpString1=".log", lpString2=".inc") returned 1 [0080.678] lstrcmpiW (lpString1="upgrader_win10.log", lpString2="HOW_RECOVER.html") returned 1 [0080.678] lstrcmpiW (lpString1="upgrader_win10.log", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0080.678] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0080.678] lstrcmpiW (lpString1="upgrader_win10.log", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0080.679] GetProcessHeap () returned 0xd20000 [0080.679] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42620 [0080.679] CreateFileW (lpFileName="C:\\Windows10Upgrade\\upgrader_win10.log" (normalized: "c:\\windows10upgrade\\upgrader_win10.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0080.679] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=20548) returned 1 [0080.679] GetProcessHeap () returned 0xd20000 [0080.679] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd2e898 [0080.680] GetProcessHeap () returned 0xd20000 [0080.680] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0080.680] lstrlenW (lpString="C:\\Windows10Upgrade\\upgrader_win10.log") returned 38 [0080.680] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0080.680] GetProcessHeap () returned 0xd20000 [0080.680] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0080.680] GetProcessHeap () returned 0xd20000 [0080.680] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x38c) returned 0xd4b998 [0080.680] lstrlenA (lpString="rsa_encrypt") returned 11 [0080.680] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0080.682] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0080.683] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0080.683] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0080.686] GetProcessHeap () returned 0xd20000 [0080.686] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0080.686] lstrlenA (lpString="010001") returned 6 [0080.686] GetProcessHeap () returned 0xd20000 [0080.686] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd88 [0080.686] GetProcessHeap () returned 0xd20000 [0080.686] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0080.686] GetProcessHeap () returned 0xd20000 [0080.686] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aee8 [0080.686] GetProcessHeap () returned 0xd20000 [0080.686] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0080.686] GetProcessHeap () returned 0xd20000 [0080.686] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b368 [0080.686] GetProcessHeap () returned 0xd20000 [0080.686] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44e98 [0080.686] GetProcessHeap () returned 0xd20000 [0080.686] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd18 [0080.686] GetProcessHeap () returned 0xd20000 [0080.687] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0080.687] GetProcessHeap () returned 0xd20000 [0080.687] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.687] GetProcessHeap () returned 0xd20000 [0080.687] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0080.687] GetProcessHeap () returned 0xd20000 [0080.687] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0080.687] GetProcessHeap () returned 0xd20000 [0080.687] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44920 [0080.687] GetProcessHeap () returned 0xd20000 [0080.687] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0080.687] GetProcessHeap () returned 0xd20000 [0080.687] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44648 [0080.687] GetProcessHeap () returned 0xd20000 [0080.687] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b758 [0080.687] GetProcessHeap () returned 0xd20000 [0080.687] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0080.687] GetProcessHeap () returned 0xd20000 [0080.687] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0080.687] GetProcessHeap () returned 0xd20000 [0080.688] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b758 | out: hHeap=0xd20000) returned 1 [0080.688] GetProcessHeap () returned 0xd20000 [0080.688] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0080.688] GetProcessHeap () returned 0xd20000 [0080.688] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444c8 [0080.688] GetProcessHeap () returned 0xd20000 [0080.688] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0080.688] GetProcessHeap () returned 0xd20000 [0080.688] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0080.688] GetProcessHeap () returned 0xd20000 [0080.688] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.688] GetProcessHeap () returned 0xd20000 [0080.688] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.688] GetProcessHeap () returned 0xd20000 [0080.688] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.688] GetProcessHeap () returned 0xd20000 [0080.688] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.688] GetProcessHeap () returned 0xd20000 [0080.688] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b7e8 [0080.689] GetProcessHeap () returned 0xd20000 [0080.689] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444c8 | out: hHeap=0xd20000) returned 1 [0080.689] GetProcessHeap () returned 0xd20000 [0080.689] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0080.689] GetProcessHeap () returned 0xd20000 [0080.689] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0080.689] GetProcessHeap () returned 0xd20000 [0080.689] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0080.689] GetProcessHeap () returned 0xd20000 [0080.689] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0080.689] GetProcessHeap () returned 0xd20000 [0080.689] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0080.689] GetProcessHeap () returned 0xd20000 [0080.689] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0080.689] GetProcessHeap () returned 0xd20000 [0080.689] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0080.689] GetProcessHeap () returned 0xd20000 [0080.689] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0080.689] GetProcessHeap () returned 0xd20000 [0080.689] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0080.690] GetProcessHeap () returned 0xd20000 [0080.690] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0080.690] GetProcessHeap () returned 0xd20000 [0080.690] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0080.690] GetProcessHeap () returned 0xd20000 [0080.690] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0080.690] GetProcessHeap () returned 0xd20000 [0080.690] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0080.690] GetProcessHeap () returned 0xd20000 [0080.690] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0080.690] GetProcessHeap () returned 0xd20000 [0080.690] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.690] GetProcessHeap () returned 0xd20000 [0080.690] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.690] GetProcessHeap () returned 0xd20000 [0080.690] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0080.690] GetProcessHeap () returned 0xd20000 [0080.690] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0080.690] GetProcessHeap () returned 0xd20000 [0080.690] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0080.690] GetProcessHeap () returned 0xd20000 [0080.690] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0080.691] GetProcessHeap () returned 0xd20000 [0080.691] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0080.691] GetProcessHeap () returned 0xd20000 [0080.691] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0080.691] GetProcessHeap () returned 0xd20000 [0080.691] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.691] GetProcessHeap () returned 0xd20000 [0080.691] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.691] GetProcessHeap () returned 0xd20000 [0080.691] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0080.691] GetProcessHeap () returned 0xd20000 [0080.691] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0080.691] GetProcessHeap () returned 0xd20000 [0080.691] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0080.691] GetProcessHeap () returned 0xd20000 [0080.691] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0080.691] GetProcessHeap () returned 0xd20000 [0080.691] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.692] GetProcessHeap () returned 0xd20000 [0080.692] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.692] GetProcessHeap () returned 0xd20000 [0080.692] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0080.692] GetProcessHeap () returned 0xd20000 [0080.692] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0080.692] GetProcessHeap () returned 0xd20000 [0080.692] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.692] GetProcessHeap () returned 0xd20000 [0080.692] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.692] GetProcessHeap () returned 0xd20000 [0080.692] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.692] GetProcessHeap () returned 0xd20000 [0080.692] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.692] GetProcessHeap () returned 0xd20000 [0080.692] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.692] GetProcessHeap () returned 0xd20000 [0080.692] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.692] GetProcessHeap () returned 0xd20000 [0080.692] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0080.692] GetProcessHeap () returned 0xd20000 [0080.693] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0080.693] GetProcessHeap () returned 0xd20000 [0080.693] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0080.693] GetProcessHeap () returned 0xd20000 [0080.693] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0080.693] GetProcessHeap () returned 0xd20000 [0080.693] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0080.693] GetProcessHeap () returned 0xd20000 [0080.693] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0080.693] GetProcessHeap () returned 0xd20000 [0080.693] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0080.693] GetProcessHeap () returned 0xd20000 [0080.693] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0080.693] GetProcessHeap () returned 0xd20000 [0080.693] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0080.693] GetProcessHeap () returned 0xd20000 [0080.693] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0080.693] GetProcessHeap () returned 0xd20000 [0080.693] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0080.693] GetProcessHeap () returned 0xd20000 [0080.693] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0080.694] GetProcessHeap () returned 0xd20000 [0080.694] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0080.694] GetProcessHeap () returned 0xd20000 [0080.694] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0080.694] GetProcessHeap () returned 0xd20000 [0080.694] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0080.694] GetProcessHeap () returned 0xd20000 [0080.694] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0080.694] GetProcessHeap () returned 0xd20000 [0080.694] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0080.694] GetProcessHeap () returned 0xd20000 [0080.694] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0080.694] GetProcessHeap () returned 0xd20000 [0080.694] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0080.694] GetProcessHeap () returned 0xd20000 [0080.694] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0080.694] GetProcessHeap () returned 0xd20000 [0080.694] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.694] GetProcessHeap () returned 0xd20000 [0080.695] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.695] GetProcessHeap () returned 0xd20000 [0080.695] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0080.695] GetProcessHeap () returned 0xd20000 [0080.695] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0080.695] GetProcessHeap () returned 0xd20000 [0080.695] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0080.695] GetProcessHeap () returned 0xd20000 [0080.695] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0080.695] GetProcessHeap () returned 0xd20000 [0080.695] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0080.695] GetProcessHeap () returned 0xd20000 [0080.695] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0080.695] GetProcessHeap () returned 0xd20000 [0080.695] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0080.695] GetProcessHeap () returned 0xd20000 [0080.695] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0080.695] GetProcessHeap () returned 0xd20000 [0080.696] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0080.696] GetProcessHeap () returned 0xd20000 [0080.696] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0080.696] GetProcessHeap () returned 0xd20000 [0080.696] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0080.696] GetProcessHeap () returned 0xd20000 [0080.696] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0080.696] GetProcessHeap () returned 0xd20000 [0080.696] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.696] GetProcessHeap () returned 0xd20000 [0080.696] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.696] GetProcessHeap () returned 0xd20000 [0080.696] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0080.696] GetProcessHeap () returned 0xd20000 [0080.696] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0080.696] GetProcessHeap () returned 0xd20000 [0080.697] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0080.697] GetProcessHeap () returned 0xd20000 [0080.697] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0080.697] GetProcessHeap () returned 0xd20000 [0080.697] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0080.697] GetProcessHeap () returned 0xd20000 [0080.697] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0080.697] GetProcessHeap () returned 0xd20000 [0080.697] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0080.697] GetProcessHeap () returned 0xd20000 [0080.697] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0080.697] GetProcessHeap () returned 0xd20000 [0080.697] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0080.697] GetProcessHeap () returned 0xd20000 [0080.697] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0080.697] GetProcessHeap () returned 0xd20000 [0080.697] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0080.697] GetProcessHeap () returned 0xd20000 [0080.697] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0080.698] GetProcessHeap () returned 0xd20000 [0080.698] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0080.698] GetProcessHeap () returned 0xd20000 [0080.698] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0080.698] GetProcessHeap () returned 0xd20000 [0080.698] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0080.698] GetProcessHeap () returned 0xd20000 [0080.698] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0080.698] GetProcessHeap () returned 0xd20000 [0080.698] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0080.698] GetProcessHeap () returned 0xd20000 [0080.698] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0080.698] GetProcessHeap () returned 0xd20000 [0080.698] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.698] GetProcessHeap () returned 0xd20000 [0080.698] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.698] GetProcessHeap () returned 0xd20000 [0080.698] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0080.698] GetProcessHeap () returned 0xd20000 [0080.698] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0080.699] GetProcessHeap () returned 0xd20000 [0080.699] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.699] GetProcessHeap () returned 0xd20000 [0080.699] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.699] GetProcessHeap () returned 0xd20000 [0080.699] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0080.699] GetProcessHeap () returned 0xd20000 [0080.699] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0080.699] GetProcessHeap () returned 0xd20000 [0080.699] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.699] GetProcessHeap () returned 0xd20000 [0080.699] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.699] GetProcessHeap () returned 0xd20000 [0080.699] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.699] GetProcessHeap () returned 0xd20000 [0080.699] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.700] GetProcessHeap () returned 0xd20000 [0080.700] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.700] GetProcessHeap () returned 0xd20000 [0080.700] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.700] GetProcessHeap () returned 0xd20000 [0080.700] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0080.700] GetProcessHeap () returned 0xd20000 [0080.700] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0080.700] GetProcessHeap () returned 0xd20000 [0080.700] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0080.700] GetProcessHeap () returned 0xd20000 [0080.700] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0080.700] GetProcessHeap () returned 0xd20000 [0080.700] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0080.700] GetProcessHeap () returned 0xd20000 [0080.700] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0080.700] GetProcessHeap () returned 0xd20000 [0080.700] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.700] GetProcessHeap () returned 0xd20000 [0080.700] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.701] GetProcessHeap () returned 0xd20000 [0080.701] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0080.701] GetProcessHeap () returned 0xd20000 [0080.701] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0080.701] GetProcessHeap () returned 0xd20000 [0080.701] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.701] GetProcessHeap () returned 0xd20000 [0080.701] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.701] GetProcessHeap () returned 0xd20000 [0080.701] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.701] GetProcessHeap () returned 0xd20000 [0080.701] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.701] GetProcessHeap () returned 0xd20000 [0080.701] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0080.701] GetProcessHeap () returned 0xd20000 [0080.701] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0080.701] GetProcessHeap () returned 0xd20000 [0080.701] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0080.701] GetProcessHeap () returned 0xd20000 [0080.701] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0080.702] GetProcessHeap () returned 0xd20000 [0080.702] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0080.702] GetProcessHeap () returned 0xd20000 [0080.702] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0080.702] GetProcessHeap () returned 0xd20000 [0080.702] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0080.702] GetProcessHeap () returned 0xd20000 [0080.702] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0080.702] GetProcessHeap () returned 0xd20000 [0080.702] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0080.702] GetProcessHeap () returned 0xd20000 [0080.702] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0080.702] GetProcessHeap () returned 0xd20000 [0080.702] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.702] GetProcessHeap () returned 0xd20000 [0080.702] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.702] GetProcessHeap () returned 0xd20000 [0080.702] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0080.702] GetProcessHeap () returned 0xd20000 [0080.702] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0080.702] GetProcessHeap () returned 0xd20000 [0080.703] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0080.703] GetProcessHeap () returned 0xd20000 [0080.703] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0080.703] GetProcessHeap () returned 0xd20000 [0080.703] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0080.703] GetProcessHeap () returned 0xd20000 [0080.703] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0080.703] GetProcessHeap () returned 0xd20000 [0080.703] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0080.703] GetProcessHeap () returned 0xd20000 [0080.703] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0080.703] GetProcessHeap () returned 0xd20000 [0080.703] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0080.703] GetProcessHeap () returned 0xd20000 [0080.703] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0080.703] GetProcessHeap () returned 0xd20000 [0080.703] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0080.703] GetProcessHeap () returned 0xd20000 [0080.703] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0080.703] GetProcessHeap () returned 0xd20000 [0080.703] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.704] GetProcessHeap () returned 0xd20000 [0080.704] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.704] GetProcessHeap () returned 0xd20000 [0080.704] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.704] GetProcessHeap () returned 0xd20000 [0080.704] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.704] GetProcessHeap () returned 0xd20000 [0080.704] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0080.704] GetProcessHeap () returned 0xd20000 [0080.704] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0080.704] GetProcessHeap () returned 0xd20000 [0080.704] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.704] GetProcessHeap () returned 0xd20000 [0080.704] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.704] GetProcessHeap () returned 0xd20000 [0080.704] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0080.704] GetProcessHeap () returned 0xd20000 [0080.704] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0080.704] GetProcessHeap () returned 0xd20000 [0080.704] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0080.704] GetProcessHeap () returned 0xd20000 [0080.705] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0080.705] GetProcessHeap () returned 0xd20000 [0080.705] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0080.705] GetProcessHeap () returned 0xd20000 [0080.705] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0080.705] GetProcessHeap () returned 0xd20000 [0080.705] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.705] GetProcessHeap () returned 0xd20000 [0080.705] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.705] GetProcessHeap () returned 0xd20000 [0080.705] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0080.705] GetProcessHeap () returned 0xd20000 [0080.705] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0080.705] GetProcessHeap () returned 0xd20000 [0080.705] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0080.705] GetProcessHeap () returned 0xd20000 [0080.705] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0080.705] GetProcessHeap () returned 0xd20000 [0080.705] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0080.705] GetProcessHeap () returned 0xd20000 [0080.706] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0080.706] GetProcessHeap () returned 0xd20000 [0080.706] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0080.706] GetProcessHeap () returned 0xd20000 [0080.706] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0080.706] GetProcessHeap () returned 0xd20000 [0080.706] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0080.706] GetProcessHeap () returned 0xd20000 [0080.706] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0080.706] GetProcessHeap () returned 0xd20000 [0080.706] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0080.706] GetProcessHeap () returned 0xd20000 [0080.706] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0080.706] GetProcessHeap () returned 0xd20000 [0080.706] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0080.706] GetProcessHeap () returned 0xd20000 [0080.706] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0080.706] GetProcessHeap () returned 0xd20000 [0080.706] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0080.706] GetProcessHeap () returned 0xd20000 [0080.707] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0080.707] GetProcessHeap () returned 0xd20000 [0080.707] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44648 | out: hHeap=0xd20000) returned 1 [0080.707] GetProcessHeap () returned 0xd20000 [0080.707] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b368 | out: hHeap=0xd20000) returned 1 [0080.707] GetProcessHeap () returned 0xd20000 [0080.707] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0080.707] GetProcessHeap () returned 0xd20000 [0080.707] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aee8 | out: hHeap=0xd20000) returned 1 [0080.707] GetProcessHeap () returned 0xd20000 [0080.707] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0080.707] GetProcessHeap () returned 0xd20000 [0080.707] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0080.707] GetProcessHeap () returned 0xd20000 [0080.707] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0080.707] WriteFile (in: hFile=0x230, lpBuffer=0xd4b998*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4b998*, lpNumberOfBytesWritten=0x299d864*=0x38c, lpOverlapped=0x0) returned 1 [0080.722] GetProcessHeap () returned 0xd20000 [0080.722] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4b998, Size=0x30) returned 0xd4b998 [0080.722] GetProcessHeap () returned 0xd20000 [0080.722] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0080.722] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0080.723] GetProcessHeap () returned 0xd20000 [0080.723] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x5050) returned 0xd4b9d0 [0080.723] ReadFile (in: hFile=0x230, lpBuffer=0xd4b9d0, nNumberOfBytesToRead=0x5050, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4b9d0*, lpNumberOfBytesRead=0x299d7e8*=0x5050, lpOverlapped=0x0) returned 1 [0080.742] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0080.742] WriteFile (in: hFile=0x230, lpBuffer=0xd4b9d0*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4b9d0*, lpNumberOfBytesWritten=0x299d7e4*=0x5050, lpOverlapped=0x0) returned 1 [0081.731] GetProcessHeap () returned 0xd20000 [0081.731] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b9d0 | out: hHeap=0xd20000) returned 1 [0081.732] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0081.732] WriteFile (in: hFile=0x230, lpBuffer=0xd4b998*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4b998*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0081.734] CloseHandle (hObject=0x230) returned 1 [0081.742] GetProcessHeap () returned 0xd20000 [0081.742] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42620 | out: hHeap=0xd20000) returned 1 [0081.742] GetProcessHeap () returned 0xd20000 [0081.742] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2e898 | out: hHeap=0xd20000) returned 1 [0081.742] GetProcessHeap () returned 0xd20000 [0081.742] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0081.742] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\upgrader_win10.log" | out: lpString1="C:\\Windows10Upgrade\\upgrader_win10.log") returned="C:\\Windows10Upgrade\\upgrader_win10.log" [0081.742] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\upgrader_win10.log", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\upgrader_win10.log.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\upgrader_win10.log.[ponce.lorena@aol.com]" [0081.742] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\upgrader_win10.log" (normalized: "c:\\windows10upgrade\\upgrader_win10.log"), lpNewFileName="C:\\Windows10Upgrade\\upgrader_win10.log.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\upgrader_win10.log.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0081.744] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\upgrader_win10.log" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0081.744] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0081.744] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\HOW_RECOVER.html" [0081.744] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\how_recover.html")) returned 0x20 [0081.744] GetProcessHeap () returned 0xd20000 [0081.744] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36648 | out: hHeap=0xd20000) returned 1 [0081.744] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea63f06a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63f06a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x880c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wimgapi.dll", cAlternateFileName="")) returned 1 [0081.744] lstrcmpiW (lpString1="wimgapi.dll", lpString2=".") returned 1 [0081.745] lstrcmpiW (lpString1="wimgapi.dll", lpString2="..") returned 1 [0081.745] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="wimgapi.dll" | out: lpString1="C:\\Windows10Upgrade\\wimgapi.dll") returned="C:\\Windows10Upgrade\\wimgapi.dll" [0081.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimgapi.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0081.745] GetProcessHeap () returned 0xd20000 [0081.745] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd445a0 [0081.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wimgapi.dll", cchWideChar=-1, lpMultiByteStr=0xd445a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wimgapi.dll", lpUsedDefaultChar=0x0) returned 12 [0081.745] lstrlenA (lpString="wimgapi.dll") returned 11 [0081.745] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0081.745] lstrlenA (lpString="wimgapi.dll") returned 11 [0081.745] lstrlenA (lpString=".dll") returned 4 [0081.745] lstrlenA (lpString=".dll") returned 4 [0081.745] lstrlenA (lpString="wimgapi.dll") returned 11 [0081.745] lstrcmpiA (lpString1=".dll", lpString2=".dll") returned 0 [0081.745] GetProcessHeap () returned 0xd20000 [0081.745] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445a0 | out: hHeap=0xd20000) returned 1 [0081.745] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea642af3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea642af3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xdf8c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="windlp.dll", cAlternateFileName="")) returned 1 [0081.745] lstrcmpiW (lpString1="windlp.dll", lpString2=".") returned 1 [0081.745] lstrcmpiW (lpString1="windlp.dll", lpString2="..") returned 1 [0081.746] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="windlp.dll" | out: lpString1="C:\\Windows10Upgrade\\windlp.dll") returned="C:\\Windows10Upgrade\\windlp.dll" [0081.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windlp.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0081.746] GetProcessHeap () returned 0xd20000 [0081.746] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xb) returned 0xd44408 [0081.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="windlp.dll", cchWideChar=-1, lpMultiByteStr=0xd44408, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="windlp.dll", lpUsedDefaultChar=0x0) returned 11 [0081.746] lstrlenA (lpString="windlp.dll") returned 10 [0081.746] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0081.746] lstrlenA (lpString="windlp.dll") returned 10 [0081.747] lstrlenA (lpString=".dll") returned 4 [0081.747] lstrlenA (lpString=".dll") returned 4 [0081.747] lstrlenA (lpString="windlp.dll") returned 10 [0081.747] lstrcmpiA (lpString1=".dll", lpString2=".dll") returned 0 [0081.747] GetProcessHeap () returned 0xd20000 [0081.747] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44408 | out: hHeap=0xd20000) returned 1 [0081.747] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea64a022, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea64a022, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x159ac8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows10UpgraderApp.exe", cAlternateFileName="WINDOW~1.EXE")) returned 1 [0081.747] lstrcmpiW (lpString1="Windows10UpgraderApp.exe", lpString2=".") returned 1 [0081.747] lstrcmpiW (lpString1="Windows10UpgraderApp.exe", lpString2="..") returned 1 [0081.747] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="Windows10UpgraderApp.exe" | out: lpString1="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe") returned="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe" [0081.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Windows10UpgraderApp.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0081.747] GetProcessHeap () returned 0xd20000 [0081.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x19) returned 0xd42620 [0081.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Windows10UpgraderApp.exe", cchWideChar=-1, lpMultiByteStr=0xd42620, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows10UpgraderApp.exe", lpUsedDefaultChar=0x0) returned 25 [0081.747] lstrlenA (lpString="Windows10UpgraderApp.exe") returned 24 [0081.747] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0081.747] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0081.747] lstrlenA (lpString="Windows10UpgraderApp.exe") returned 24 [0081.747] lstrcmpiA (lpString1="indows10UpgraderApp.exe", lpString2=".[ponce.lorena@aol.com]") returned 1 [0081.748] lstrlenA (lpString="Windows10UpgraderApp.exe") returned 24 [0081.748] lstrlenA (lpString=".dll") returned 4 [0081.748] lstrlenA (lpString=".dll") returned 4 [0081.748] lstrlenA (lpString="Windows10UpgraderApp.exe") returned 24 [0081.748] lstrcmpiA (lpString1=".exe", lpString2=".dll") returned 1 [0081.748] lstrlenA (lpString="Windows10UpgraderApp.exe") returned 24 [0081.748] lstrlenA (lpString=".ini") returned 4 [0081.748] lstrlenA (lpString=".ini") returned 4 [0081.748] lstrlenA (lpString="Windows10UpgraderApp.exe") returned 24 [0081.748] lstrcmpiA (lpString1=".exe", lpString2=".ini") returned -1 [0081.748] lstrlenA (lpString="Windows10UpgraderApp.exe") returned 24 [0081.748] lstrlenA (lpString=".inc") returned 4 [0081.748] lstrlenA (lpString=".inc") returned 4 [0081.748] lstrlenA (lpString="Windows10UpgraderApp.exe") returned 24 [0081.748] lstrcmpiA (lpString1=".exe", lpString2=".inc") returned -1 [0081.748] lstrcmpiW (lpString1="Windows10UpgraderApp.exe", lpString2="HOW_RECOVER.html") returned 1 [0081.748] lstrcmpiW (lpString1="Windows10UpgraderApp.exe", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0081.748] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0081.748] lstrcmpiW (lpString1="Windows10UpgraderApp.exe", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0081.748] GetProcessHeap () returned 0xd20000 [0081.749] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd426c0 [0081.749] CreateFileW (lpFileName="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe" (normalized: "c:\\windows10upgrade\\windows10upgraderapp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0081.793] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=1415880) returned 1 [0081.793] GetProcessHeap () returned 0xd20000 [0081.793] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd2e898 [0081.793] GetProcessHeap () returned 0xd20000 [0081.793] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0081.794] lstrlenW (lpString="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe") returned 44 [0081.794] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0081.794] GetProcessHeap () returned 0xd20000 [0081.794] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0081.794] GetProcessHeap () returned 0xd20000 [0081.794] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x388) returned 0xd4b9d0 [0081.794] lstrlenA (lpString="rsa_encrypt") returned 11 [0081.794] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0081.797] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0081.797] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0081.797] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0081.797] GetProcessHeap () returned 0xd20000 [0081.797] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0081.797] lstrlenA (lpString="010001") returned 6 [0081.797] GetProcessHeap () returned 0xd20000 [0081.797] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd88 [0081.797] GetProcessHeap () returned 0xd20000 [0081.797] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0081.797] GetProcessHeap () returned 0xd20000 [0081.797] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aee8 [0081.797] GetProcessHeap () returned 0xd20000 [0081.798] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0081.798] GetProcessHeap () returned 0xd20000 [0081.798] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b6c8 [0081.798] GetProcessHeap () returned 0xd20000 [0081.798] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44b50 [0081.798] GetProcessHeap () returned 0xd20000 [0081.798] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cdb8 [0081.798] GetProcessHeap () returned 0xd20000 [0081.798] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0081.798] GetProcessHeap () returned 0xd20000 [0081.798] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0081.798] GetProcessHeap () returned 0xd20000 [0081.798] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0081.798] GetProcessHeap () returned 0xd20000 [0081.798] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0081.798] GetProcessHeap () returned 0xd20000 [0081.798] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44c68 [0081.798] GetProcessHeap () returned 0xd20000 [0081.798] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0081.798] GetProcessHeap () returned 0xd20000 [0081.798] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444c8 [0081.799] GetProcessHeap () returned 0xd20000 [0081.799] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b3f8 [0081.799] GetProcessHeap () returned 0xd20000 [0081.799] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0081.799] GetProcessHeap () returned 0xd20000 [0081.799] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0081.799] GetProcessHeap () returned 0xd20000 [0081.799] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b3f8 | out: hHeap=0xd20000) returned 1 [0081.799] GetProcessHeap () returned 0xd20000 [0081.799] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0081.799] GetProcessHeap () returned 0xd20000 [0081.799] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44438 [0081.799] GetProcessHeap () returned 0xd20000 [0081.799] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0081.799] GetProcessHeap () returned 0xd20000 [0081.799] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0081.799] GetProcessHeap () returned 0xd20000 [0081.799] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0081.799] GetProcessHeap () returned 0xd20000 [0081.800] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0081.800] GetProcessHeap () returned 0xd20000 [0081.800] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0081.800] GetProcessHeap () returned 0xd20000 [0081.800] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0081.800] GetProcessHeap () returned 0xd20000 [0081.800] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4aa68 [0081.800] GetProcessHeap () returned 0xd20000 [0081.800] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44438 | out: hHeap=0xd20000) returned 1 [0081.800] GetProcessHeap () returned 0xd20000 [0081.800] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0081.800] GetProcessHeap () returned 0xd20000 [0081.800] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aa68 | out: hHeap=0xd20000) returned 1 [0081.800] GetProcessHeap () returned 0xd20000 [0081.800] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0081.800] GetProcessHeap () returned 0xd20000 [0081.800] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0081.800] GetProcessHeap () returned 0xd20000 [0081.800] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0081.800] GetProcessHeap () returned 0xd20000 [0081.800] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0081.801] GetProcessHeap () returned 0xd20000 [0081.801] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0081.801] GetProcessHeap () returned 0xd20000 [0081.801] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0081.801] GetProcessHeap () returned 0xd20000 [0081.801] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0081.801] GetProcessHeap () returned 0xd20000 [0081.801] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0081.801] GetProcessHeap () returned 0xd20000 [0081.801] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0081.801] GetProcessHeap () returned 0xd20000 [0081.801] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0081.801] GetProcessHeap () returned 0xd20000 [0081.801] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0081.801] GetProcessHeap () returned 0xd20000 [0081.801] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0081.801] GetProcessHeap () returned 0xd20000 [0081.801] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0081.801] GetProcessHeap () returned 0xd20000 [0081.801] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0081.801] GetProcessHeap () returned 0xd20000 [0081.802] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0081.802] GetProcessHeap () returned 0xd20000 [0081.802] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0081.802] GetProcessHeap () returned 0xd20000 [0081.802] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0081.802] GetProcessHeap () returned 0xd20000 [0081.802] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0081.802] GetProcessHeap () returned 0xd20000 [0081.802] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0081.802] GetProcessHeap () returned 0xd20000 [0081.802] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0081.802] GetProcessHeap () returned 0xd20000 [0081.802] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0081.802] GetProcessHeap () returned 0xd20000 [0081.802] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0081.802] GetProcessHeap () returned 0xd20000 [0081.802] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0081.802] GetProcessHeap () returned 0xd20000 [0081.802] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0081.802] GetProcessHeap () returned 0xd20000 [0081.802] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0081.803] GetProcessHeap () returned 0xd20000 [0081.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0081.803] GetProcessHeap () returned 0xd20000 [0081.803] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0081.803] GetProcessHeap () returned 0xd20000 [0081.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0081.803] GetProcessHeap () returned 0xd20000 [0081.803] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0081.803] GetProcessHeap () returned 0xd20000 [0081.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0081.803] GetProcessHeap () returned 0xd20000 [0081.803] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0081.803] GetProcessHeap () returned 0xd20000 [0081.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0081.803] GetProcessHeap () returned 0xd20000 [0081.803] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0081.803] GetProcessHeap () returned 0xd20000 [0081.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0081.803] GetProcessHeap () returned 0xd20000 [0081.804] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0081.804] GetProcessHeap () returned 0xd20000 [0081.804] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0081.804] GetProcessHeap () returned 0xd20000 [0081.804] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0081.804] GetProcessHeap () returned 0xd20000 [0081.804] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0081.804] GetProcessHeap () returned 0xd20000 [0081.804] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0081.804] GetProcessHeap () returned 0xd20000 [0081.804] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0081.804] GetProcessHeap () returned 0xd20000 [0081.804] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0081.804] GetProcessHeap () returned 0xd20000 [0081.804] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0081.804] GetProcessHeap () returned 0xd20000 [0081.804] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0081.804] GetProcessHeap () returned 0xd20000 [0081.804] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0081.804] GetProcessHeap () returned 0xd20000 [0081.804] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0081.805] GetProcessHeap () returned 0xd20000 [0081.805] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0081.805] GetProcessHeap () returned 0xd20000 [0081.805] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0081.805] GetProcessHeap () returned 0xd20000 [0081.805] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0081.805] GetProcessHeap () returned 0xd20000 [0081.805] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0081.805] GetProcessHeap () returned 0xd20000 [0081.805] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0081.805] GetProcessHeap () returned 0xd20000 [0081.805] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0081.805] GetProcessHeap () returned 0xd20000 [0081.805] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0081.805] GetProcessHeap () returned 0xd20000 [0081.805] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0081.805] GetProcessHeap () returned 0xd20000 [0081.805] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0081.805] GetProcessHeap () returned 0xd20000 [0081.805] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0081.806] GetProcessHeap () returned 0xd20000 [0081.806] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0081.806] GetProcessHeap () returned 0xd20000 [0081.806] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0081.806] GetProcessHeap () returned 0xd20000 [0081.806] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0081.806] GetProcessHeap () returned 0xd20000 [0081.806] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0081.806] GetProcessHeap () returned 0xd20000 [0081.806] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0081.806] GetProcessHeap () returned 0xd20000 [0081.806] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0081.806] GetProcessHeap () returned 0xd20000 [0081.806] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0081.806] GetProcessHeap () returned 0xd20000 [0081.806] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0081.806] GetProcessHeap () returned 0xd20000 [0081.806] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0081.806] GetProcessHeap () returned 0xd20000 [0081.806] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0081.807] GetProcessHeap () returned 0xd20000 [0081.807] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0081.807] GetProcessHeap () returned 0xd20000 [0081.807] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0081.807] GetProcessHeap () returned 0xd20000 [0081.807] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0081.807] GetProcessHeap () returned 0xd20000 [0081.807] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0081.807] GetProcessHeap () returned 0xd20000 [0081.807] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0081.807] GetProcessHeap () returned 0xd20000 [0081.807] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0081.807] GetProcessHeap () returned 0xd20000 [0081.807] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0081.807] GetProcessHeap () returned 0xd20000 [0081.807] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0081.807] GetProcessHeap () returned 0xd20000 [0081.807] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0081.807] GetProcessHeap () returned 0xd20000 [0081.808] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0081.808] GetProcessHeap () returned 0xd20000 [0081.808] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0081.808] GetProcessHeap () returned 0xd20000 [0081.808] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0081.808] GetProcessHeap () returned 0xd20000 [0081.808] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0081.808] GetProcessHeap () returned 0xd20000 [0081.808] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0081.808] GetProcessHeap () returned 0xd20000 [0081.808] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0081.808] GetProcessHeap () returned 0xd20000 [0081.809] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0081.809] GetProcessHeap () returned 0xd20000 [0081.809] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0081.809] GetProcessHeap () returned 0xd20000 [0081.809] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0081.809] GetProcessHeap () returned 0xd20000 [0081.809] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0081.809] GetProcessHeap () returned 0xd20000 [0081.809] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0081.809] GetProcessHeap () returned 0xd20000 [0081.809] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0081.809] GetProcessHeap () returned 0xd20000 [0081.809] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0081.809] GetProcessHeap () returned 0xd20000 [0081.809] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0081.810] GetProcessHeap () returned 0xd20000 [0081.810] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0081.810] GetProcessHeap () returned 0xd20000 [0081.810] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0081.810] GetProcessHeap () returned 0xd20000 [0081.810] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0081.810] GetProcessHeap () returned 0xd20000 [0081.810] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0081.810] GetProcessHeap () returned 0xd20000 [0081.810] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0081.810] GetProcessHeap () returned 0xd20000 [0081.810] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0081.810] GetProcessHeap () returned 0xd20000 [0081.810] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0081.810] GetProcessHeap () returned 0xd20000 [0081.810] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0081.810] GetProcessHeap () returned 0xd20000 [0081.810] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0081.810] GetProcessHeap () returned 0xd20000 [0081.810] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0081.810] GetProcessHeap () returned 0xd20000 [0081.811] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0081.811] GetProcessHeap () returned 0xd20000 [0081.811] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0081.811] GetProcessHeap () returned 0xd20000 [0081.811] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0081.811] GetProcessHeap () returned 0xd20000 [0081.811] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0081.811] GetProcessHeap () returned 0xd20000 [0081.811] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0081.811] GetProcessHeap () returned 0xd20000 [0081.811] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0081.811] GetProcessHeap () returned 0xd20000 [0081.811] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0081.811] GetProcessHeap () returned 0xd20000 [0081.811] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0081.811] GetProcessHeap () returned 0xd20000 [0081.811] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0081.811] GetProcessHeap () returned 0xd20000 [0081.811] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0081.811] GetProcessHeap () returned 0xd20000 [0081.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0081.812] GetProcessHeap () returned 0xd20000 [0081.812] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0081.812] GetProcessHeap () returned 0xd20000 [0081.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0081.812] GetProcessHeap () returned 0xd20000 [0081.812] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0081.812] GetProcessHeap () returned 0xd20000 [0081.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0081.812] GetProcessHeap () returned 0xd20000 [0081.812] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0081.812] GetProcessHeap () returned 0xd20000 [0081.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0081.812] GetProcessHeap () returned 0xd20000 [0081.812] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0081.812] GetProcessHeap () returned 0xd20000 [0081.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0081.812] GetProcessHeap () returned 0xd20000 [0081.812] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0081.812] GetProcessHeap () returned 0xd20000 [0081.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0081.812] GetProcessHeap () returned 0xd20000 [0081.813] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0081.813] GetProcessHeap () returned 0xd20000 [0081.813] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0081.813] GetProcessHeap () returned 0xd20000 [0081.813] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0081.813] GetProcessHeap () returned 0xd20000 [0081.813] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0081.813] GetProcessHeap () returned 0xd20000 [0081.813] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0081.813] GetProcessHeap () returned 0xd20000 [0081.813] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0081.813] GetProcessHeap () returned 0xd20000 [0081.813] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0081.813] GetProcessHeap () returned 0xd20000 [0081.813] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0081.813] GetProcessHeap () returned 0xd20000 [0081.813] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0081.813] GetProcessHeap () returned 0xd20000 [0081.813] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0081.813] GetProcessHeap () returned 0xd20000 [0081.813] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0081.814] GetProcessHeap () returned 0xd20000 [0081.814] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0081.814] GetProcessHeap () returned 0xd20000 [0081.814] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0081.814] GetProcessHeap () returned 0xd20000 [0081.814] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0081.814] GetProcessHeap () returned 0xd20000 [0081.814] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0081.814] GetProcessHeap () returned 0xd20000 [0081.814] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0081.814] GetProcessHeap () returned 0xd20000 [0081.814] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0081.814] GetProcessHeap () returned 0xd20000 [0081.814] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0081.814] GetProcessHeap () returned 0xd20000 [0081.814] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0081.814] GetProcessHeap () returned 0xd20000 [0081.814] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0081.814] GetProcessHeap () returned 0xd20000 [0081.814] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0081.815] GetProcessHeap () returned 0xd20000 [0081.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0081.815] GetProcessHeap () returned 0xd20000 [0081.815] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0081.815] GetProcessHeap () returned 0xd20000 [0081.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0081.815] GetProcessHeap () returned 0xd20000 [0081.815] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0081.815] GetProcessHeap () returned 0xd20000 [0081.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0081.815] GetProcessHeap () returned 0xd20000 [0081.815] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0081.815] GetProcessHeap () returned 0xd20000 [0081.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0081.815] GetProcessHeap () returned 0xd20000 [0081.815] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0081.815] GetProcessHeap () returned 0xd20000 [0081.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0081.815] GetProcessHeap () returned 0xd20000 [0081.815] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0081.816] GetProcessHeap () returned 0xd20000 [0081.816] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0081.816] GetProcessHeap () returned 0xd20000 [0081.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0081.816] GetProcessHeap () returned 0xd20000 [0081.816] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0081.816] GetProcessHeap () returned 0xd20000 [0081.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0081.816] GetProcessHeap () returned 0xd20000 [0081.816] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0081.816] GetProcessHeap () returned 0xd20000 [0081.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0081.816] GetProcessHeap () returned 0xd20000 [0081.816] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0081.816] GetProcessHeap () returned 0xd20000 [0081.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0081.816] GetProcessHeap () returned 0xd20000 [0081.816] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0081.816] GetProcessHeap () returned 0xd20000 [0081.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0081.816] GetProcessHeap () returned 0xd20000 [0081.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0081.817] GetProcessHeap () returned 0xd20000 [0081.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0081.817] GetProcessHeap () returned 0xd20000 [0081.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0081.817] GetProcessHeap () returned 0xd20000 [0081.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0081.817] GetProcessHeap () returned 0xd20000 [0081.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0081.817] GetProcessHeap () returned 0xd20000 [0081.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0081.817] GetProcessHeap () returned 0xd20000 [0081.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0081.817] GetProcessHeap () returned 0xd20000 [0081.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0081.817] GetProcessHeap () returned 0xd20000 [0081.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0081.817] GetProcessHeap () returned 0xd20000 [0081.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0081.817] GetProcessHeap () returned 0xd20000 [0081.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0081.817] GetProcessHeap () returned 0xd20000 [0081.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0081.818] GetProcessHeap () returned 0xd20000 [0081.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0081.818] GetProcessHeap () returned 0xd20000 [0081.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0081.818] GetProcessHeap () returned 0xd20000 [0081.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444c8 | out: hHeap=0xd20000) returned 1 [0081.818] GetProcessHeap () returned 0xd20000 [0081.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b6c8 | out: hHeap=0xd20000) returned 1 [0081.818] GetProcessHeap () returned 0xd20000 [0081.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0081.818] GetProcessHeap () returned 0xd20000 [0081.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aee8 | out: hHeap=0xd20000) returned 1 [0081.818] GetProcessHeap () returned 0xd20000 [0081.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0081.818] GetProcessHeap () returned 0xd20000 [0081.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0081.818] GetProcessHeap () returned 0xd20000 [0081.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0081.818] WriteFile (in: hFile=0x230, lpBuffer=0xd4b9d0*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4b9d0*, lpNumberOfBytesWritten=0x299d864*=0x388, lpOverlapped=0x0) returned 1 [0081.907] GetProcessHeap () returned 0xd20000 [0081.907] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4b9d0, Size=0x30) returned 0xd4b9d0 [0081.907] GetProcessHeap () returned 0xd20000 [0081.907] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0081.907] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0081.907] GetProcessHeap () returned 0xd20000 [0081.907] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x159ad0) returned 0x2d5c020 [0081.936] ReadFile (in: hFile=0x230, lpBuffer=0x2d5c020, nNumberOfBytesToRead=0x159ad0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x2d5c020*, lpNumberOfBytesRead=0x299d7e8*=0x159ad0, lpOverlapped=0x0) returned 1 [0082.639] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0082.639] WriteFile (in: hFile=0x230, lpBuffer=0x2d5c020*, nNumberOfBytesToWrite=0x159ad0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0x2d5c020*, lpNumberOfBytesWritten=0x299d7e4*=0x159ad0, lpOverlapped=0x0) returned 1 [0083.221] GetProcessHeap () returned 0xd20000 [0083.221] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0x2d5c020 | out: hHeap=0xd20000) returned 1 [0083.222] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0083.222] WriteFile (in: hFile=0x230, lpBuffer=0xd4b9d0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4b9d0*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0083.225] CloseHandle (hObject=0x230) returned 1 [0083.476] GetProcessHeap () returned 0xd20000 [0083.477] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd426c0 | out: hHeap=0xd20000) returned 1 [0083.477] GetProcessHeap () returned 0xd20000 [0083.477] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2e898 | out: hHeap=0xd20000) returned 1 [0083.477] GetProcessHeap () returned 0xd20000 [0083.477] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0083.477] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe" | out: lpString1="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe") returned="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe" [0083.477] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe.[ponce.lorena@aol.com]" [0083.477] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe" (normalized: "c:\\windows10upgrade\\windows10upgraderapp.exe"), lpNewFileName="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\windows10upgraderapp.exe.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0083.480] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\Windows10UpgraderApp.exe" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0083.480] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0083.481] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\HOW_RECOVER.html" [0083.481] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\how_recover.html")) returned 0x20 [0083.481] GetProcessHeap () returned 0xd20000 [0083.481] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42620 | out: hHeap=0xd20000) returned 1 [0083.481] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea64ee41, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea64ee41, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x62c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WinREBootApp32.exe", cAlternateFileName="WINREB~1.EXE")) returned 1 [0083.481] lstrcmpiW (lpString1="WinREBootApp32.exe", lpString2=".") returned 1 [0083.481] lstrcmpiW (lpString1="WinREBootApp32.exe", lpString2="..") returned 1 [0083.481] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="WinREBootApp32.exe" | out: lpString1="C:\\Windows10Upgrade\\WinREBootApp32.exe") returned="C:\\Windows10Upgrade\\WinREBootApp32.exe" [0083.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WinREBootApp32.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0083.481] GetProcessHeap () returned 0xd20000 [0083.481] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x13) returned 0xd36648 [0083.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WinREBootApp32.exe", cchWideChar=-1, lpMultiByteStr=0xd36648, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WinREBootApp32.exe", lpUsedDefaultChar=0x0) returned 19 [0083.481] lstrlenA (lpString="WinREBootApp32.exe") returned 18 [0083.482] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0083.482] lstrlenA (lpString="WinREBootApp32.exe") returned 18 [0083.482] lstrlenA (lpString=".dll") returned 4 [0083.482] lstrlenA (lpString=".dll") returned 4 [0083.482] lstrlenA (lpString="WinREBootApp32.exe") returned 18 [0083.482] lstrcmpiA (lpString1=".exe", lpString2=".dll") returned 1 [0083.482] lstrlenA (lpString="WinREBootApp32.exe") returned 18 [0083.482] lstrlenA (lpString=".ini") returned 4 [0083.482] lstrlenA (lpString=".ini") returned 4 [0083.482] lstrlenA (lpString="WinREBootApp32.exe") returned 18 [0083.482] lstrcmpiA (lpString1=".exe", lpString2=".ini") returned -1 [0083.482] lstrlenA (lpString="WinREBootApp32.exe") returned 18 [0083.482] lstrlenA (lpString=".inc") returned 4 [0083.482] lstrlenA (lpString=".inc") returned 4 [0083.482] lstrlenA (lpString="WinREBootApp32.exe") returned 18 [0083.482] lstrcmpiA (lpString1=".exe", lpString2=".inc") returned -1 [0083.482] lstrcmpiW (lpString1="WinREBootApp32.exe", lpString2="HOW_RECOVER.html") returned 1 [0083.482] lstrcmpiW (lpString1="WinREBootApp32.exe", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0083.482] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0083.483] lstrcmpiW (lpString1="WinREBootApp32.exe", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0083.483] GetProcessHeap () returned 0xd20000 [0083.483] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42620 [0083.483] CreateFileW (lpFileName="C:\\Windows10Upgrade\\WinREBootApp32.exe" (normalized: "c:\\windows10upgrade\\winrebootapp32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0083.483] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=25288) returned 1 [0083.484] GetProcessHeap () returned 0xd20000 [0083.484] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd2e898 [0083.484] GetProcessHeap () returned 0xd20000 [0083.484] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0083.484] lstrlenW (lpString="C:\\Windows10Upgrade\\WinREBootApp32.exe") returned 38 [0083.484] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0083.484] GetProcessHeap () returned 0xd20000 [0083.484] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0083.484] GetProcessHeap () returned 0xd20000 [0083.484] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4ba08 [0083.484] lstrlenA (lpString="rsa_encrypt") returned 11 [0083.484] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0083.487] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0083.487] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0083.487] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0083.487] GetProcessHeap () returned 0xd20000 [0083.487] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0083.487] lstrlenA (lpString="010001") returned 6 [0083.487] GetProcessHeap () returned 0xd20000 [0083.487] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd18 [0083.487] GetProcessHeap () returned 0xd20000 [0083.487] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0083.487] GetProcessHeap () returned 0xd20000 [0083.487] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b098 [0083.487] GetProcessHeap () returned 0xd20000 [0083.487] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0083.488] GetProcessHeap () returned 0xd20000 [0083.488] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b7e8 [0083.488] GetProcessHeap () returned 0xd20000 [0083.488] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45640 [0083.488] GetProcessHeap () returned 0xd20000 [0083.488] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd98 [0083.488] GetProcessHeap () returned 0xd20000 [0083.488] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0083.488] GetProcessHeap () returned 0xd20000 [0083.488] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0083.488] GetProcessHeap () returned 0xd20000 [0083.488] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44c68 [0083.488] GetProcessHeap () returned 0xd20000 [0083.488] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0083.488] GetProcessHeap () returned 0xd20000 [0083.488] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44808 [0083.488] GetProcessHeap () returned 0xd20000 [0083.488] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0083.488] GetProcessHeap () returned 0xd20000 [0083.488] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446d8 [0083.488] GetProcessHeap () returned 0xd20000 [0083.488] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b1b8 [0083.489] GetProcessHeap () returned 0xd20000 [0083.489] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0083.489] GetProcessHeap () returned 0xd20000 [0083.489] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0083.489] GetProcessHeap () returned 0xd20000 [0083.489] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b1b8 | out: hHeap=0xd20000) returned 1 [0083.489] GetProcessHeap () returned 0xd20000 [0083.489] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0083.489] GetProcessHeap () returned 0xd20000 [0083.489] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44498 [0083.489] GetProcessHeap () returned 0xd20000 [0083.489] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0083.489] GetProcessHeap () returned 0xd20000 [0083.489] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0083.489] GetProcessHeap () returned 0xd20000 [0083.489] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.489] GetProcessHeap () returned 0xd20000 [0083.489] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.490] GetProcessHeap () returned 0xd20000 [0083.490] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0083.490] GetProcessHeap () returned 0xd20000 [0083.490] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0083.490] GetProcessHeap () returned 0xd20000 [0083.490] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b638 [0083.490] GetProcessHeap () returned 0xd20000 [0083.490] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44498 | out: hHeap=0xd20000) returned 1 [0083.490] GetProcessHeap () returned 0xd20000 [0083.490] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0083.490] GetProcessHeap () returned 0xd20000 [0083.490] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b638 | out: hHeap=0xd20000) returned 1 [0083.490] GetProcessHeap () returned 0xd20000 [0083.490] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0083.490] GetProcessHeap () returned 0xd20000 [0083.490] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0083.490] GetProcessHeap () returned 0xd20000 [0083.490] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.490] GetProcessHeap () returned 0xd20000 [0083.490] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.490] GetProcessHeap () returned 0xd20000 [0083.491] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.491] GetProcessHeap () returned 0xd20000 [0083.491] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.491] GetProcessHeap () returned 0xd20000 [0083.491] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.491] GetProcessHeap () returned 0xd20000 [0083.491] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.491] GetProcessHeap () returned 0xd20000 [0083.491] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0083.491] GetProcessHeap () returned 0xd20000 [0083.491] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0083.491] GetProcessHeap () returned 0xd20000 [0083.491] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0083.491] GetProcessHeap () returned 0xd20000 [0083.491] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0083.491] GetProcessHeap () returned 0xd20000 [0083.491] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.491] GetProcessHeap () returned 0xd20000 [0083.491] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.492] GetProcessHeap () returned 0xd20000 [0083.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.492] GetProcessHeap () returned 0xd20000 [0083.492] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.492] GetProcessHeap () returned 0xd20000 [0083.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0083.492] GetProcessHeap () returned 0xd20000 [0083.492] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0083.492] GetProcessHeap () returned 0xd20000 [0083.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0083.492] GetProcessHeap () returned 0xd20000 [0083.492] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0083.492] GetProcessHeap () returned 0xd20000 [0083.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0083.492] GetProcessHeap () returned 0xd20000 [0083.492] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0083.492] GetProcessHeap () returned 0xd20000 [0083.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.492] GetProcessHeap () returned 0xd20000 [0083.492] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.493] GetProcessHeap () returned 0xd20000 [0083.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0083.493] GetProcessHeap () returned 0xd20000 [0083.493] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0083.493] GetProcessHeap () returned 0xd20000 [0083.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0083.493] GetProcessHeap () returned 0xd20000 [0083.493] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0083.493] GetProcessHeap () returned 0xd20000 [0083.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.493] GetProcessHeap () returned 0xd20000 [0083.493] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.493] GetProcessHeap () returned 0xd20000 [0083.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0083.493] GetProcessHeap () returned 0xd20000 [0083.493] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0083.493] GetProcessHeap () returned 0xd20000 [0083.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0083.494] GetProcessHeap () returned 0xd20000 [0083.494] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0083.494] GetProcessHeap () returned 0xd20000 [0083.494] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.494] GetProcessHeap () returned 0xd20000 [0083.494] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.494] GetProcessHeap () returned 0xd20000 [0083.494] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0083.494] GetProcessHeap () returned 0xd20000 [0083.494] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0083.494] GetProcessHeap () returned 0xd20000 [0083.494] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0083.494] GetProcessHeap () returned 0xd20000 [0083.494] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0083.494] GetProcessHeap () returned 0xd20000 [0083.494] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0083.494] GetProcessHeap () returned 0xd20000 [0083.495] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0083.495] GetProcessHeap () returned 0xd20000 [0083.495] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.495] GetProcessHeap () returned 0xd20000 [0083.495] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.495] GetProcessHeap () returned 0xd20000 [0083.495] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0083.495] GetProcessHeap () returned 0xd20000 [0083.495] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0083.495] GetProcessHeap () returned 0xd20000 [0083.495] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.496] GetProcessHeap () returned 0xd20000 [0083.496] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.496] GetProcessHeap () returned 0xd20000 [0083.496] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0083.496] GetProcessHeap () returned 0xd20000 [0083.496] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0083.497] GetProcessHeap () returned 0xd20000 [0083.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0083.497] GetProcessHeap () returned 0xd20000 [0083.497] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0083.497] GetProcessHeap () returned 0xd20000 [0083.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0083.497] GetProcessHeap () returned 0xd20000 [0083.497] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0083.497] GetProcessHeap () returned 0xd20000 [0083.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0083.497] GetProcessHeap () returned 0xd20000 [0083.497] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0083.497] GetProcessHeap () returned 0xd20000 [0083.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.497] GetProcessHeap () returned 0xd20000 [0083.497] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.497] GetProcessHeap () returned 0xd20000 [0083.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0083.497] GetProcessHeap () returned 0xd20000 [0083.497] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0083.498] GetProcessHeap () returned 0xd20000 [0083.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0083.498] GetProcessHeap () returned 0xd20000 [0083.498] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0083.498] GetProcessHeap () returned 0xd20000 [0083.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.498] GetProcessHeap () returned 0xd20000 [0083.498] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.498] GetProcessHeap () returned 0xd20000 [0083.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0083.498] GetProcessHeap () returned 0xd20000 [0083.498] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0083.498] GetProcessHeap () returned 0xd20000 [0083.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.498] GetProcessHeap () returned 0xd20000 [0083.498] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.498] GetProcessHeap () returned 0xd20000 [0083.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0083.498] GetProcessHeap () returned 0xd20000 [0083.498] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0083.499] GetProcessHeap () returned 0xd20000 [0083.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.499] GetProcessHeap () returned 0xd20000 [0083.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.499] GetProcessHeap () returned 0xd20000 [0083.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.499] GetProcessHeap () returned 0xd20000 [0083.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.499] GetProcessHeap () returned 0xd20000 [0083.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.499] GetProcessHeap () returned 0xd20000 [0083.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.499] GetProcessHeap () returned 0xd20000 [0083.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.499] GetProcessHeap () returned 0xd20000 [0083.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.499] GetProcessHeap () returned 0xd20000 [0083.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.499] GetProcessHeap () returned 0xd20000 [0083.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.500] GetProcessHeap () returned 0xd20000 [0083.500] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.500] GetProcessHeap () returned 0xd20000 [0083.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.500] GetProcessHeap () returned 0xd20000 [0083.500] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.500] GetProcessHeap () returned 0xd20000 [0083.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.500] GetProcessHeap () returned 0xd20000 [0083.500] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0083.500] GetProcessHeap () returned 0xd20000 [0083.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0083.500] GetProcessHeap () returned 0xd20000 [0083.500] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.500] GetProcessHeap () returned 0xd20000 [0083.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.500] GetProcessHeap () returned 0xd20000 [0083.500] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.501] GetProcessHeap () returned 0xd20000 [0083.501] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.501] GetProcessHeap () returned 0xd20000 [0083.501] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0083.501] GetProcessHeap () returned 0xd20000 [0083.501] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0083.501] GetProcessHeap () returned 0xd20000 [0083.501] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0083.501] GetProcessHeap () returned 0xd20000 [0083.501] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0083.501] GetProcessHeap () returned 0xd20000 [0083.501] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0083.501] GetProcessHeap () returned 0xd20000 [0083.501] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0083.501] GetProcessHeap () returned 0xd20000 [0083.501] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0083.501] GetProcessHeap () returned 0xd20000 [0083.501] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0083.502] GetProcessHeap () returned 0xd20000 [0083.502] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.502] GetProcessHeap () returned 0xd20000 [0083.502] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.502] GetProcessHeap () returned 0xd20000 [0083.502] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.502] GetProcessHeap () returned 0xd20000 [0083.502] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.502] GetProcessHeap () returned 0xd20000 [0083.502] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.502] GetProcessHeap () returned 0xd20000 [0083.502] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.502] GetProcessHeap () returned 0xd20000 [0083.502] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0083.502] GetProcessHeap () returned 0xd20000 [0083.502] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0083.502] GetProcessHeap () returned 0xd20000 [0083.502] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0083.502] GetProcessHeap () returned 0xd20000 [0083.502] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0083.503] GetProcessHeap () returned 0xd20000 [0083.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0083.503] GetProcessHeap () returned 0xd20000 [0083.503] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0083.503] GetProcessHeap () returned 0xd20000 [0083.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0083.503] GetProcessHeap () returned 0xd20000 [0083.503] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0083.503] GetProcessHeap () returned 0xd20000 [0083.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0083.503] GetProcessHeap () returned 0xd20000 [0083.503] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0083.503] GetProcessHeap () returned 0xd20000 [0083.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.503] GetProcessHeap () returned 0xd20000 [0083.503] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.503] GetProcessHeap () returned 0xd20000 [0083.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.503] GetProcessHeap () returned 0xd20000 [0083.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.504] GetProcessHeap () returned 0xd20000 [0083.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.504] GetProcessHeap () returned 0xd20000 [0083.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.504] GetProcessHeap () returned 0xd20000 [0083.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.504] GetProcessHeap () returned 0xd20000 [0083.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.504] GetProcessHeap () returned 0xd20000 [0083.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0083.504] GetProcessHeap () returned 0xd20000 [0083.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0083.504] GetProcessHeap () returned 0xd20000 [0083.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0083.504] GetProcessHeap () returned 0xd20000 [0083.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0083.504] GetProcessHeap () returned 0xd20000 [0083.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0083.504] GetProcessHeap () returned 0xd20000 [0083.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0083.505] GetProcessHeap () returned 0xd20000 [0083.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.505] GetProcessHeap () returned 0xd20000 [0083.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.505] GetProcessHeap () returned 0xd20000 [0083.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0083.505] GetProcessHeap () returned 0xd20000 [0083.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0083.505] GetProcessHeap () returned 0xd20000 [0083.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0083.505] GetProcessHeap () returned 0xd20000 [0083.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0083.505] GetProcessHeap () returned 0xd20000 [0083.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0083.505] GetProcessHeap () returned 0xd20000 [0083.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0083.505] GetProcessHeap () returned 0xd20000 [0083.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0083.505] GetProcessHeap () returned 0xd20000 [0083.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0083.506] GetProcessHeap () returned 0xd20000 [0083.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.506] GetProcessHeap () returned 0xd20000 [0083.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.506] GetProcessHeap () returned 0xd20000 [0083.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0083.506] GetProcessHeap () returned 0xd20000 [0083.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0083.506] GetProcessHeap () returned 0xd20000 [0083.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0083.506] GetProcessHeap () returned 0xd20000 [0083.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0083.506] GetProcessHeap () returned 0xd20000 [0083.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.506] GetProcessHeap () returned 0xd20000 [0083.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.506] GetProcessHeap () returned 0xd20000 [0083.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.507] GetProcessHeap () returned 0xd20000 [0083.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.507] GetProcessHeap () returned 0xd20000 [0083.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.507] GetProcessHeap () returned 0xd20000 [0083.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.507] GetProcessHeap () returned 0xd20000 [0083.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0083.507] GetProcessHeap () returned 0xd20000 [0083.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0083.507] GetProcessHeap () returned 0xd20000 [0083.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0083.507] GetProcessHeap () returned 0xd20000 [0083.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0083.507] GetProcessHeap () returned 0xd20000 [0083.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0083.507] GetProcessHeap () returned 0xd20000 [0083.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0083.507] GetProcessHeap () returned 0xd20000 [0083.508] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.508] GetProcessHeap () returned 0xd20000 [0083.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.508] GetProcessHeap () returned 0xd20000 [0083.508] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0083.508] GetProcessHeap () returned 0xd20000 [0083.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0083.508] GetProcessHeap () returned 0xd20000 [0083.508] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0083.508] GetProcessHeap () returned 0xd20000 [0083.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0083.508] GetProcessHeap () returned 0xd20000 [0083.508] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.508] GetProcessHeap () returned 0xd20000 [0083.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.508] GetProcessHeap () returned 0xd20000 [0083.508] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0083.508] GetProcessHeap () returned 0xd20000 [0083.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0083.509] GetProcessHeap () returned 0xd20000 [0083.509] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.509] GetProcessHeap () returned 0xd20000 [0083.509] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.509] GetProcessHeap () returned 0xd20000 [0083.509] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0083.509] GetProcessHeap () returned 0xd20000 [0083.509] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0083.509] GetProcessHeap () returned 0xd20000 [0083.509] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0083.509] GetProcessHeap () returned 0xd20000 [0083.509] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0083.509] GetProcessHeap () returned 0xd20000 [0083.509] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0083.509] GetProcessHeap () returned 0xd20000 [0083.509] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0083.509] GetProcessHeap () returned 0xd20000 [0083.509] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446d8 | out: hHeap=0xd20000) returned 1 [0083.509] GetProcessHeap () returned 0xd20000 [0083.509] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0083.510] GetProcessHeap () returned 0xd20000 [0083.510] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0083.510] GetProcessHeap () returned 0xd20000 [0083.510] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b098 | out: hHeap=0xd20000) returned 1 [0083.510] GetProcessHeap () returned 0xd20000 [0083.510] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0083.510] GetProcessHeap () returned 0xd20000 [0083.510] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0083.510] GetProcessHeap () returned 0xd20000 [0083.510] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0083.510] WriteFile (in: hFile=0x230, lpBuffer=0xd4ba08*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ba08*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0083.676] GetProcessHeap () returned 0xd20000 [0083.677] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4ba08, Size=0x30) returned 0xd4ba08 [0083.677] GetProcessHeap () returned 0xd20000 [0083.677] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0083.677] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0083.677] GetProcessHeap () returned 0xd20000 [0083.677] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x62c8) returned 0xd4ba40 [0083.677] ReadFile (in: hFile=0x230, lpBuffer=0xd4ba40, nNumberOfBytesToRead=0x62c8, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4ba40*, lpNumberOfBytesRead=0x299d7e8*=0x62c8, lpOverlapped=0x0) returned 1 [0083.679] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0083.679] WriteFile (in: hFile=0x230, lpBuffer=0xd4ba40*, nNumberOfBytesToWrite=0x62c8, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4ba40*, lpNumberOfBytesWritten=0x299d7e4*=0x62c8, lpOverlapped=0x0) returned 1 [0083.757] GetProcessHeap () returned 0xd20000 [0083.757] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ba40 | out: hHeap=0xd20000) returned 1 [0083.757] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0083.757] WriteFile (in: hFile=0x230, lpBuffer=0xd4ba08*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ba08*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0083.759] CloseHandle (hObject=0x230) returned 1 [0083.762] GetProcessHeap () returned 0xd20000 [0083.762] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42620 | out: hHeap=0xd20000) returned 1 [0083.762] GetProcessHeap () returned 0xd20000 [0083.762] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2e898 | out: hHeap=0xd20000) returned 1 [0083.762] GetProcessHeap () returned 0xd20000 [0083.762] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0083.763] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\WinREBootApp32.exe" | out: lpString1="C:\\Windows10Upgrade\\WinREBootApp32.exe") returned="C:\\Windows10Upgrade\\WinREBootApp32.exe" [0083.763] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\WinREBootApp32.exe", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\WinREBootApp32.exe.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\WinREBootApp32.exe.[ponce.lorena@aol.com]" [0083.763] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\WinREBootApp32.exe" (normalized: "c:\\windows10upgrade\\winrebootapp32.exe"), lpNewFileName="C:\\Windows10Upgrade\\WinREBootApp32.exe.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\winrebootapp32.exe.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0083.764] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\WinREBootApp32.exe" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0083.764] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0083.764] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\HOW_RECOVER.html" [0083.764] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\how_recover.html")) returned 0x20 [0083.764] GetProcessHeap () returned 0xd20000 [0083.764] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36648 | out: hHeap=0xd20000) returned 1 [0083.764] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6528e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6528e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x64c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WinREBootApp64.exe", cAlternateFileName="WINREB~2.EXE")) returned 1 [0083.764] lstrcmpiW (lpString1="WinREBootApp64.exe", lpString2=".") returned 1 [0083.764] lstrcmpiW (lpString1="WinREBootApp64.exe", lpString2="..") returned 1 [0083.764] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="WinREBootApp64.exe" | out: lpString1="C:\\Windows10Upgrade\\WinREBootApp64.exe") returned="C:\\Windows10Upgrade\\WinREBootApp64.exe" [0083.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WinREBootApp64.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0083.764] GetProcessHeap () returned 0xd20000 [0083.764] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x13) returned 0xd36568 [0083.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WinREBootApp64.exe", cchWideChar=-1, lpMultiByteStr=0xd36568, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WinREBootApp64.exe", lpUsedDefaultChar=0x0) returned 19 [0083.764] lstrlenA (lpString="WinREBootApp64.exe") returned 18 [0083.765] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0083.765] lstrlenA (lpString="WinREBootApp64.exe") returned 18 [0083.765] lstrlenA (lpString=".dll") returned 4 [0083.765] lstrlenA (lpString=".dll") returned 4 [0083.765] lstrlenA (lpString="WinREBootApp64.exe") returned 18 [0083.765] lstrcmpiA (lpString1=".exe", lpString2=".dll") returned 1 [0083.765] lstrlenA (lpString="WinREBootApp64.exe") returned 18 [0083.765] lstrlenA (lpString=".ini") returned 4 [0083.765] lstrlenA (lpString=".ini") returned 4 [0083.765] lstrlenA (lpString="WinREBootApp64.exe") returned 18 [0083.765] lstrcmpiA (lpString1=".exe", lpString2=".ini") returned -1 [0083.765] lstrlenA (lpString="WinREBootApp64.exe") returned 18 [0083.765] lstrlenA (lpString=".inc") returned 4 [0083.765] lstrlenA (lpString=".inc") returned 4 [0083.765] lstrlenA (lpString="WinREBootApp64.exe") returned 18 [0083.765] lstrcmpiA (lpString1=".exe", lpString2=".inc") returned -1 [0083.765] lstrcmpiW (lpString1="WinREBootApp64.exe", lpString2="HOW_RECOVER.html") returned 1 [0083.765] lstrcmpiW (lpString1="WinREBootApp64.exe", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0083.766] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0083.766] lstrcmpiW (lpString1="WinREBootApp64.exe", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0083.766] GetProcessHeap () returned 0xd20000 [0083.766] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd426c0 [0083.766] CreateFileW (lpFileName="C:\\Windows10Upgrade\\WinREBootApp64.exe" (normalized: "c:\\windows10upgrade\\winrebootapp64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0083.766] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=25800) returned 1 [0083.766] GetProcessHeap () returned 0xd20000 [0083.766] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd2e898 [0083.767] GetProcessHeap () returned 0xd20000 [0083.767] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0083.767] lstrlenW (lpString="C:\\Windows10Upgrade\\WinREBootApp64.exe") returned 38 [0083.767] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0083.767] GetProcessHeap () returned 0xd20000 [0083.767] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0083.767] GetProcessHeap () returned 0xd20000 [0083.767] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4ba40 [0083.767] lstrlenA (lpString="rsa_encrypt") returned 11 [0083.767] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0083.769] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0083.770] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0083.770] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0083.770] GetProcessHeap () returned 0xd20000 [0083.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0083.770] lstrlenA (lpString="010001") returned 6 [0083.770] GetProcessHeap () returned 0xd20000 [0083.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cbe8 [0083.770] GetProcessHeap () returned 0xd20000 [0083.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0083.770] GetProcessHeap () returned 0xd20000 [0083.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4adc8 [0083.770] GetProcessHeap () returned 0xd20000 [0083.770] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0083.770] GetProcessHeap () returned 0xd20000 [0083.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b878 [0083.770] GetProcessHeap () returned 0xd20000 [0083.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44920 [0083.771] GetProcessHeap () returned 0xd20000 [0083.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd18 [0083.771] GetProcessHeap () returned 0xd20000 [0083.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0083.771] GetProcessHeap () returned 0xd20000 [0083.771] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0083.771] GetProcessHeap () returned 0xd20000 [0083.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0083.771] GetProcessHeap () returned 0xd20000 [0083.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0083.771] GetProcessHeap () returned 0xd20000 [0083.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44d80 [0083.771] GetProcessHeap () returned 0xd20000 [0083.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.771] GetProcessHeap () returned 0xd20000 [0083.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44600 [0083.771] GetProcessHeap () returned 0xd20000 [0083.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b758 [0083.772] GetProcessHeap () returned 0xd20000 [0083.772] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0083.772] GetProcessHeap () returned 0xd20000 [0083.772] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0083.772] GetProcessHeap () returned 0xd20000 [0083.772] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b758 | out: hHeap=0xd20000) returned 1 [0083.772] GetProcessHeap () returned 0xd20000 [0083.772] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0083.772] GetProcessHeap () returned 0xd20000 [0083.772] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446c0 [0083.772] GetProcessHeap () returned 0xd20000 [0083.772] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.772] GetProcessHeap () returned 0xd20000 [0083.772] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0083.772] GetProcessHeap () returned 0xd20000 [0083.772] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0083.772] GetProcessHeap () returned 0xd20000 [0083.772] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0083.772] GetProcessHeap () returned 0xd20000 [0083.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0083.773] GetProcessHeap () returned 0xd20000 [0083.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0083.773] GetProcessHeap () returned 0xd20000 [0083.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b098 [0083.773] GetProcessHeap () returned 0xd20000 [0083.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446c0 | out: hHeap=0xd20000) returned 1 [0083.773] GetProcessHeap () returned 0xd20000 [0083.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0083.773] GetProcessHeap () returned 0xd20000 [0083.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b098 | out: hHeap=0xd20000) returned 1 [0083.773] GetProcessHeap () returned 0xd20000 [0083.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0083.773] GetProcessHeap () returned 0xd20000 [0083.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0083.773] GetProcessHeap () returned 0xd20000 [0083.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0083.773] GetProcessHeap () returned 0xd20000 [0083.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0083.774] GetProcessHeap () returned 0xd20000 [0083.774] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0083.774] GetProcessHeap () returned 0xd20000 [0083.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0083.774] GetProcessHeap () returned 0xd20000 [0083.774] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0083.774] GetProcessHeap () returned 0xd20000 [0083.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0083.774] GetProcessHeap () returned 0xd20000 [0083.774] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0083.774] GetProcessHeap () returned 0xd20000 [0083.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0083.774] GetProcessHeap () returned 0xd20000 [0083.774] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0083.774] GetProcessHeap () returned 0xd20000 [0083.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0083.774] GetProcessHeap () returned 0xd20000 [0083.774] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0083.775] GetProcessHeap () returned 0xd20000 [0083.775] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0083.775] GetProcessHeap () returned 0xd20000 [0083.775] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0083.775] GetProcessHeap () returned 0xd20000 [0083.775] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0083.775] GetProcessHeap () returned 0xd20000 [0083.775] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0083.775] GetProcessHeap () returned 0xd20000 [0083.775] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0083.775] GetProcessHeap () returned 0xd20000 [0083.775] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0083.775] GetProcessHeap () returned 0xd20000 [0083.775] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0083.775] GetProcessHeap () returned 0xd20000 [0083.775] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0083.775] GetProcessHeap () returned 0xd20000 [0083.775] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0083.776] GetProcessHeap () returned 0xd20000 [0083.776] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0083.776] GetProcessHeap () returned 0xd20000 [0083.776] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0083.776] GetProcessHeap () returned 0xd20000 [0083.776] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0083.776] GetProcessHeap () returned 0xd20000 [0083.776] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0083.776] GetProcessHeap () returned 0xd20000 [0083.776] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0083.776] GetProcessHeap () returned 0xd20000 [0083.776] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0083.776] GetProcessHeap () returned 0xd20000 [0083.776] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0083.776] GetProcessHeap () returned 0xd20000 [0083.776] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0083.776] GetProcessHeap () returned 0xd20000 [0083.777] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0083.777] GetProcessHeap () returned 0xd20000 [0083.777] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0083.778] GetProcessHeap () returned 0xd20000 [0083.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.778] GetProcessHeap () returned 0xd20000 [0083.778] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.778] GetProcessHeap () returned 0xd20000 [0083.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0083.778] GetProcessHeap () returned 0xd20000 [0083.778] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0083.778] GetProcessHeap () returned 0xd20000 [0083.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.778] GetProcessHeap () returned 0xd20000 [0083.778] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.778] GetProcessHeap () returned 0xd20000 [0083.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.778] GetProcessHeap () returned 0xd20000 [0083.778] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.778] GetProcessHeap () returned 0xd20000 [0083.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0083.778] GetProcessHeap () returned 0xd20000 [0083.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0083.779] GetProcessHeap () returned 0xd20000 [0083.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0083.779] GetProcessHeap () returned 0xd20000 [0083.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0083.779] GetProcessHeap () returned 0xd20000 [0083.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0083.779] GetProcessHeap () returned 0xd20000 [0083.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0083.779] GetProcessHeap () returned 0xd20000 [0083.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0083.779] GetProcessHeap () returned 0xd20000 [0083.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0083.779] GetProcessHeap () returned 0xd20000 [0083.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0083.779] GetProcessHeap () returned 0xd20000 [0083.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0083.779] GetProcessHeap () returned 0xd20000 [0083.780] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0083.780] GetProcessHeap () returned 0xd20000 [0083.780] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0083.780] GetProcessHeap () returned 0xd20000 [0083.780] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0083.780] GetProcessHeap () returned 0xd20000 [0083.780] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0083.780] GetProcessHeap () returned 0xd20000 [0083.780] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0083.780] GetProcessHeap () returned 0xd20000 [0083.780] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0083.780] GetProcessHeap () returned 0xd20000 [0083.780] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0083.780] GetProcessHeap () returned 0xd20000 [0083.780] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0083.780] GetProcessHeap () returned 0xd20000 [0083.780] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0083.780] GetProcessHeap () returned 0xd20000 [0083.781] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0083.781] GetProcessHeap () returned 0xd20000 [0083.781] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0083.781] GetProcessHeap () returned 0xd20000 [0083.781] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0083.781] GetProcessHeap () returned 0xd20000 [0083.781] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0083.781] GetProcessHeap () returned 0xd20000 [0083.781] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0083.781] GetProcessHeap () returned 0xd20000 [0083.781] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0083.781] GetProcessHeap () returned 0xd20000 [0083.781] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0083.781] GetProcessHeap () returned 0xd20000 [0083.781] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0083.781] GetProcessHeap () returned 0xd20000 [0083.781] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0083.781] GetProcessHeap () returned 0xd20000 [0083.782] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0083.782] GetProcessHeap () returned 0xd20000 [0083.782] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0083.782] GetProcessHeap () returned 0xd20000 [0083.782] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0083.782] GetProcessHeap () returned 0xd20000 [0083.782] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0083.782] GetProcessHeap () returned 0xd20000 [0083.782] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0083.782] GetProcessHeap () returned 0xd20000 [0083.782] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0083.782] GetProcessHeap () returned 0xd20000 [0083.782] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0083.782] GetProcessHeap () returned 0xd20000 [0083.782] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0083.782] GetProcessHeap () returned 0xd20000 [0083.782] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0083.782] GetProcessHeap () returned 0xd20000 [0083.782] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0083.783] GetProcessHeap () returned 0xd20000 [0083.783] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.783] GetProcessHeap () returned 0xd20000 [0083.783] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.783] GetProcessHeap () returned 0xd20000 [0083.783] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0083.783] GetProcessHeap () returned 0xd20000 [0083.783] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0083.783] GetProcessHeap () returned 0xd20000 [0083.783] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0083.783] GetProcessHeap () returned 0xd20000 [0083.783] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0083.783] GetProcessHeap () returned 0xd20000 [0083.783] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0083.783] GetProcessHeap () returned 0xd20000 [0083.783] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0083.783] GetProcessHeap () returned 0xd20000 [0083.783] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0083.784] GetProcessHeap () returned 0xd20000 [0083.784] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0083.784] GetProcessHeap () returned 0xd20000 [0083.784] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0083.784] GetProcessHeap () returned 0xd20000 [0083.784] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0083.784] GetProcessHeap () returned 0xd20000 [0083.784] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0083.784] GetProcessHeap () returned 0xd20000 [0083.784] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0083.784] GetProcessHeap () returned 0xd20000 [0083.784] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0083.784] GetProcessHeap () returned 0xd20000 [0083.784] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0083.784] GetProcessHeap () returned 0xd20000 [0083.784] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0083.784] GetProcessHeap () returned 0xd20000 [0083.784] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0083.785] GetProcessHeap () returned 0xd20000 [0083.785] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0083.785] GetProcessHeap () returned 0xd20000 [0083.785] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0083.785] GetProcessHeap () returned 0xd20000 [0083.785] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0083.785] GetProcessHeap () returned 0xd20000 [0083.785] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0083.785] GetProcessHeap () returned 0xd20000 [0083.785] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.785] GetProcessHeap () returned 0xd20000 [0083.785] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.785] GetProcessHeap () returned 0xd20000 [0083.785] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.785] GetProcessHeap () returned 0xd20000 [0083.785] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.785] GetProcessHeap () returned 0xd20000 [0083.785] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0083.786] GetProcessHeap () returned 0xd20000 [0083.786] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0083.786] GetProcessHeap () returned 0xd20000 [0083.786] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0083.786] GetProcessHeap () returned 0xd20000 [0083.786] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0083.786] GetProcessHeap () returned 0xd20000 [0083.786] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0083.786] GetProcessHeap () returned 0xd20000 [0083.786] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0083.786] GetProcessHeap () returned 0xd20000 [0083.786] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0083.786] GetProcessHeap () returned 0xd20000 [0083.786] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0083.786] GetProcessHeap () returned 0xd20000 [0083.786] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0083.786] GetProcessHeap () returned 0xd20000 [0083.786] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0083.786] GetProcessHeap () returned 0xd20000 [0083.787] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0083.787] GetProcessHeap () returned 0xd20000 [0083.787] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0083.787] GetProcessHeap () returned 0xd20000 [0083.787] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0083.787] GetProcessHeap () returned 0xd20000 [0083.787] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0083.787] GetProcessHeap () returned 0xd20000 [0083.787] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0083.787] GetProcessHeap () returned 0xd20000 [0083.787] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0083.787] GetProcessHeap () returned 0xd20000 [0083.787] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0083.787] GetProcessHeap () returned 0xd20000 [0083.787] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0083.787] GetProcessHeap () returned 0xd20000 [0083.787] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0083.787] GetProcessHeap () returned 0xd20000 [0083.788] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0083.788] GetProcessHeap () returned 0xd20000 [0083.788] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0083.788] GetProcessHeap () returned 0xd20000 [0083.788] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0083.788] GetProcessHeap () returned 0xd20000 [0083.788] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0083.788] GetProcessHeap () returned 0xd20000 [0083.788] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0083.788] GetProcessHeap () returned 0xd20000 [0083.788] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0083.788] GetProcessHeap () returned 0xd20000 [0083.788] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0083.788] GetProcessHeap () returned 0xd20000 [0083.788] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0083.788] GetProcessHeap () returned 0xd20000 [0083.788] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0083.788] GetProcessHeap () returned 0xd20000 [0083.789] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.789] GetProcessHeap () returned 0xd20000 [0083.789] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.789] GetProcessHeap () returned 0xd20000 [0083.789] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.789] GetProcessHeap () returned 0xd20000 [0083.789] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.789] GetProcessHeap () returned 0xd20000 [0083.789] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0083.789] GetProcessHeap () returned 0xd20000 [0083.789] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0083.789] GetProcessHeap () returned 0xd20000 [0083.789] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.789] GetProcessHeap () returned 0xd20000 [0083.789] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.789] GetProcessHeap () returned 0xd20000 [0083.789] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0083.789] GetProcessHeap () returned 0xd20000 [0083.789] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0083.790] GetProcessHeap () returned 0xd20000 [0083.790] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0083.790] GetProcessHeap () returned 0xd20000 [0083.790] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0083.790] GetProcessHeap () returned 0xd20000 [0083.790] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.790] GetProcessHeap () returned 0xd20000 [0083.790] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.790] GetProcessHeap () returned 0xd20000 [0083.790] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0083.790] GetProcessHeap () returned 0xd20000 [0083.790] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0083.790] GetProcessHeap () returned 0xd20000 [0083.790] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0083.790] GetProcessHeap () returned 0xd20000 [0083.790] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0083.790] GetProcessHeap () returned 0xd20000 [0083.790] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0083.790] GetProcessHeap () returned 0xd20000 [0083.791] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0083.791] GetProcessHeap () returned 0xd20000 [0083.791] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0083.791] GetProcessHeap () returned 0xd20000 [0083.791] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0083.791] GetProcessHeap () returned 0xd20000 [0083.791] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0083.791] GetProcessHeap () returned 0xd20000 [0083.791] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0083.791] GetProcessHeap () returned 0xd20000 [0083.791] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.791] GetProcessHeap () returned 0xd20000 [0083.791] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.791] GetProcessHeap () returned 0xd20000 [0083.791] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0083.791] GetProcessHeap () returned 0xd20000 [0083.791] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0083.791] GetProcessHeap () returned 0xd20000 [0083.792] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.792] GetProcessHeap () returned 0xd20000 [0083.792] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.792] GetProcessHeap () returned 0xd20000 [0083.792] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0083.792] GetProcessHeap () returned 0xd20000 [0083.792] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0083.792] GetProcessHeap () returned 0xd20000 [0083.792] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0083.792] GetProcessHeap () returned 0xd20000 [0083.792] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0083.792] GetProcessHeap () returned 0xd20000 [0083.792] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0083.792] GetProcessHeap () returned 0xd20000 [0083.792] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0083.792] GetProcessHeap () returned 0xd20000 [0083.793] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0083.793] GetProcessHeap () returned 0xd20000 [0083.793] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0083.793] GetProcessHeap () returned 0xd20000 [0083.793] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0083.793] GetProcessHeap () returned 0xd20000 [0083.793] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0083.793] GetProcessHeap () returned 0xd20000 [0083.793] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0083.793] GetProcessHeap () returned 0xd20000 [0083.793] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0083.793] GetProcessHeap () returned 0xd20000 [0083.793] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44600 | out: hHeap=0xd20000) returned 1 [0083.793] GetProcessHeap () returned 0xd20000 [0083.793] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b878 | out: hHeap=0xd20000) returned 1 [0083.793] GetProcessHeap () returned 0xd20000 [0083.793] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0083.794] GetProcessHeap () returned 0xd20000 [0083.794] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4adc8 | out: hHeap=0xd20000) returned 1 [0083.794] GetProcessHeap () returned 0xd20000 [0083.794] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0083.794] GetProcessHeap () returned 0xd20000 [0083.794] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0083.794] GetProcessHeap () returned 0xd20000 [0083.794] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0083.794] WriteFile (in: hFile=0x230, lpBuffer=0xd4ba40*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ba40*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0083.855] GetProcessHeap () returned 0xd20000 [0083.855] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4ba40, Size=0x30) returned 0xd4ba40 [0083.855] GetProcessHeap () returned 0xd20000 [0083.855] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0083.855] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0083.856] GetProcessHeap () returned 0xd20000 [0083.856] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x64c8) returned 0xd4ba78 [0083.856] ReadFile (in: hFile=0x230, lpBuffer=0xd4ba78, nNumberOfBytesToRead=0x64c8, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4ba78*, lpNumberOfBytesRead=0x299d7e8*=0x64c8, lpOverlapped=0x0) returned 1 [0083.857] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0083.858] WriteFile (in: hFile=0x230, lpBuffer=0xd4ba78*, nNumberOfBytesToWrite=0x64c8, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4ba78*, lpNumberOfBytesWritten=0x299d7e4*=0x64c8, lpOverlapped=0x0) returned 1 [0083.860] GetProcessHeap () returned 0xd20000 [0083.860] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ba78 | out: hHeap=0xd20000) returned 1 [0083.860] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0083.860] WriteFile (in: hFile=0x230, lpBuffer=0xd4ba40*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ba40*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0083.862] CloseHandle (hObject=0x230) returned 1 [0083.865] GetProcessHeap () returned 0xd20000 [0083.865] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd426c0 | out: hHeap=0xd20000) returned 1 [0083.865] GetProcessHeap () returned 0xd20000 [0083.865] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2e898 | out: hHeap=0xd20000) returned 1 [0083.865] GetProcessHeap () returned 0xd20000 [0083.865] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0083.865] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\WinREBootApp64.exe" | out: lpString1="C:\\Windows10Upgrade\\WinREBootApp64.exe") returned="C:\\Windows10Upgrade\\WinREBootApp64.exe" [0083.865] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\WinREBootApp64.exe", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\WinREBootApp64.exe.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\WinREBootApp64.exe.[ponce.lorena@aol.com]" [0083.865] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\WinREBootApp64.exe" (normalized: "c:\\windows10upgrade\\winrebootapp64.exe"), lpNewFileName="C:\\Windows10Upgrade\\WinREBootApp64.exe.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\winrebootapp64.exe.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0083.866] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\WinREBootApp64.exe" | out: pszPath="C:\\Windows10Upgrade") returned 1 [0083.866] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade" | out: pszPath="C:\\Windows10Upgrade\\") returned="" [0083.866] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\HOW_RECOVER.html" [0083.867] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\how_recover.html")) returned 0x20 [0083.867] GetProcessHeap () returned 0xd20000 [0083.867] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36568 | out: hHeap=0xd20000) returned 1 [0083.867] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6528e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6528e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x64c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WinREBootApp64.exe", cAlternateFileName="WINREB~2.EXE")) returned 0 [0083.867] FindClose (in: hFindFile=0xd36d08 | out: hFindFile=0xd36d08) returned 1 [0083.867] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Windows10Upgrade\\resources\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\") returned="C:\\Windows10Upgrade\\resources\\" [0083.867] GetProcessHeap () returned 0xd20000 [0083.867] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd32218 | out: hHeap=0xd20000) returned 1 [0083.867] GetProcessHeap () returned 0xd20000 [0083.867] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0083.868] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\") returned 30 [0083.868] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\resources\\*") returned="C:\\Windows10Upgrade\\resources\\*" [0083.868] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b3c1b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b3c1b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd49260 [0083.868] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0083.868] FindNextFileW (in: hFindFile=0xd49260, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b3c1b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b3c1b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.868] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0083.868] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0083.869] FindNextFileW (in: hFindFile=0xd49260, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a5195, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3a5195, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="amd64", cAlternateFileName="")) returned 1 [0083.869] lstrcmpiW (lpString1="amd64", lpString2=".") returned 1 [0083.869] lstrcmpiW (lpString1="amd64", lpString2="..") returned 1 [0083.869] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\", lpString2="amd64" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64") returned="C:\\Windows10Upgrade\\resources\\amd64" [0083.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amd64", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0083.869] GetProcessHeap () returned 0xd20000 [0083.869] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x6) returned 0xd3cc98 [0083.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="amd64", cchWideChar=-1, lpMultiByteStr=0xd3cc98, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="amd64", lpUsedDefaultChar=0x0) returned 6 [0083.869] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0083.869] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0083.869] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0083.869] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0083.869] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0083.869] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0083.869] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0083.869] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0083.869] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0083.870] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0083.870] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0083.870] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0083.870] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0083.870] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0083.870] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0083.870] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0083.870] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0083.870] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0083.870] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0083.870] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0083.870] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0083.871] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0083.871] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0083.871] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0083.871] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0083.871] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0083.871] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0083.871] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0083.871] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0083.872] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0083.872] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0083.872] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0083.872] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0083.872] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0083.872] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0083.872] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0083.872] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0083.872] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0083.872] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0083.872] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0083.872] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0083.872] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0083.872] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="amd64", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0083.872] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\") returned="C:\\Windows10Upgrade\\resources\\amd64\\" [0083.872] GetProcessHeap () returned 0xd20000 [0083.872] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cd18 [0083.872] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\amd64\\") returned 36 [0083.873] GetProcessHeap () returned 0xd20000 [0083.873] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4a) returned 0xd2e898 [0083.873] lstrcpyW (in: lpString1=0xd2e898, lpString2="C:\\Windows10Upgrade\\resources\\amd64\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\") returned="C:\\Windows10Upgrade\\resources\\amd64\\" [0083.873] GetProcessHeap () returned 0xd20000 [0083.873] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0083.873] FindNextFileW (in: hFindFile=0xd49260, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a78b4, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a78b4, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xc981b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hwcompatShared.txt", cAlternateFileName="HWCOMP~1.TXT")) returned 1 [0083.873] lstrcmpiW (lpString1="hwcompatShared.txt", lpString2=".") returned 1 [0083.873] lstrcmpiW (lpString1="hwcompatShared.txt", lpString2="..") returned 1 [0083.873] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\", lpString2="hwcompatShared.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt") returned="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" [0083.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwcompatShared.txt", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0083.873] GetProcessHeap () returned 0xd20000 [0083.873] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x13) returned 0xd36568 [0083.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwcompatShared.txt", cchWideChar=-1, lpMultiByteStr=0xd36568, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwcompatShared.txt", lpUsedDefaultChar=0x0) returned 19 [0083.873] lstrlenA (lpString="hwcompatShared.txt") returned 18 [0083.873] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0083.873] lstrlenA (lpString="hwcompatShared.txt") returned 18 [0083.873] lstrlenA (lpString=".dll") returned 4 [0083.873] lstrlenA (lpString=".dll") returned 4 [0083.874] lstrlenA (lpString="hwcompatShared.txt") returned 18 [0083.874] lstrcmpiA (lpString1=".txt", lpString2=".dll") returned 1 [0083.874] lstrlenA (lpString="hwcompatShared.txt") returned 18 [0083.874] lstrlenA (lpString=".ini") returned 4 [0083.874] lstrlenA (lpString=".ini") returned 4 [0083.874] lstrlenA (lpString="hwcompatShared.txt") returned 18 [0083.874] lstrcmpiA (lpString1=".txt", lpString2=".ini") returned 1 [0083.874] lstrlenA (lpString="hwcompatShared.txt") returned 18 [0083.874] lstrlenA (lpString=".inc") returned 4 [0083.874] lstrlenA (lpString=".inc") returned 4 [0083.874] lstrlenA (lpString="hwcompatShared.txt") returned 18 [0083.874] lstrcmpiA (lpString1=".txt", lpString2=".inc") returned 1 [0083.874] lstrcmpiW (lpString1="hwcompatShared.txt", lpString2="HOW_RECOVER.html") returned 1 [0083.874] lstrcmpiW (lpString1="hwcompatShared.txt", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0083.874] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0083.874] lstrcmpiW (lpString1="hwcompatShared.txt", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0083.874] GetProcessHeap () returned 0xd20000 [0083.874] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd426e8 [0083.875] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0083.877] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=825371) returned 1 [0083.877] GetProcessHeap () returned 0xd20000 [0083.877] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd3c308 [0083.877] GetProcessHeap () returned 0xd20000 [0083.877] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0083.877] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt") returned 48 [0083.877] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0083.877] GetProcessHeap () returned 0xd20000 [0083.877] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0083.877] GetProcessHeap () returned 0xd20000 [0083.877] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x385) returned 0xd4ba78 [0083.878] lstrlenA (lpString="rsa_encrypt") returned 11 [0083.878] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0083.880] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0083.880] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0083.880] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0083.880] GetProcessHeap () returned 0xd20000 [0083.880] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0083.880] lstrlenA (lpString="010001") returned 6 [0083.880] GetProcessHeap () returned 0xd20000 [0083.880] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0083.880] GetProcessHeap () returned 0xd20000 [0083.880] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0083.880] GetProcessHeap () returned 0xd20000 [0083.881] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aa68 [0083.881] GetProcessHeap () returned 0xd20000 [0083.881] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0083.881] GetProcessHeap () returned 0xd20000 [0083.881] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b1b8 [0083.881] GetProcessHeap () returned 0xd20000 [0083.881] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44e98 [0083.881] GetProcessHeap () returned 0xd20000 [0083.881] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd28 [0083.881] GetProcessHeap () returned 0xd20000 [0083.881] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0083.881] GetProcessHeap () returned 0xd20000 [0083.881] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.881] GetProcessHeap () returned 0xd20000 [0083.881] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44c68 [0083.881] GetProcessHeap () returned 0xd20000 [0083.881] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0083.881] GetProcessHeap () returned 0xd20000 [0083.881] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd45410 [0083.882] GetProcessHeap () returned 0xd20000 [0083.882] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.882] GetProcessHeap () returned 0xd20000 [0083.882] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44468 [0083.882] GetProcessHeap () returned 0xd20000 [0083.882] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aca8 [0083.882] GetProcessHeap () returned 0xd20000 [0083.882] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0083.882] GetProcessHeap () returned 0xd20000 [0083.882] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0083.882] GetProcessHeap () returned 0xd20000 [0083.882] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aca8 | out: hHeap=0xd20000) returned 1 [0083.882] GetProcessHeap () returned 0xd20000 [0083.882] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0083.882] GetProcessHeap () returned 0xd20000 [0083.882] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44408 [0083.882] GetProcessHeap () returned 0xd20000 [0083.882] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.882] GetProcessHeap () returned 0xd20000 [0083.883] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0083.883] GetProcessHeap () returned 0xd20000 [0083.883] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0083.883] GetProcessHeap () returned 0xd20000 [0083.883] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0083.883] GetProcessHeap () returned 0xd20000 [0083.883] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.883] GetProcessHeap () returned 0xd20000 [0083.883] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.883] GetProcessHeap () returned 0xd20000 [0083.883] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4adc8 [0083.883] GetProcessHeap () returned 0xd20000 [0083.883] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44408 | out: hHeap=0xd20000) returned 1 [0083.883] GetProcessHeap () returned 0xd20000 [0083.883] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0083.883] GetProcessHeap () returned 0xd20000 [0083.883] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4adc8 | out: hHeap=0xd20000) returned 1 [0083.883] GetProcessHeap () returned 0xd20000 [0083.883] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.884] GetProcessHeap () returned 0xd20000 [0083.884] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.884] GetProcessHeap () returned 0xd20000 [0083.884] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0083.884] GetProcessHeap () returned 0xd20000 [0083.884] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0083.884] GetProcessHeap () returned 0xd20000 [0083.884] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0083.884] GetProcessHeap () returned 0xd20000 [0083.884] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0083.884] GetProcessHeap () returned 0xd20000 [0083.884] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0083.884] GetProcessHeap () returned 0xd20000 [0083.884] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0083.884] GetProcessHeap () returned 0xd20000 [0083.884] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.884] GetProcessHeap () returned 0xd20000 [0083.884] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.884] GetProcessHeap () returned 0xd20000 [0083.885] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0083.885] GetProcessHeap () returned 0xd20000 [0083.885] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0083.885] GetProcessHeap () returned 0xd20000 [0083.885] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.885] GetProcessHeap () returned 0xd20000 [0083.885] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.885] GetProcessHeap () returned 0xd20000 [0083.885] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0083.885] GetProcessHeap () returned 0xd20000 [0083.885] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0083.885] GetProcessHeap () returned 0xd20000 [0083.885] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0083.885] GetProcessHeap () returned 0xd20000 [0083.885] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0083.885] GetProcessHeap () returned 0xd20000 [0083.885] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0083.885] GetProcessHeap () returned 0xd20000 [0083.886] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0083.886] GetProcessHeap () returned 0xd20000 [0083.886] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0083.886] GetProcessHeap () returned 0xd20000 [0083.886] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0083.886] GetProcessHeap () returned 0xd20000 [0083.886] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.886] GetProcessHeap () returned 0xd20000 [0083.886] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.886] GetProcessHeap () returned 0xd20000 [0083.886] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0083.886] GetProcessHeap () returned 0xd20000 [0083.886] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0083.886] GetProcessHeap () returned 0xd20000 [0083.886] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0083.886] GetProcessHeap () returned 0xd20000 [0083.887] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0083.887] GetProcessHeap () returned 0xd20000 [0083.887] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.887] GetProcessHeap () returned 0xd20000 [0083.887] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.887] GetProcessHeap () returned 0xd20000 [0083.887] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0083.887] GetProcessHeap () returned 0xd20000 [0083.887] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0083.887] GetProcessHeap () returned 0xd20000 [0083.887] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.887] GetProcessHeap () returned 0xd20000 [0083.887] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.887] GetProcessHeap () returned 0xd20000 [0083.887] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0083.887] GetProcessHeap () returned 0xd20000 [0083.887] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0083.887] GetProcessHeap () returned 0xd20000 [0083.887] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.888] GetProcessHeap () returned 0xd20000 [0083.888] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.888] GetProcessHeap () returned 0xd20000 [0083.888] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.888] GetProcessHeap () returned 0xd20000 [0083.888] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.888] GetProcessHeap () returned 0xd20000 [0083.888] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.888] GetProcessHeap () returned 0xd20000 [0083.888] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.888] GetProcessHeap () returned 0xd20000 [0083.888] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.888] GetProcessHeap () returned 0xd20000 [0083.888] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.888] GetProcessHeap () returned 0xd20000 [0083.888] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.888] GetProcessHeap () returned 0xd20000 [0083.888] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.888] GetProcessHeap () returned 0xd20000 [0083.888] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.889] GetProcessHeap () returned 0xd20000 [0083.889] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.889] GetProcessHeap () returned 0xd20000 [0083.889] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.889] GetProcessHeap () returned 0xd20000 [0083.889] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.889] GetProcessHeap () returned 0xd20000 [0083.889] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0083.889] GetProcessHeap () returned 0xd20000 [0083.889] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0083.889] GetProcessHeap () returned 0xd20000 [0083.889] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.889] GetProcessHeap () returned 0xd20000 [0083.889] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.889] GetProcessHeap () returned 0xd20000 [0083.889] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.889] GetProcessHeap () returned 0xd20000 [0083.889] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.890] GetProcessHeap () returned 0xd20000 [0083.890] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0083.890] GetProcessHeap () returned 0xd20000 [0083.890] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0083.890] GetProcessHeap () returned 0xd20000 [0083.890] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0083.890] GetProcessHeap () returned 0xd20000 [0083.890] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0083.890] GetProcessHeap () returned 0xd20000 [0083.890] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0083.890] GetProcessHeap () returned 0xd20000 [0083.890] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0083.890] GetProcessHeap () returned 0xd20000 [0083.890] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0083.890] GetProcessHeap () returned 0xd20000 [0083.890] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0083.890] GetProcessHeap () returned 0xd20000 [0083.890] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.890] GetProcessHeap () returned 0xd20000 [0083.891] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.891] GetProcessHeap () returned 0xd20000 [0083.891] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.891] GetProcessHeap () returned 0xd20000 [0083.891] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.891] GetProcessHeap () returned 0xd20000 [0083.891] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.891] GetProcessHeap () returned 0xd20000 [0083.891] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.891] GetProcessHeap () returned 0xd20000 [0083.891] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0083.891] GetProcessHeap () returned 0xd20000 [0083.891] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0083.891] GetProcessHeap () returned 0xd20000 [0083.891] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0083.891] GetProcessHeap () returned 0xd20000 [0083.891] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0083.891] GetProcessHeap () returned 0xd20000 [0083.891] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0083.891] GetProcessHeap () returned 0xd20000 [0083.892] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0083.892] GetProcessHeap () returned 0xd20000 [0083.892] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0083.892] GetProcessHeap () returned 0xd20000 [0083.892] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0083.892] GetProcessHeap () returned 0xd20000 [0083.892] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0083.892] GetProcessHeap () returned 0xd20000 [0083.892] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0083.892] GetProcessHeap () returned 0xd20000 [0083.892] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.892] GetProcessHeap () returned 0xd20000 [0083.892] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.892] GetProcessHeap () returned 0xd20000 [0083.892] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.892] GetProcessHeap () returned 0xd20000 [0083.892] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.892] GetProcessHeap () returned 0xd20000 [0083.892] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.892] GetProcessHeap () returned 0xd20000 [0083.892] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.893] GetProcessHeap () returned 0xd20000 [0083.893] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.893] GetProcessHeap () returned 0xd20000 [0083.893] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.893] GetProcessHeap () returned 0xd20000 [0083.893] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0083.893] GetProcessHeap () returned 0xd20000 [0083.893] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0083.893] GetProcessHeap () returned 0xd20000 [0083.893] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0083.893] GetProcessHeap () returned 0xd20000 [0083.893] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0083.893] GetProcessHeap () returned 0xd20000 [0083.893] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0083.893] GetProcessHeap () returned 0xd20000 [0083.893] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0083.893] GetProcessHeap () returned 0xd20000 [0083.893] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.893] GetProcessHeap () returned 0xd20000 [0083.894] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.894] GetProcessHeap () returned 0xd20000 [0083.894] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0083.894] GetProcessHeap () returned 0xd20000 [0083.894] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0083.894] GetProcessHeap () returned 0xd20000 [0083.894] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0083.894] GetProcessHeap () returned 0xd20000 [0083.894] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0083.894] GetProcessHeap () returned 0xd20000 [0083.894] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0083.894] GetProcessHeap () returned 0xd20000 [0083.894] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0083.894] GetProcessHeap () returned 0xd20000 [0083.894] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0083.894] GetProcessHeap () returned 0xd20000 [0083.894] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0083.894] GetProcessHeap () returned 0xd20000 [0083.894] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.894] GetProcessHeap () returned 0xd20000 [0083.895] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.895] GetProcessHeap () returned 0xd20000 [0083.895] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0083.895] GetProcessHeap () returned 0xd20000 [0083.895] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0083.895] GetProcessHeap () returned 0xd20000 [0083.895] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0083.895] GetProcessHeap () returned 0xd20000 [0083.895] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0083.895] GetProcessHeap () returned 0xd20000 [0083.895] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.895] GetProcessHeap () returned 0xd20000 [0083.895] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.895] GetProcessHeap () returned 0xd20000 [0083.895] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.895] GetProcessHeap () returned 0xd20000 [0083.895] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.895] GetProcessHeap () returned 0xd20000 [0083.895] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.896] GetProcessHeap () returned 0xd20000 [0083.896] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.896] GetProcessHeap () returned 0xd20000 [0083.896] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0083.896] GetProcessHeap () returned 0xd20000 [0083.896] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0083.896] GetProcessHeap () returned 0xd20000 [0083.896] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0083.896] GetProcessHeap () returned 0xd20000 [0083.896] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0083.896] GetProcessHeap () returned 0xd20000 [0083.896] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0083.896] GetProcessHeap () returned 0xd20000 [0083.896] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0083.896] GetProcessHeap () returned 0xd20000 [0083.896] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.896] GetProcessHeap () returned 0xd20000 [0083.896] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.896] GetProcessHeap () returned 0xd20000 [0083.896] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0083.897] GetProcessHeap () returned 0xd20000 [0083.897] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0083.897] GetProcessHeap () returned 0xd20000 [0083.897] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0083.897] GetProcessHeap () returned 0xd20000 [0083.897] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0083.897] GetProcessHeap () returned 0xd20000 [0083.897] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.897] GetProcessHeap () returned 0xd20000 [0083.897] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.897] GetProcessHeap () returned 0xd20000 [0083.897] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0083.897] GetProcessHeap () returned 0xd20000 [0083.897] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0083.897] GetProcessHeap () returned 0xd20000 [0083.897] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.897] GetProcessHeap () returned 0xd20000 [0083.897] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.897] GetProcessHeap () returned 0xd20000 [0083.898] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0083.898] GetProcessHeap () returned 0xd20000 [0083.898] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0083.898] GetProcessHeap () returned 0xd20000 [0083.898] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0083.898] GetProcessHeap () returned 0xd20000 [0083.898] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0083.898] GetProcessHeap () returned 0xd20000 [0083.898] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0083.898] GetProcessHeap () returned 0xd20000 [0083.898] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0083.898] GetProcessHeap () returned 0xd20000 [0083.898] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.898] GetProcessHeap () returned 0xd20000 [0083.898] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.898] GetProcessHeap () returned 0xd20000 [0083.898] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0083.898] GetProcessHeap () returned 0xd20000 [0083.898] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0083.899] GetProcessHeap () returned 0xd20000 [0083.899] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.899] GetProcessHeap () returned 0xd20000 [0083.899] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.899] GetProcessHeap () returned 0xd20000 [0083.899] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0083.899] GetProcessHeap () returned 0xd20000 [0083.899] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0083.899] GetProcessHeap () returned 0xd20000 [0083.899] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0083.899] GetProcessHeap () returned 0xd20000 [0083.899] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0083.899] GetProcessHeap () returned 0xd20000 [0083.899] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0083.899] GetProcessHeap () returned 0xd20000 [0083.899] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0083.899] GetProcessHeap () returned 0xd20000 [0083.899] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0083.900] GetProcessHeap () returned 0xd20000 [0083.900] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0083.900] GetProcessHeap () returned 0xd20000 [0083.900] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.900] GetProcessHeap () returned 0xd20000 [0083.900] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.900] GetProcessHeap () returned 0xd20000 [0083.900] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.900] GetProcessHeap () returned 0xd20000 [0083.900] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.900] GetProcessHeap () returned 0xd20000 [0083.900] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0083.900] GetProcessHeap () returned 0xd20000 [0083.900] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0083.900] GetProcessHeap () returned 0xd20000 [0083.900] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.900] GetProcessHeap () returned 0xd20000 [0083.900] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.900] GetProcessHeap () returned 0xd20000 [0083.900] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0083.901] GetProcessHeap () returned 0xd20000 [0083.901] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0083.901] GetProcessHeap () returned 0xd20000 [0083.901] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0083.901] GetProcessHeap () returned 0xd20000 [0083.901] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0083.901] GetProcessHeap () returned 0xd20000 [0083.901] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.901] GetProcessHeap () returned 0xd20000 [0083.901] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.901] GetProcessHeap () returned 0xd20000 [0083.901] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0083.901] GetProcessHeap () returned 0xd20000 [0083.901] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0083.901] GetProcessHeap () returned 0xd20000 [0083.901] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0083.901] GetProcessHeap () returned 0xd20000 [0083.977] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0083.977] GetProcessHeap () returned 0xd20000 [0083.977] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0083.978] GetProcessHeap () returned 0xd20000 [0083.978] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0083.978] GetProcessHeap () returned 0xd20000 [0083.978] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44468 | out: hHeap=0xd20000) returned 1 [0083.978] GetProcessHeap () returned 0xd20000 [0083.978] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b1b8 | out: hHeap=0xd20000) returned 1 [0083.978] GetProcessHeap () returned 0xd20000 [0083.978] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0083.978] GetProcessHeap () returned 0xd20000 [0083.978] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aa68 | out: hHeap=0xd20000) returned 1 [0083.978] GetProcessHeap () returned 0xd20000 [0083.978] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0083.978] GetProcessHeap () returned 0xd20000 [0083.978] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0083.978] GetProcessHeap () returned 0xd20000 [0083.978] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0083.978] WriteFile (in: hFile=0x230, lpBuffer=0xd4ba78*, nNumberOfBytesToWrite=0x385, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ba78*, lpNumberOfBytesWritten=0x299d864*=0x385, lpOverlapped=0x0) returned 1 [0084.002] GetProcessHeap () returned 0xd20000 [0084.002] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4ba78, Size=0x30) returned 0xd4ba78 [0084.002] GetProcessHeap () returned 0xd20000 [0084.003] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0084.003] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0084.004] GetProcessHeap () returned 0xd20000 [0084.004] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc9820) returned 0x2d54020 [0084.023] ReadFile (in: hFile=0x230, lpBuffer=0x2d54020, nNumberOfBytesToRead=0xc9820, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x2d54020*, lpNumberOfBytesRead=0x299d7e8*=0xc9820, lpOverlapped=0x0) returned 1 [0084.543] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0084.543] WriteFile (in: hFile=0x230, lpBuffer=0x2d54020*, nNumberOfBytesToWrite=0xc9820, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0x2d54020*, lpNumberOfBytesWritten=0x299d7e4*=0xc9820, lpOverlapped=0x0) returned 1 [0084.960] GetProcessHeap () returned 0xd20000 [0084.960] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0x2d54020 | out: hHeap=0xd20000) returned 1 [0084.960] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0084.960] WriteFile (in: hFile=0x230, lpBuffer=0xd4ba78*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ba78*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0084.962] CloseHandle (hObject=0x230) returned 1 [0084.990] GetProcessHeap () returned 0xd20000 [0084.990] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd426e8 | out: hHeap=0xd20000) returned 1 [0084.990] GetProcessHeap () returned 0xd20000 [0084.990] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3c308 | out: hHeap=0xd20000) returned 1 [0084.991] GetProcessHeap () returned 0xd20000 [0084.991] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0084.991] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt") returned="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" [0084.991] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt.[ponce.lorena@aol.com]" [0084.991] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\hwcompatshared.txt.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0084.993] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\hwcompatShared.txt" | out: pszPath="C:\\Windows10Upgrade\\resources") returned 1 [0084.993] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources" | out: pszPath="C:\\Windows10Upgrade\\resources\\") returned="" [0084.993] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\HOW_RECOVER.html" [0084.993] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\how_recover.html")) returned 0xffffffff [0084.993] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\how_recover.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0084.999] GetProcessHeap () returned 0xd20000 [0084.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd3c308 [0084.999] GetProcessHeap () returned 0xd20000 [0084.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0085.007] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.009] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.009] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.009] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.009] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.009] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.010] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.010] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.010] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.010] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.010] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.010] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.010] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.011] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.011] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.011] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.011] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.012] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.012] GetProcessHeap () returned 0xd20000 [0085.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3c308 | out: hHeap=0xd20000) returned 1 [0085.012] GetProcessHeap () returned 0xd20000 [0085.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0085.012] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x299d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x299d9d0*=0x300, lpOverlapped=0x0) returned 1 [0085.013] GetProcessHeap () returned 0xd20000 [0085.013] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd3c308 [0085.013] GetProcessHeap () returned 0xd20000 [0085.014] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0085.023] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.024] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.024] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.024] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.024] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.024] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.024] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.024] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.025] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.025] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.025] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.025] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.025] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.025] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.025] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.025] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.026] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.026] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.026] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.026] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.026] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.026] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.026] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.090] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.090] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.090] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.090] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.091] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.091] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.091] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.091] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.091] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.091] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.091] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.091] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.092] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.092] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.092] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.092] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.092] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.092] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.092] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.092] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.093] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.093] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.093] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.093] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.093] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.093] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.093] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.093] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.094] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.094] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.094] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.094] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.094] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.094] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.094] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.094] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.095] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.095] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.095] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.095] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.095] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.095] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.095] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.096] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.096] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.096] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.096] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.096] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.096] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.096] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.096] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.097] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.097] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.097] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.097] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.097] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.097] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.097] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.097] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.098] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.098] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.098] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.098] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.098] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.098] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.098] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.098] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.099] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.099] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.099] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.099] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.099] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.099] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.099] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.100] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.100] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.100] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.100] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.100] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.100] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.100] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.100] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.101] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.101] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.101] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.101] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.101] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.101] GetProcessHeap () returned 0xd20000 [0085.101] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3c308 | out: hHeap=0xd20000) returned 1 [0085.101] GetProcessHeap () returned 0xd20000 [0085.101] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0085.102] CloseHandle (hObject=0x230) returned 1 [0085.102] GetProcessHeap () returned 0xd20000 [0085.102] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36568 | out: hHeap=0xd20000) returned 1 [0085.102] FindNextFileW (in: hFindFile=0xd49260, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3a9fd3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b1515, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b1515, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="i386", cAlternateFileName="")) returned 1 [0085.102] lstrcmpiW (lpString1="i386", lpString2=".") returned 1 [0085.102] lstrcmpiW (lpString1="i386", lpString2="..") returned 1 [0085.102] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\", lpString2="i386" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386") returned="C:\\Windows10Upgrade\\resources\\i386" [0085.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i386", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0085.103] GetProcessHeap () returned 0xd20000 [0085.103] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x5) returned 0xd3cbd8 [0085.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i386", cchWideChar=-1, lpMultiByteStr=0xd3cbd8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="i386", lpUsedDefaultChar=0x0) returned 5 [0085.103] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0085.103] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0085.103] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0085.103] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0085.103] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0085.103] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0085.103] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0085.103] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0085.103] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0085.103] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0085.103] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0085.103] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0085.103] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0085.103] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0085.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0085.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0085.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0085.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0085.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0085.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0085.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0085.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0085.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0085.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0085.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0085.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0085.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0085.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0085.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0085.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0085.104] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0085.105] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0085.105] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0085.105] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0085.105] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0085.105] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0085.105] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0085.105] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0085.105] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0085.105] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0085.105] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0085.105] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0085.105] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="i386", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0085.105] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\") returned="C:\\Windows10Upgrade\\resources\\i386\\" [0085.105] GetProcessHeap () returned 0xd20000 [0085.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cd88 [0085.105] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\i386\\") returned 35 [0085.106] GetProcessHeap () returned 0xd20000 [0085.106] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x48) returned 0xd43ec8 [0085.106] lstrcpyW (in: lpString1=0xd43ec8, lpString2="C:\\Windows10Upgrade\\resources\\i386\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\") returned="C:\\Windows10Upgrade\\resources\\i386\\" [0085.106] GetProcessHeap () returned 0xd20000 [0085.106] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0085.106] FindNextFileW (in: hFindFile=0xd49260, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea63c947, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ux", cAlternateFileName="")) returned 1 [0085.106] lstrcmpiW (lpString1="ux", lpString2=".") returned 1 [0085.106] lstrcmpiW (lpString1="ux", lpString2="..") returned 1 [0085.106] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\", lpString2="ux" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux") returned="C:\\Windows10Upgrade\\resources\\ux" [0085.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ux", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0085.106] GetProcessHeap () returned 0xd20000 [0085.106] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x3) returned 0xd3cd98 [0085.106] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ux", cchWideChar=-1, lpMultiByteStr=0xd3cd98, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ux", lpUsedDefaultChar=0x0) returned 3 [0085.106] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0085.106] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0085.106] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0085.106] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0085.107] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0085.107] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0085.107] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0085.107] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0085.107] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0085.107] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0085.107] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0085.107] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0085.107] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0085.107] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0085.107] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0085.107] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0085.107] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0085.107] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0085.107] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0085.107] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0085.107] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0085.108] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0085.108] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0085.108] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0085.108] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0085.108] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0085.108] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0085.108] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0085.108] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0085.108] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0085.108] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0085.108] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0085.108] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0085.108] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0085.108] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0085.108] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0085.108] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0085.108] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0085.108] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0085.109] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0085.109] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0085.109] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0085.109] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="ux", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0085.109] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0085.109] GetProcessHeap () returned 0xd20000 [0085.109] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cc48 [0085.109] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\") returned 33 [0085.109] GetProcessHeap () returned 0xd20000 [0085.109] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x44) returned 0xd44378 [0085.109] lstrcpyW (in: lpString1=0xd44378, lpString2="C:\\Windows10Upgrade\\resources\\ux\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0085.109] GetProcessHeap () returned 0xd20000 [0085.109] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.109] FindNextFileW (in: hFindFile=0xd49260, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea63c947, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ux", cAlternateFileName="")) returned 0 [0085.109] FindClose (in: hFindFile=0xd49260 | out: hFindFile=0xd49260) returned 1 [0085.110] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\") returned="C:\\Windows10Upgrade\\resources\\ux\\" [0085.110] GetProcessHeap () returned 0xd20000 [0085.110] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44378 | out: hHeap=0xd20000) returned 1 [0085.110] GetProcessHeap () returned 0xd20000 [0085.110] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.110] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\") returned 33 [0085.110] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\*") returned="C:\\Windows10Upgrade\\resources\\ux\\*" [0085.110] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea63c947, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd49060 [0085.116] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0085.116] FindNextFileW (in: hFindFile=0xd49060, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3b3c1b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea63c947, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.116] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0085.116] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0085.116] FindNextFileW (in: hFindFile=0xd49060, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b4fa7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b4fa7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x397, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="block.png", cAlternateFileName="")) returned 1 [0085.116] lstrcmpiW (lpString1="block.png", lpString2=".") returned 1 [0085.116] lstrcmpiW (lpString1="block.png", lpString2="..") returned 1 [0085.117] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="block.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\block.png") returned="C:\\Windows10Upgrade\\resources\\ux\\block.png" [0085.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="block.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0085.117] GetProcessHeap () returned 0xd20000 [0085.117] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xa) returned 0xd44648 [0085.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="block.png", cchWideChar=-1, lpMultiByteStr=0xd44648, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="block.png", lpUsedDefaultChar=0x0) returned 10 [0085.117] lstrlenA (lpString="block.png") returned 9 [0085.117] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0085.117] lstrlenA (lpString="block.png") returned 9 [0085.117] lstrlenA (lpString=".dll") returned 4 [0085.117] lstrlenA (lpString=".dll") returned 4 [0085.117] lstrlenA (lpString="block.png") returned 9 [0085.117] lstrcmpiA (lpString1=".png", lpString2=".dll") returned 1 [0085.117] lstrlenA (lpString="block.png") returned 9 [0085.117] lstrlenA (lpString=".ini") returned 4 [0085.117] lstrlenA (lpString=".ini") returned 4 [0085.117] lstrlenA (lpString="block.png") returned 9 [0085.117] lstrcmpiA (lpString1=".png", lpString2=".ini") returned 1 [0085.117] lstrlenA (lpString="block.png") returned 9 [0085.118] lstrlenA (lpString=".inc") returned 4 [0085.118] lstrlenA (lpString=".inc") returned 4 [0085.118] lstrlenA (lpString="block.png") returned 9 [0085.118] lstrcmpiA (lpString1=".png", lpString2=".inc") returned 1 [0085.118] lstrcmpiW (lpString1="block.png", lpString2="HOW_RECOVER.html") returned -1 [0085.118] lstrcmpiW (lpString1="block.png", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0085.118] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0085.118] lstrcmpiW (lpString1="block.png", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0085.118] GetProcessHeap () returned 0xd20000 [0085.118] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42530 [0085.118] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0085.119] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=919) returned 1 [0085.119] GetProcessHeap () returned 0xd20000 [0085.119] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd3c308 [0085.119] GetProcessHeap () returned 0xd20000 [0085.119] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0085.119] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\block.png") returned 42 [0085.119] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0085.119] GetProcessHeap () returned 0xd20000 [0085.119] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0085.119] GetProcessHeap () returned 0xd20000 [0085.120] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x389) returned 0xd4bab0 [0085.120] lstrlenA (lpString="rsa_encrypt") returned 11 [0085.120] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0085.123] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0085.123] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0085.123] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0085.123] GetProcessHeap () returned 0xd20000 [0085.123] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0085.123] lstrlenA (lpString="010001") returned 6 [0085.123] GetProcessHeap () returned 0xd20000 [0085.123] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cdb8 [0085.123] GetProcessHeap () returned 0xd20000 [0085.123] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0085.124] GetProcessHeap () returned 0xd20000 [0085.124] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b128 [0085.124] GetProcessHeap () returned 0xd20000 [0085.124] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0085.124] GetProcessHeap () returned 0xd20000 [0085.124] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b248 [0085.124] GetProcessHeap () returned 0xd20000 [0085.124] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44920 [0085.124] GetProcessHeap () returned 0xd20000 [0085.124] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc98 [0085.124] GetProcessHeap () returned 0xd20000 [0085.124] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0085.124] GetProcessHeap () returned 0xd20000 [0085.124] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.124] GetProcessHeap () returned 0xd20000 [0085.124] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44c68 [0085.124] GetProcessHeap () returned 0xd20000 [0085.124] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0085.124] GetProcessHeap () returned 0xd20000 [0085.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd450c8 [0085.125] GetProcessHeap () returned 0xd20000 [0085.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0085.125] GetProcessHeap () returned 0xd20000 [0085.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446d8 [0085.125] GetProcessHeap () returned 0xd20000 [0085.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b008 [0085.125] GetProcessHeap () returned 0xd20000 [0085.125] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0085.125] GetProcessHeap () returned 0xd20000 [0085.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0085.125] GetProcessHeap () returned 0xd20000 [0085.125] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b008 | out: hHeap=0xd20000) returned 1 [0085.125] GetProcessHeap () returned 0xd20000 [0085.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.125] GetProcessHeap () returned 0xd20000 [0085.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44678 [0085.125] GetProcessHeap () returned 0xd20000 [0085.126] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0085.126] GetProcessHeap () returned 0xd20000 [0085.126] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.126] GetProcessHeap () returned 0xd20000 [0085.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0085.126] GetProcessHeap () returned 0xd20000 [0085.126] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0085.126] GetProcessHeap () returned 0xd20000 [0085.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.126] GetProcessHeap () returned 0xd20000 [0085.126] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.126] GetProcessHeap () returned 0xd20000 [0085.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b5a8 [0085.126] GetProcessHeap () returned 0xd20000 [0085.126] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44678 | out: hHeap=0xd20000) returned 1 [0085.126] GetProcessHeap () returned 0xd20000 [0085.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0085.126] GetProcessHeap () returned 0xd20000 [0085.126] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b5a8 | out: hHeap=0xd20000) returned 1 [0085.127] GetProcessHeap () returned 0xd20000 [0085.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.127] GetProcessHeap () returned 0xd20000 [0085.127] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.127] GetProcessHeap () returned 0xd20000 [0085.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.127] GetProcessHeap () returned 0xd20000 [0085.127] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.127] GetProcessHeap () returned 0xd20000 [0085.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.127] GetProcessHeap () returned 0xd20000 [0085.127] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.127] GetProcessHeap () returned 0xd20000 [0085.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0085.127] GetProcessHeap () returned 0xd20000 [0085.127] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0085.128] GetProcessHeap () returned 0xd20000 [0085.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.128] GetProcessHeap () returned 0xd20000 [0085.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.128] GetProcessHeap () returned 0xd20000 [0085.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.128] GetProcessHeap () returned 0xd20000 [0085.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.128] GetProcessHeap () returned 0xd20000 [0085.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0085.128] GetProcessHeap () returned 0xd20000 [0085.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0085.128] GetProcessHeap () returned 0xd20000 [0085.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.128] GetProcessHeap () returned 0xd20000 [0085.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.128] GetProcessHeap () returned 0xd20000 [0085.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.128] GetProcessHeap () returned 0xd20000 [0085.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.129] GetProcessHeap () returned 0xd20000 [0085.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.129] GetProcessHeap () returned 0xd20000 [0085.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.129] GetProcessHeap () returned 0xd20000 [0085.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0085.129] GetProcessHeap () returned 0xd20000 [0085.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.129] GetProcessHeap () returned 0xd20000 [0085.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.129] GetProcessHeap () returned 0xd20000 [0085.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.129] GetProcessHeap () returned 0xd20000 [0085.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0085.129] GetProcessHeap () returned 0xd20000 [0085.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0085.129] GetProcessHeap () returned 0xd20000 [0085.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.130] GetProcessHeap () returned 0xd20000 [0085.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.130] GetProcessHeap () returned 0xd20000 [0085.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.130] GetProcessHeap () returned 0xd20000 [0085.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.130] GetProcessHeap () returned 0xd20000 [0085.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.130] GetProcessHeap () returned 0xd20000 [0085.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.130] GetProcessHeap () returned 0xd20000 [0085.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.130] GetProcessHeap () returned 0xd20000 [0085.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.130] GetProcessHeap () returned 0xd20000 [0085.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.130] GetProcessHeap () returned 0xd20000 [0085.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.131] GetProcessHeap () returned 0xd20000 [0085.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.131] GetProcessHeap () returned 0xd20000 [0085.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.131] GetProcessHeap () returned 0xd20000 [0085.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.131] GetProcessHeap () returned 0xd20000 [0085.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.131] GetProcessHeap () returned 0xd20000 [0085.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.131] GetProcessHeap () returned 0xd20000 [0085.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.131] GetProcessHeap () returned 0xd20000 [0085.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0085.131] GetProcessHeap () returned 0xd20000 [0085.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0085.131] GetProcessHeap () returned 0xd20000 [0085.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.132] GetProcessHeap () returned 0xd20000 [0085.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.132] GetProcessHeap () returned 0xd20000 [0085.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.132] GetProcessHeap () returned 0xd20000 [0085.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.132] GetProcessHeap () returned 0xd20000 [0085.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.132] GetProcessHeap () returned 0xd20000 [0085.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.132] GetProcessHeap () returned 0xd20000 [0085.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.132] GetProcessHeap () returned 0xd20000 [0085.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.132] GetProcessHeap () returned 0xd20000 [0085.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.132] GetProcessHeap () returned 0xd20000 [0085.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.133] GetProcessHeap () returned 0xd20000 [0085.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.133] GetProcessHeap () returned 0xd20000 [0085.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.133] GetProcessHeap () returned 0xd20000 [0085.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.133] GetProcessHeap () returned 0xd20000 [0085.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.133] GetProcessHeap () returned 0xd20000 [0085.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.133] GetProcessHeap () returned 0xd20000 [0085.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.133] GetProcessHeap () returned 0xd20000 [0085.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.133] GetProcessHeap () returned 0xd20000 [0085.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.134] GetProcessHeap () returned 0xd20000 [0085.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.134] GetProcessHeap () returned 0xd20000 [0085.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.134] GetProcessHeap () returned 0xd20000 [0085.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.134] GetProcessHeap () returned 0xd20000 [0085.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.134] GetProcessHeap () returned 0xd20000 [0085.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.134] GetProcessHeap () returned 0xd20000 [0085.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.134] GetProcessHeap () returned 0xd20000 [0085.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.134] GetProcessHeap () returned 0xd20000 [0085.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.134] GetProcessHeap () returned 0xd20000 [0085.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0085.134] GetProcessHeap () returned 0xd20000 [0085.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.135] GetProcessHeap () returned 0xd20000 [0085.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.135] GetProcessHeap () returned 0xd20000 [0085.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.135] GetProcessHeap () returned 0xd20000 [0085.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0085.135] GetProcessHeap () returned 0xd20000 [0085.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.135] GetProcessHeap () returned 0xd20000 [0085.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.135] GetProcessHeap () returned 0xd20000 [0085.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.135] GetProcessHeap () returned 0xd20000 [0085.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.135] GetProcessHeap () returned 0xd20000 [0085.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.135] GetProcessHeap () returned 0xd20000 [0085.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.136] GetProcessHeap () returned 0xd20000 [0085.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.136] GetProcessHeap () returned 0xd20000 [0085.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.232] GetProcessHeap () returned 0xd20000 [0085.232] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.232] GetProcessHeap () returned 0xd20000 [0085.232] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0085.232] GetProcessHeap () returned 0xd20000 [0085.232] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0085.232] GetProcessHeap () returned 0xd20000 [0085.232] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.232] GetProcessHeap () returned 0xd20000 [0085.233] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.233] GetProcessHeap () returned 0xd20000 [0085.233] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.233] GetProcessHeap () returned 0xd20000 [0085.233] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.233] GetProcessHeap () returned 0xd20000 [0085.233] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.233] GetProcessHeap () returned 0xd20000 [0085.233] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.233] GetProcessHeap () returned 0xd20000 [0085.233] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.233] GetProcessHeap () returned 0xd20000 [0085.233] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.233] GetProcessHeap () returned 0xd20000 [0085.233] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0085.233] GetProcessHeap () returned 0xd20000 [0085.233] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0085.233] GetProcessHeap () returned 0xd20000 [0085.233] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.233] GetProcessHeap () returned 0xd20000 [0085.234] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.234] GetProcessHeap () returned 0xd20000 [0085.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.234] GetProcessHeap () returned 0xd20000 [0085.234] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.234] GetProcessHeap () returned 0xd20000 [0085.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.234] GetProcessHeap () returned 0xd20000 [0085.234] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.234] GetProcessHeap () returned 0xd20000 [0085.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.234] GetProcessHeap () returned 0xd20000 [0085.234] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.234] GetProcessHeap () returned 0xd20000 [0085.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0085.234] GetProcessHeap () returned 0xd20000 [0085.234] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0085.234] GetProcessHeap () returned 0xd20000 [0085.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.234] GetProcessHeap () returned 0xd20000 [0085.235] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.235] GetProcessHeap () returned 0xd20000 [0085.235] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.235] GetProcessHeap () returned 0xd20000 [0085.235] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.235] GetProcessHeap () returned 0xd20000 [0085.235] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.235] GetProcessHeap () returned 0xd20000 [0085.235] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.235] GetProcessHeap () returned 0xd20000 [0085.235] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.235] GetProcessHeap () returned 0xd20000 [0085.235] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.235] GetProcessHeap () returned 0xd20000 [0085.235] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.235] GetProcessHeap () returned 0xd20000 [0085.235] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.235] GetProcessHeap () returned 0xd20000 [0085.235] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.236] GetProcessHeap () returned 0xd20000 [0085.236] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.236] GetProcessHeap () returned 0xd20000 [0085.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.236] GetProcessHeap () returned 0xd20000 [0085.236] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.236] GetProcessHeap () returned 0xd20000 [0085.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.236] GetProcessHeap () returned 0xd20000 [0085.236] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.236] GetProcessHeap () returned 0xd20000 [0085.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.236] GetProcessHeap () returned 0xd20000 [0085.236] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.236] GetProcessHeap () returned 0xd20000 [0085.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.236] GetProcessHeap () returned 0xd20000 [0085.236] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.236] GetProcessHeap () returned 0xd20000 [0085.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0085.237] GetProcessHeap () returned 0xd20000 [0085.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0085.237] GetProcessHeap () returned 0xd20000 [0085.237] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.237] GetProcessHeap () returned 0xd20000 [0085.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.237] GetProcessHeap () returned 0xd20000 [0085.237] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.237] GetProcessHeap () returned 0xd20000 [0085.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.237] GetProcessHeap () returned 0xd20000 [0085.237] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.237] GetProcessHeap () returned 0xd20000 [0085.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.237] GetProcessHeap () returned 0xd20000 [0085.237] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0085.237] GetProcessHeap () returned 0xd20000 [0085.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0085.237] GetProcessHeap () returned 0xd20000 [0085.237] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.238] GetProcessHeap () returned 0xd20000 [0085.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.238] GetProcessHeap () returned 0xd20000 [0085.238] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.238] GetProcessHeap () returned 0xd20000 [0085.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.238] GetProcessHeap () returned 0xd20000 [0085.238] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.238] GetProcessHeap () returned 0xd20000 [0085.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.238] GetProcessHeap () returned 0xd20000 [0085.238] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.238] GetProcessHeap () returned 0xd20000 [0085.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.238] GetProcessHeap () returned 0xd20000 [0085.238] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.238] GetProcessHeap () returned 0xd20000 [0085.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.238] GetProcessHeap () returned 0xd20000 [0085.239] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.239] GetProcessHeap () returned 0xd20000 [0085.239] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.239] GetProcessHeap () returned 0xd20000 [0085.239] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.239] GetProcessHeap () returned 0xd20000 [0085.239] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.239] GetProcessHeap () returned 0xd20000 [0085.239] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.239] GetProcessHeap () returned 0xd20000 [0085.239] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.239] GetProcessHeap () returned 0xd20000 [0085.239] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.239] GetProcessHeap () returned 0xd20000 [0085.239] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.239] GetProcessHeap () returned 0xd20000 [0085.239] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.239] GetProcessHeap () returned 0xd20000 [0085.239] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.240] GetProcessHeap () returned 0xd20000 [0085.240] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.240] GetProcessHeap () returned 0xd20000 [0085.240] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.240] GetProcessHeap () returned 0xd20000 [0085.240] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.240] GetProcessHeap () returned 0xd20000 [0085.240] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.240] GetProcessHeap () returned 0xd20000 [0085.240] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.240] GetProcessHeap () returned 0xd20000 [0085.240] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.240] GetProcessHeap () returned 0xd20000 [0085.240] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.240] GetProcessHeap () returned 0xd20000 [0085.240] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.240] GetProcessHeap () returned 0xd20000 [0085.240] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.240] GetProcessHeap () returned 0xd20000 [0085.241] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.241] GetProcessHeap () returned 0xd20000 [0085.241] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.241] GetProcessHeap () returned 0xd20000 [0085.241] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.241] GetProcessHeap () returned 0xd20000 [0085.241] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.241] GetProcessHeap () returned 0xd20000 [0085.241] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.241] GetProcessHeap () returned 0xd20000 [0085.241] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0085.241] GetProcessHeap () returned 0xd20000 [0085.241] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0085.241] GetProcessHeap () returned 0xd20000 [0085.241] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0085.241] GetProcessHeap () returned 0xd20000 [0085.241] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0085.241] GetProcessHeap () returned 0xd20000 [0085.241] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446d8 | out: hHeap=0xd20000) returned 1 [0085.242] GetProcessHeap () returned 0xd20000 [0085.242] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b248 | out: hHeap=0xd20000) returned 1 [0085.242] GetProcessHeap () returned 0xd20000 [0085.242] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0085.242] GetProcessHeap () returned 0xd20000 [0085.242] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b128 | out: hHeap=0xd20000) returned 1 [0085.242] GetProcessHeap () returned 0xd20000 [0085.242] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0085.242] GetProcessHeap () returned 0xd20000 [0085.242] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.242] GetProcessHeap () returned 0xd20000 [0085.242] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0085.242] WriteFile (in: hFile=0x230, lpBuffer=0xd4bab0*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4bab0*, lpNumberOfBytesWritten=0x299d864*=0x389, lpOverlapped=0x0) returned 1 [0085.252] GetProcessHeap () returned 0xd20000 [0085.252] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4bab0, Size=0x30) returned 0xd4bab0 [0085.252] GetProcessHeap () returned 0xd20000 [0085.252] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0085.252] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0085.252] GetProcessHeap () returned 0xd20000 [0085.252] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x3a0) returned 0xd4bae8 [0085.252] ReadFile (in: hFile=0x230, lpBuffer=0xd4bae8, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4bae8*, lpNumberOfBytesRead=0x299d7e8*=0x3a0, lpOverlapped=0x0) returned 1 [0085.253] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0085.253] WriteFile (in: hFile=0x230, lpBuffer=0xd4bae8*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4bae8*, lpNumberOfBytesWritten=0x299d7e4*=0x3a0, lpOverlapped=0x0) returned 1 [0085.254] GetProcessHeap () returned 0xd20000 [0085.254] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bae8 | out: hHeap=0xd20000) returned 1 [0085.254] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0085.255] WriteFile (in: hFile=0x230, lpBuffer=0xd4bab0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4bab0*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0085.256] CloseHandle (hObject=0x230) returned 1 [0085.258] GetProcessHeap () returned 0xd20000 [0085.258] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42530 | out: hHeap=0xd20000) returned 1 [0085.258] GetProcessHeap () returned 0xd20000 [0085.258] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3c308 | out: hHeap=0xd20000) returned 1 [0085.258] GetProcessHeap () returned 0xd20000 [0085.258] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0085.258] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\block.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\block.png") returned="C:\\Windows10Upgrade\\resources\\ux\\block.png" [0085.258] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\block.png", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\block.png.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\block.png.[ponce.lorena@aol.com]" [0085.258] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\block.png.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\block.png.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0085.259] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\block.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0085.259] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0085.259] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" [0085.259] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_recover.html")) returned 0xffffffff [0085.260] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_recover.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0085.379] GetProcessHeap () returned 0xd20000 [0085.379] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd3c308 [0085.379] GetProcessHeap () returned 0xd20000 [0085.379] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0085.389] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.392] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.392] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.392] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.392] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.392] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.392] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.393] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.393] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.393] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.393] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.393] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.393] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.394] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.394] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.394] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.394] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.394] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.394] GetProcessHeap () returned 0xd20000 [0085.394] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3c308 | out: hHeap=0xd20000) returned 1 [0085.395] GetProcessHeap () returned 0xd20000 [0085.395] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0085.395] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x299d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x299d9d0*=0x300, lpOverlapped=0x0) returned 1 [0085.396] GetProcessHeap () returned 0xd20000 [0085.396] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd3c308 [0085.396] GetProcessHeap () returned 0xd20000 [0085.396] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0085.408] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.408] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.408] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.408] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.408] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.408] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.409] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.409] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.409] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.409] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.409] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.409] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.409] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.410] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.410] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.410] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.410] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.410] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.410] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.410] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.410] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.411] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.411] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.411] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.411] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.411] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.411] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.411] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.412] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.412] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.412] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.412] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.412] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.412] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.412] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.413] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.413] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.413] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.413] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.413] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.413] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.413] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.414] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.414] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.414] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.414] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.414] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.414] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.414] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.414] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.415] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.415] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.415] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.415] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.415] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.415] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.415] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.415] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.416] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.416] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.416] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.416] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.416] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.416] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.416] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.417] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.417] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.417] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.417] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.433] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.434] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.434] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.434] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.434] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.434] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.434] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.434] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.435] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.435] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.435] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.435] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.435] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.435] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.435] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.436] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.436] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.436] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.436] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.436] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.436] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.436] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.436] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.437] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.437] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.437] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.437] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.437] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.437] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.437] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.438] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.438] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.438] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.438] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.438] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.438] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.438] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.439] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.439] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.439] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.439] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0085.439] GetProcessHeap () returned 0xd20000 [0085.439] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3c308 | out: hHeap=0xd20000) returned 1 [0085.439] GetProcessHeap () returned 0xd20000 [0085.439] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0085.439] CloseHandle (hObject=0x230) returned 1 [0085.440] GetProcessHeap () returned 0xd20000 [0085.440] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44648 | out: hHeap=0xd20000) returned 1 [0085.440] FindNextFileW (in: hFindFile=0xd49060, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b8a24, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b8a24, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x749e0600, ftLastWriteTime.dwHighDateTime=0x1d2ea8c, nFileSizeHigh=0x0, nFileSizeLow=0x1ba8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bluelogo.png", cAlternateFileName="")) returned 1 [0085.440] lstrcmpiW (lpString1="bluelogo.png", lpString2=".") returned 1 [0085.440] lstrcmpiW (lpString1="bluelogo.png", lpString2="..") returned 1 [0085.440] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="bluelogo.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png") returned="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" [0085.440] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bluelogo.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0085.440] GetProcessHeap () returned 0xd20000 [0085.440] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xd) returned 0xd446c0 [0085.440] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bluelogo.png", cchWideChar=-1, lpMultiByteStr=0xd446c0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bluelogo.png", lpUsedDefaultChar=0x0) returned 13 [0085.441] lstrlenA (lpString="bluelogo.png") returned 12 [0085.441] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0085.441] lstrlenA (lpString="bluelogo.png") returned 12 [0085.441] lstrlenA (lpString=".dll") returned 4 [0085.441] lstrlenA (lpString=".dll") returned 4 [0085.441] lstrlenA (lpString="bluelogo.png") returned 12 [0085.441] lstrcmpiA (lpString1=".png", lpString2=".dll") returned 1 [0085.441] lstrlenA (lpString="bluelogo.png") returned 12 [0085.441] lstrlenA (lpString=".ini") returned 4 [0085.441] lstrlenA (lpString=".ini") returned 4 [0085.441] lstrlenA (lpString="bluelogo.png") returned 12 [0085.441] lstrcmpiA (lpString1=".png", lpString2=".ini") returned 1 [0085.441] lstrlenA (lpString="bluelogo.png") returned 12 [0085.441] lstrlenA (lpString=".inc") returned 4 [0085.441] lstrlenA (lpString=".inc") returned 4 [0085.441] lstrlenA (lpString="bluelogo.png") returned 12 [0085.441] lstrcmpiA (lpString1=".png", lpString2=".inc") returned 1 [0085.441] lstrcmpiW (lpString1="bluelogo.png", lpString2="HOW_RECOVER.html") returned -1 [0085.441] lstrcmpiW (lpString1="bluelogo.png", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0085.442] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0085.442] lstrcmpiW (lpString1="bluelogo.png", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0085.442] GetProcessHeap () returned 0xd20000 [0085.442] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42850 [0085.442] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0085.443] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=7080) returned 1 [0085.444] GetProcessHeap () returned 0xd20000 [0085.444] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd3c308 [0085.444] GetProcessHeap () returned 0xd20000 [0085.444] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0085.444] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png") returned 45 [0085.444] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0085.444] GetProcessHeap () returned 0xd20000 [0085.444] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0085.444] GetProcessHeap () returned 0xd20000 [0085.444] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x388) returned 0xd4bae8 [0085.444] lstrlenA (lpString="rsa_encrypt") returned 11 [0085.444] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0085.447] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0085.447] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0085.447] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0085.447] GetProcessHeap () returned 0xd20000 [0085.447] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0085.447] lstrlenA (lpString="010001") returned 6 [0085.447] GetProcessHeap () returned 0xd20000 [0085.447] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0085.447] GetProcessHeap () returned 0xd20000 [0085.447] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0085.447] GetProcessHeap () returned 0xd20000 [0085.447] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4adc8 [0085.447] GetProcessHeap () returned 0xd20000 [0085.447] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0085.447] GetProcessHeap () returned 0xd20000 [0085.448] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ad38 [0085.448] GetProcessHeap () returned 0xd20000 [0085.448] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45410 [0085.448] GetProcessHeap () returned 0xd20000 [0085.448] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cdb8 [0085.448] GetProcessHeap () returned 0xd20000 [0085.448] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0085.448] GetProcessHeap () returned 0xd20000 [0085.448] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.448] GetProcessHeap () returned 0xd20000 [0085.448] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0085.448] GetProcessHeap () returned 0xd20000 [0085.448] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0085.448] GetProcessHeap () returned 0xd20000 [0085.450] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44e98 [0085.450] GetProcessHeap () returned 0xd20000 [0085.450] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.450] GetProcessHeap () returned 0xd20000 [0085.450] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44678 [0085.450] GetProcessHeap () returned 0xd20000 [0085.450] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b878 [0085.450] GetProcessHeap () returned 0xd20000 [0085.450] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0085.450] GetProcessHeap () returned 0xd20000 [0085.450] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0085.450] GetProcessHeap () returned 0xd20000 [0085.450] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b878 | out: hHeap=0xd20000) returned 1 [0085.450] GetProcessHeap () returned 0xd20000 [0085.450] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0085.450] GetProcessHeap () returned 0xd20000 [0085.450] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444c8 [0085.450] GetProcessHeap () returned 0xd20000 [0085.450] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.451] GetProcessHeap () returned 0xd20000 [0085.451] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0085.451] GetProcessHeap () returned 0xd20000 [0085.451] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.451] GetProcessHeap () returned 0xd20000 [0085.451] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.451] GetProcessHeap () returned 0xd20000 [0085.451] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0085.451] GetProcessHeap () returned 0xd20000 [0085.451] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0085.451] GetProcessHeap () returned 0xd20000 [0085.451] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4ae58 [0085.451] GetProcessHeap () returned 0xd20000 [0085.451] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444c8 | out: hHeap=0xd20000) returned 1 [0085.451] GetProcessHeap () returned 0xd20000 [0085.451] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0085.451] GetProcessHeap () returned 0xd20000 [0085.451] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ae58 | out: hHeap=0xd20000) returned 1 [0085.451] GetProcessHeap () returned 0xd20000 [0085.452] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0085.452] GetProcessHeap () returned 0xd20000 [0085.452] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0085.452] GetProcessHeap () returned 0xd20000 [0085.452] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.452] GetProcessHeap () returned 0xd20000 [0085.452] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.452] GetProcessHeap () returned 0xd20000 [0085.452] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0085.452] GetProcessHeap () returned 0xd20000 [0085.452] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0085.452] GetProcessHeap () returned 0xd20000 [0085.452] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.452] GetProcessHeap () returned 0xd20000 [0085.452] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.452] GetProcessHeap () returned 0xd20000 [0085.452] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.452] GetProcessHeap () returned 0xd20000 [0085.452] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.453] GetProcessHeap () returned 0xd20000 [0085.453] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.453] GetProcessHeap () returned 0xd20000 [0085.453] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.453] GetProcessHeap () returned 0xd20000 [0085.453] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.453] GetProcessHeap () returned 0xd20000 [0085.453] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.453] GetProcessHeap () returned 0xd20000 [0085.453] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.453] GetProcessHeap () returned 0xd20000 [0085.453] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.453] GetProcessHeap () returned 0xd20000 [0085.453] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.453] GetProcessHeap () returned 0xd20000 [0085.453] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.453] GetProcessHeap () returned 0xd20000 [0085.453] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.453] GetProcessHeap () returned 0xd20000 [0085.454] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.454] GetProcessHeap () returned 0xd20000 [0085.454] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0085.454] GetProcessHeap () returned 0xd20000 [0085.454] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0085.454] GetProcessHeap () returned 0xd20000 [0085.454] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.454] GetProcessHeap () returned 0xd20000 [0085.454] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.454] GetProcessHeap () returned 0xd20000 [0085.454] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.454] GetProcessHeap () returned 0xd20000 [0085.454] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.454] GetProcessHeap () returned 0xd20000 [0085.454] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.454] GetProcessHeap () returned 0xd20000 [0085.454] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.454] GetProcessHeap () returned 0xd20000 [0085.454] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0085.455] GetProcessHeap () returned 0xd20000 [0085.455] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0085.455] GetProcessHeap () returned 0xd20000 [0085.455] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.455] GetProcessHeap () returned 0xd20000 [0085.455] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.455] GetProcessHeap () returned 0xd20000 [0085.455] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.455] GetProcessHeap () returned 0xd20000 [0085.455] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.455] GetProcessHeap () returned 0xd20000 [0085.455] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.455] GetProcessHeap () returned 0xd20000 [0085.455] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.455] GetProcessHeap () returned 0xd20000 [0085.455] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.455] GetProcessHeap () returned 0xd20000 [0085.455] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.455] GetProcessHeap () returned 0xd20000 [0085.456] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.456] GetProcessHeap () returned 0xd20000 [0085.456] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.456] GetProcessHeap () returned 0xd20000 [0085.456] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.456] GetProcessHeap () returned 0xd20000 [0085.456] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.456] GetProcessHeap () returned 0xd20000 [0085.456] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.456] GetProcessHeap () returned 0xd20000 [0085.456] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.456] GetProcessHeap () returned 0xd20000 [0085.456] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0085.456] GetProcessHeap () returned 0xd20000 [0085.456] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0085.456] GetProcessHeap () returned 0xd20000 [0085.456] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.456] GetProcessHeap () returned 0xd20000 [0085.457] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.457] GetProcessHeap () returned 0xd20000 [0085.457] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.457] GetProcessHeap () returned 0xd20000 [0085.457] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.457] GetProcessHeap () returned 0xd20000 [0085.457] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.457] GetProcessHeap () returned 0xd20000 [0085.457] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.457] GetProcessHeap () returned 0xd20000 [0085.457] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.457] GetProcessHeap () returned 0xd20000 [0085.457] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.457] GetProcessHeap () returned 0xd20000 [0085.457] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.457] GetProcessHeap () returned 0xd20000 [0085.457] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.457] GetProcessHeap () returned 0xd20000 [0085.457] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.458] GetProcessHeap () returned 0xd20000 [0085.458] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.458] GetProcessHeap () returned 0xd20000 [0085.458] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0085.458] GetProcessHeap () returned 0xd20000 [0085.458] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0085.458] GetProcessHeap () returned 0xd20000 [0085.458] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.458] GetProcessHeap () returned 0xd20000 [0085.458] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.458] GetProcessHeap () returned 0xd20000 [0085.458] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0085.458] GetProcessHeap () returned 0xd20000 [0085.458] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0085.458] GetProcessHeap () returned 0xd20000 [0085.458] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.458] GetProcessHeap () returned 0xd20000 [0085.458] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.459] GetProcessHeap () returned 0xd20000 [0085.459] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.459] GetProcessHeap () returned 0xd20000 [0085.459] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.459] GetProcessHeap () returned 0xd20000 [0085.459] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.459] GetProcessHeap () returned 0xd20000 [0085.459] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.459] GetProcessHeap () returned 0xd20000 [0085.459] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.459] GetProcessHeap () returned 0xd20000 [0085.459] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.459] GetProcessHeap () returned 0xd20000 [0085.459] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.459] GetProcessHeap () returned 0xd20000 [0085.459] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.459] GetProcessHeap () returned 0xd20000 [0085.459] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.459] GetProcessHeap () returned 0xd20000 [0085.460] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.460] GetProcessHeap () returned 0xd20000 [0085.460] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.460] GetProcessHeap () returned 0xd20000 [0085.460] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.460] GetProcessHeap () returned 0xd20000 [0085.460] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0085.460] GetProcessHeap () returned 0xd20000 [0085.460] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.460] GetProcessHeap () returned 0xd20000 [0085.460] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.460] GetProcessHeap () returned 0xd20000 [0085.460] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.460] GetProcessHeap () returned 0xd20000 [0085.460] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.460] GetProcessHeap () returned 0xd20000 [0085.460] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.460] GetProcessHeap () returned 0xd20000 [0085.460] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.461] GetProcessHeap () returned 0xd20000 [0085.461] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.461] GetProcessHeap () returned 0xd20000 [0085.461] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.461] GetProcessHeap () returned 0xd20000 [0085.461] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.461] GetProcessHeap () returned 0xd20000 [0085.461] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.461] GetProcessHeap () returned 0xd20000 [0085.461] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.461] GetProcessHeap () returned 0xd20000 [0085.461] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.461] GetProcessHeap () returned 0xd20000 [0085.461] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.461] GetProcessHeap () returned 0xd20000 [0085.461] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.461] GetProcessHeap () returned 0xd20000 [0085.461] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.461] GetProcessHeap () returned 0xd20000 [0085.461] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0085.462] GetProcessHeap () returned 0xd20000 [0085.462] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0085.462] GetProcessHeap () returned 0xd20000 [0085.462] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.462] GetProcessHeap () returned 0xd20000 [0085.462] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.462] GetProcessHeap () returned 0xd20000 [0085.462] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.462] GetProcessHeap () returned 0xd20000 [0085.462] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.462] GetProcessHeap () returned 0xd20000 [0085.462] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0085.462] GetProcessHeap () returned 0xd20000 [0085.462] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.462] GetProcessHeap () returned 0xd20000 [0085.462] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.462] GetProcessHeap () returned 0xd20000 [0085.462] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.463] GetProcessHeap () returned 0xd20000 [0085.463] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.463] GetProcessHeap () returned 0xd20000 [0085.463] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.463] GetProcessHeap () returned 0xd20000 [0085.463] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0085.463] GetProcessHeap () returned 0xd20000 [0085.463] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0085.463] GetProcessHeap () returned 0xd20000 [0085.463] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.463] GetProcessHeap () returned 0xd20000 [0085.463] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.463] GetProcessHeap () returned 0xd20000 [0085.463] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.463] GetProcessHeap () returned 0xd20000 [0085.463] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.463] GetProcessHeap () returned 0xd20000 [0085.463] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.464] GetProcessHeap () returned 0xd20000 [0085.464] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.464] GetProcessHeap () returned 0xd20000 [0085.464] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.464] GetProcessHeap () returned 0xd20000 [0085.464] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.464] GetProcessHeap () returned 0xd20000 [0085.465] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.465] GetProcessHeap () returned 0xd20000 [0085.465] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.465] GetProcessHeap () returned 0xd20000 [0085.465] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0085.465] GetProcessHeap () returned 0xd20000 [0085.465] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0085.465] GetProcessHeap () returned 0xd20000 [0085.465] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.465] GetProcessHeap () returned 0xd20000 [0085.465] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.465] GetProcessHeap () returned 0xd20000 [0085.465] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.465] GetProcessHeap () returned 0xd20000 [0085.465] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.465] GetProcessHeap () returned 0xd20000 [0085.465] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.465] GetProcessHeap () returned 0xd20000 [0085.466] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.466] GetProcessHeap () returned 0xd20000 [0085.466] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.466] GetProcessHeap () returned 0xd20000 [0085.466] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.466] GetProcessHeap () returned 0xd20000 [0085.466] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.466] GetProcessHeap () returned 0xd20000 [0085.466] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.466] GetProcessHeap () returned 0xd20000 [0085.466] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.466] GetProcessHeap () returned 0xd20000 [0085.466] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.466] GetProcessHeap () returned 0xd20000 [0085.466] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0085.466] GetProcessHeap () returned 0xd20000 [0085.466] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.466] GetProcessHeap () returned 0xd20000 [0085.466] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.467] GetProcessHeap () returned 0xd20000 [0085.467] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.467] GetProcessHeap () returned 0xd20000 [0085.467] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.467] GetProcessHeap () returned 0xd20000 [0085.467] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.467] GetProcessHeap () returned 0xd20000 [0085.467] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.467] GetProcessHeap () returned 0xd20000 [0085.467] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.467] GetProcessHeap () returned 0xd20000 [0085.467] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.467] GetProcessHeap () returned 0xd20000 [0085.467] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.467] GetProcessHeap () returned 0xd20000 [0085.467] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0085.467] GetProcessHeap () returned 0xd20000 [0085.467] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0085.467] GetProcessHeap () returned 0xd20000 [0085.468] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.468] GetProcessHeap () returned 0xd20000 [0085.468] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.468] GetProcessHeap () returned 0xd20000 [0085.468] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.468] GetProcessHeap () returned 0xd20000 [0085.468] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.468] GetProcessHeap () returned 0xd20000 [0085.468] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.468] GetProcessHeap () returned 0xd20000 [0085.468] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.468] GetProcessHeap () returned 0xd20000 [0085.468] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.468] GetProcessHeap () returned 0xd20000 [0085.468] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.468] GetProcessHeap () returned 0xd20000 [0085.468] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.469] GetProcessHeap () returned 0xd20000 [0085.469] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.469] GetProcessHeap () returned 0xd20000 [0085.469] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.469] GetProcessHeap () returned 0xd20000 [0085.469] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.469] GetProcessHeap () returned 0xd20000 [0085.469] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.469] GetProcessHeap () returned 0xd20000 [0085.469] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.469] GetProcessHeap () returned 0xd20000 [0085.469] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.469] GetProcessHeap () returned 0xd20000 [0085.469] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.469] GetProcessHeap () returned 0xd20000 [0085.469] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.469] GetProcessHeap () returned 0xd20000 [0085.469] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.469] GetProcessHeap () returned 0xd20000 [0085.470] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.470] GetProcessHeap () returned 0xd20000 [0085.470] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.470] GetProcessHeap () returned 0xd20000 [0085.470] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.470] GetProcessHeap () returned 0xd20000 [0085.470] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.470] GetProcessHeap () returned 0xd20000 [0085.470] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.470] GetProcessHeap () returned 0xd20000 [0085.470] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.470] GetProcessHeap () returned 0xd20000 [0085.470] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.470] GetProcessHeap () returned 0xd20000 [0085.470] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.470] GetProcessHeap () returned 0xd20000 [0085.470] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0085.470] GetProcessHeap () returned 0xd20000 [0085.470] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0085.470] GetProcessHeap () returned 0xd20000 [0085.471] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0085.471] GetProcessHeap () returned 0xd20000 [0085.471] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0085.471] GetProcessHeap () returned 0xd20000 [0085.471] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44678 | out: hHeap=0xd20000) returned 1 [0085.471] GetProcessHeap () returned 0xd20000 [0085.471] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ad38 | out: hHeap=0xd20000) returned 1 [0085.471] GetProcessHeap () returned 0xd20000 [0085.471] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0085.471] GetProcessHeap () returned 0xd20000 [0085.471] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4adc8 | out: hHeap=0xd20000) returned 1 [0085.471] GetProcessHeap () returned 0xd20000 [0085.471] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0085.471] GetProcessHeap () returned 0xd20000 [0085.471] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.471] GetProcessHeap () returned 0xd20000 [0085.471] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0085.471] WriteFile (in: hFile=0x230, lpBuffer=0xd4bae8*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4bae8*, lpNumberOfBytesWritten=0x299d864*=0x388, lpOverlapped=0x0) returned 1 [0085.481] GetProcessHeap () returned 0xd20000 [0085.481] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4bae8, Size=0x30) returned 0xd4bae8 [0085.481] GetProcessHeap () returned 0xd20000 [0085.482] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0085.482] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0085.482] GetProcessHeap () returned 0xd20000 [0085.482] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1bb0) returned 0xd4bb20 [0085.482] ReadFile (in: hFile=0x230, lpBuffer=0xd4bb20, nNumberOfBytesToRead=0x1bb0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4bb20*, lpNumberOfBytesRead=0x299d7e8*=0x1bb0, lpOverlapped=0x0) returned 1 [0085.483] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0085.484] WriteFile (in: hFile=0x230, lpBuffer=0xd4bb20*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4bb20*, lpNumberOfBytesWritten=0x299d7e4*=0x1bb0, lpOverlapped=0x0) returned 1 [0085.485] GetProcessHeap () returned 0xd20000 [0085.485] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bb20 | out: hHeap=0xd20000) returned 1 [0085.485] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0085.485] WriteFile (in: hFile=0x230, lpBuffer=0xd4bae8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4bae8*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0085.487] CloseHandle (hObject=0x230) returned 1 [0085.493] GetProcessHeap () returned 0xd20000 [0085.493] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42850 | out: hHeap=0xd20000) returned 1 [0085.493] GetProcessHeap () returned 0xd20000 [0085.493] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3c308 | out: hHeap=0xd20000) returned 1 [0085.493] GetProcessHeap () returned 0xd20000 [0085.493] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0085.493] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png") returned="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" [0085.493] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png.[ponce.lorena@aol.com]" [0085.493] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\bluelogo.png.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0085.494] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\bluelogo.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0085.494] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0085.494] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" [0085.494] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_recover.html")) returned 0x20 [0085.495] GetProcessHeap () returned 0xd20000 [0085.495] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446c0 | out: hHeap=0xd20000) returned 1 [0085.495] FindNextFileW (in: hFindFile=0xd49060, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b9dbd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b9dbd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bullet.png", cAlternateFileName="")) returned 1 [0085.495] lstrcmpiW (lpString1="bullet.png", lpString2=".") returned 1 [0085.495] lstrcmpiW (lpString1="bullet.png", lpString2="..") returned 1 [0085.495] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="bullet.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\bullet.png") returned="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" [0085.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bullet.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0085.495] GetProcessHeap () returned 0xd20000 [0085.495] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xb) returned 0xd44438 [0085.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bullet.png", cchWideChar=-1, lpMultiByteStr=0xd44438, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bullet.png", lpUsedDefaultChar=0x0) returned 11 [0085.496] lstrlenA (lpString="bullet.png") returned 10 [0085.496] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0085.496] lstrlenA (lpString="bullet.png") returned 10 [0085.496] lstrlenA (lpString=".dll") returned 4 [0085.496] lstrlenA (lpString=".dll") returned 4 [0085.496] lstrlenA (lpString="bullet.png") returned 10 [0085.496] lstrcmpiA (lpString1=".png", lpString2=".dll") returned 1 [0085.496] lstrlenA (lpString="bullet.png") returned 10 [0085.496] lstrlenA (lpString=".ini") returned 4 [0085.496] lstrlenA (lpString=".ini") returned 4 [0085.496] lstrlenA (lpString="bullet.png") returned 10 [0085.496] lstrcmpiA (lpString1=".png", lpString2=".ini") returned 1 [0085.496] lstrlenA (lpString="bullet.png") returned 10 [0085.496] lstrlenA (lpString=".inc") returned 4 [0085.497] lstrlenA (lpString=".inc") returned 4 [0085.497] lstrlenA (lpString="bullet.png") returned 10 [0085.497] lstrcmpiA (lpString1=".png", lpString2=".inc") returned 1 [0085.497] lstrcmpiW (lpString1="bullet.png", lpString2="HOW_RECOVER.html") returned -1 [0085.497] lstrcmpiW (lpString1="bullet.png", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0085.497] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0085.497] lstrcmpiW (lpString1="bullet.png", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0085.497] GetProcessHeap () returned 0xd20000 [0085.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42580 [0085.497] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0085.498] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=221) returned 1 [0085.498] GetProcessHeap () returned 0xd20000 [0085.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4be90 [0085.498] GetProcessHeap () returned 0xd20000 [0085.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0085.498] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\bullet.png") returned 43 [0085.498] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0085.498] GetProcessHeap () returned 0xd20000 [0085.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0085.498] GetProcessHeap () returned 0xd20000 [0085.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x383) returned 0xd4c328 [0085.498] lstrlenA (lpString="rsa_encrypt") returned 11 [0085.498] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0085.501] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0085.501] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0085.501] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0085.501] GetProcessHeap () returned 0xd20000 [0085.501] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0085.501] lstrlenA (lpString="010001") returned 6 [0085.501] GetProcessHeap () returned 0xd20000 [0085.501] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc98 [0085.501] GetProcessHeap () returned 0xd20000 [0085.501] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0085.501] GetProcessHeap () returned 0xd20000 [0085.501] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b488 [0085.501] GetProcessHeap () returned 0xd20000 [0085.501] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0085.501] GetProcessHeap () returned 0xd20000 [0085.501] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ac18 [0085.501] GetProcessHeap () returned 0xd20000 [0085.501] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45410 [0085.502] GetProcessHeap () returned 0xd20000 [0085.502] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cbd8 [0085.502] GetProcessHeap () returned 0xd20000 [0085.502] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0085.502] GetProcessHeap () returned 0xd20000 [0085.502] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0085.502] GetProcessHeap () returned 0xd20000 [0085.502] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0085.502] GetProcessHeap () returned 0xd20000 [0085.502] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0085.502] GetProcessHeap () returned 0xd20000 [0085.502] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44fb0 [0085.502] GetProcessHeap () returned 0xd20000 [0085.502] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.502] GetProcessHeap () returned 0xd20000 [0085.502] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44570 [0085.502] GetProcessHeap () returned 0xd20000 [0085.502] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b7e8 [0085.502] GetProcessHeap () returned 0xd20000 [0085.503] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0085.503] GetProcessHeap () returned 0xd20000 [0085.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0085.503] GetProcessHeap () returned 0xd20000 [0085.503] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0085.503] GetProcessHeap () returned 0xd20000 [0085.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.503] GetProcessHeap () returned 0xd20000 [0085.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44510 [0085.503] GetProcessHeap () returned 0xd20000 [0085.503] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.503] GetProcessHeap () returned 0xd20000 [0085.503] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.503] GetProcessHeap () returned 0xd20000 [0085.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0085.503] GetProcessHeap () returned 0xd20000 [0085.503] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0085.503] GetProcessHeap () returned 0xd20000 [0085.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.504] GetProcessHeap () returned 0xd20000 [0085.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.504] GetProcessHeap () returned 0xd20000 [0085.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b878 [0085.504] GetProcessHeap () returned 0xd20000 [0085.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44510 | out: hHeap=0xd20000) returned 1 [0085.504] GetProcessHeap () returned 0xd20000 [0085.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0085.504] GetProcessHeap () returned 0xd20000 [0085.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b878 | out: hHeap=0xd20000) returned 1 [0085.504] GetProcessHeap () returned 0xd20000 [0085.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0085.504] GetProcessHeap () returned 0xd20000 [0085.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.504] GetProcessHeap () returned 0xd20000 [0085.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.504] GetProcessHeap () returned 0xd20000 [0085.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.505] GetProcessHeap () returned 0xd20000 [0085.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0085.505] GetProcessHeap () returned 0xd20000 [0085.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0085.505] GetProcessHeap () returned 0xd20000 [0085.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.505] GetProcessHeap () returned 0xd20000 [0085.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.505] GetProcessHeap () returned 0xd20000 [0085.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.505] GetProcessHeap () returned 0xd20000 [0085.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.505] GetProcessHeap () returned 0xd20000 [0085.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.505] GetProcessHeap () returned 0xd20000 [0085.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.505] GetProcessHeap () returned 0xd20000 [0085.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.506] GetProcessHeap () returned 0xd20000 [0085.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.506] GetProcessHeap () returned 0xd20000 [0085.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.506] GetProcessHeap () returned 0xd20000 [0085.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.506] GetProcessHeap () returned 0xd20000 [0085.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.506] GetProcessHeap () returned 0xd20000 [0085.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.506] GetProcessHeap () returned 0xd20000 [0085.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.506] GetProcessHeap () returned 0xd20000 [0085.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.506] GetProcessHeap () returned 0xd20000 [0085.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.506] GetProcessHeap () returned 0xd20000 [0085.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.507] GetProcessHeap () returned 0xd20000 [0085.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0085.507] GetProcessHeap () returned 0xd20000 [0085.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0085.507] GetProcessHeap () returned 0xd20000 [0085.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.507] GetProcessHeap () returned 0xd20000 [0085.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.507] GetProcessHeap () returned 0xd20000 [0085.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.507] GetProcessHeap () returned 0xd20000 [0085.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.507] GetProcessHeap () returned 0xd20000 [0085.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.507] GetProcessHeap () returned 0xd20000 [0085.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.507] GetProcessHeap () returned 0xd20000 [0085.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.507] GetProcessHeap () returned 0xd20000 [0085.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.508] GetProcessHeap () returned 0xd20000 [0085.508] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.508] GetProcessHeap () returned 0xd20000 [0085.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.508] GetProcessHeap () returned 0xd20000 [0085.508] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.508] GetProcessHeap () returned 0xd20000 [0085.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.508] GetProcessHeap () returned 0xd20000 [0085.508] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.508] GetProcessHeap () returned 0xd20000 [0085.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.508] GetProcessHeap () returned 0xd20000 [0085.508] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.508] GetProcessHeap () returned 0xd20000 [0085.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.508] GetProcessHeap () returned 0xd20000 [0085.508] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.509] GetProcessHeap () returned 0xd20000 [0085.509] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.509] GetProcessHeap () returned 0xd20000 [0085.509] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.509] GetProcessHeap () returned 0xd20000 [0085.509] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.509] GetProcessHeap () returned 0xd20000 [0085.509] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.509] GetProcessHeap () returned 0xd20000 [0085.509] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.509] GetProcessHeap () returned 0xd20000 [0085.509] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.509] GetProcessHeap () returned 0xd20000 [0085.509] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.509] GetProcessHeap () returned 0xd20000 [0085.509] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.509] GetProcessHeap () returned 0xd20000 [0085.509] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.509] GetProcessHeap () returned 0xd20000 [0085.510] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0085.510] GetProcessHeap () returned 0xd20000 [0085.510] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.510] GetProcessHeap () returned 0xd20000 [0085.510] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.510] GetProcessHeap () returned 0xd20000 [0085.510] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.510] GetProcessHeap () returned 0xd20000 [0085.510] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0085.510] GetProcessHeap () returned 0xd20000 [0085.510] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.510] GetProcessHeap () returned 0xd20000 [0085.510] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.510] GetProcessHeap () returned 0xd20000 [0085.510] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.510] GetProcessHeap () returned 0xd20000 [0085.510] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.510] GetProcessHeap () returned 0xd20000 [0085.511] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.511] GetProcessHeap () returned 0xd20000 [0085.511] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.511] GetProcessHeap () returned 0xd20000 [0085.511] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.512] GetProcessHeap () returned 0xd20000 [0085.512] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.512] GetProcessHeap () returned 0xd20000 [0085.512] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.512] GetProcessHeap () returned 0xd20000 [0085.512] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0085.512] GetProcessHeap () returned 0xd20000 [0085.512] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0085.512] GetProcessHeap () returned 0xd20000 [0085.512] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.512] GetProcessHeap () returned 0xd20000 [0085.512] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.513] GetProcessHeap () returned 0xd20000 [0085.513] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.513] GetProcessHeap () returned 0xd20000 [0085.513] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.513] GetProcessHeap () returned 0xd20000 [0085.513] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.513] GetProcessHeap () returned 0xd20000 [0085.513] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.513] GetProcessHeap () returned 0xd20000 [0085.513] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.513] GetProcessHeap () returned 0xd20000 [0085.513] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.513] GetProcessHeap () returned 0xd20000 [0085.513] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0085.513] GetProcessHeap () returned 0xd20000 [0085.513] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0085.513] GetProcessHeap () returned 0xd20000 [0085.513] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.514] GetProcessHeap () returned 0xd20000 [0085.514] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.514] GetProcessHeap () returned 0xd20000 [0085.514] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.514] GetProcessHeap () returned 0xd20000 [0085.514] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.514] GetProcessHeap () returned 0xd20000 [0085.514] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.514] GetProcessHeap () returned 0xd20000 [0085.514] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.514] GetProcessHeap () returned 0xd20000 [0085.514] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.514] GetProcessHeap () returned 0xd20000 [0085.514] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.514] GetProcessHeap () returned 0xd20000 [0085.514] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0085.514] GetProcessHeap () returned 0xd20000 [0085.514] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0085.515] GetProcessHeap () returned 0xd20000 [0085.515] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.515] GetProcessHeap () returned 0xd20000 [0085.515] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.515] GetProcessHeap () returned 0xd20000 [0085.515] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.515] GetProcessHeap () returned 0xd20000 [0085.515] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.515] GetProcessHeap () returned 0xd20000 [0085.515] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.515] GetProcessHeap () returned 0xd20000 [0085.515] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.515] GetProcessHeap () returned 0xd20000 [0085.515] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.515] GetProcessHeap () returned 0xd20000 [0085.515] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.515] GetProcessHeap () returned 0xd20000 [0085.515] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.516] GetProcessHeap () returned 0xd20000 [0085.516] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.516] GetProcessHeap () returned 0xd20000 [0085.516] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.516] GetProcessHeap () returned 0xd20000 [0085.516] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.516] GetProcessHeap () returned 0xd20000 [0085.516] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.516] GetProcessHeap () returned 0xd20000 [0085.516] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.516] GetProcessHeap () returned 0xd20000 [0085.516] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.516] GetProcessHeap () returned 0xd20000 [0085.516] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.516] GetProcessHeap () returned 0xd20000 [0085.516] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.516] GetProcessHeap () returned 0xd20000 [0085.516] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.516] GetProcessHeap () returned 0xd20000 [0085.517] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.517] GetProcessHeap () returned 0xd20000 [0085.517] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.517] GetProcessHeap () returned 0xd20000 [0085.517] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0085.517] GetProcessHeap () returned 0xd20000 [0085.517] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0085.517] GetProcessHeap () returned 0xd20000 [0085.517] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.517] GetProcessHeap () returned 0xd20000 [0085.517] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.517] GetProcessHeap () returned 0xd20000 [0085.517] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.517] GetProcessHeap () returned 0xd20000 [0085.517] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.517] GetProcessHeap () returned 0xd20000 [0085.517] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.517] GetProcessHeap () returned 0xd20000 [0085.517] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.518] GetProcessHeap () returned 0xd20000 [0085.518] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0085.518] GetProcessHeap () returned 0xd20000 [0085.518] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0085.518] GetProcessHeap () returned 0xd20000 [0085.518] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.518] GetProcessHeap () returned 0xd20000 [0085.518] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.518] GetProcessHeap () returned 0xd20000 [0085.518] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.518] GetProcessHeap () returned 0xd20000 [0085.518] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.518] GetProcessHeap () returned 0xd20000 [0085.518] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.518] GetProcessHeap () returned 0xd20000 [0085.518] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.518] GetProcessHeap () returned 0xd20000 [0085.518] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.518] GetProcessHeap () returned 0xd20000 [0085.519] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.519] GetProcessHeap () returned 0xd20000 [0085.519] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.519] GetProcessHeap () returned 0xd20000 [0085.519] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.519] GetProcessHeap () returned 0xd20000 [0085.519] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.519] GetProcessHeap () returned 0xd20000 [0085.519] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.519] GetProcessHeap () returned 0xd20000 [0085.519] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.519] GetProcessHeap () returned 0xd20000 [0085.519] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.519] GetProcessHeap () returned 0xd20000 [0085.519] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.519] GetProcessHeap () returned 0xd20000 [0085.519] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.519] GetProcessHeap () returned 0xd20000 [0085.519] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.520] GetProcessHeap () returned 0xd20000 [0085.520] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.520] GetProcessHeap () returned 0xd20000 [0085.520] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.520] GetProcessHeap () returned 0xd20000 [0085.520] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.520] GetProcessHeap () returned 0xd20000 [0085.520] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.520] GetProcessHeap () returned 0xd20000 [0085.520] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.520] GetProcessHeap () returned 0xd20000 [0085.520] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.520] GetProcessHeap () returned 0xd20000 [0085.520] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.520] GetProcessHeap () returned 0xd20000 [0085.520] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.520] GetProcessHeap () returned 0xd20000 [0085.520] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.521] GetProcessHeap () returned 0xd20000 [0085.521] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.521] GetProcessHeap () returned 0xd20000 [0085.521] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.521] GetProcessHeap () returned 0xd20000 [0085.521] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.521] GetProcessHeap () returned 0xd20000 [0085.521] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.521] GetProcessHeap () returned 0xd20000 [0085.521] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.521] GetProcessHeap () returned 0xd20000 [0085.521] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.521] GetProcessHeap () returned 0xd20000 [0085.521] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.521] GetProcessHeap () returned 0xd20000 [0085.521] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.521] GetProcessHeap () returned 0xd20000 [0085.521] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.521] GetProcessHeap () returned 0xd20000 [0085.522] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.522] GetProcessHeap () returned 0xd20000 [0085.522] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.522] GetProcessHeap () returned 0xd20000 [0085.522] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.522] GetProcessHeap () returned 0xd20000 [0085.522] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.522] GetProcessHeap () returned 0xd20000 [0085.522] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.522] GetProcessHeap () returned 0xd20000 [0085.522] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.522] GetProcessHeap () returned 0xd20000 [0085.522] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.522] GetProcessHeap () returned 0xd20000 [0085.522] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.522] GetProcessHeap () returned 0xd20000 [0085.522] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.522] GetProcessHeap () returned 0xd20000 [0085.522] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.523] GetProcessHeap () returned 0xd20000 [0085.523] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.523] GetProcessHeap () returned 0xd20000 [0085.523] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.523] GetProcessHeap () returned 0xd20000 [0085.523] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.523] GetProcessHeap () returned 0xd20000 [0085.523] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.523] GetProcessHeap () returned 0xd20000 [0085.523] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.523] GetProcessHeap () returned 0xd20000 [0085.523] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.523] GetProcessHeap () returned 0xd20000 [0085.523] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.523] GetProcessHeap () returned 0xd20000 [0085.523] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.523] GetProcessHeap () returned 0xd20000 [0085.523] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.523] GetProcessHeap () returned 0xd20000 [0085.524] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0085.524] GetProcessHeap () returned 0xd20000 [0085.524] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0085.524] GetProcessHeap () returned 0xd20000 [0085.524] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0085.524] GetProcessHeap () returned 0xd20000 [0085.524] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0085.524] GetProcessHeap () returned 0xd20000 [0085.524] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44570 | out: hHeap=0xd20000) returned 1 [0085.524] GetProcessHeap () returned 0xd20000 [0085.524] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ac18 | out: hHeap=0xd20000) returned 1 [0085.524] GetProcessHeap () returned 0xd20000 [0085.524] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0085.524] GetProcessHeap () returned 0xd20000 [0085.524] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b488 | out: hHeap=0xd20000) returned 1 [0085.524] GetProcessHeap () returned 0xd20000 [0085.524] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0085.524] GetProcessHeap () returned 0xd20000 [0085.525] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.525] GetProcessHeap () returned 0xd20000 [0085.525] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0085.525] WriteFile (in: hFile=0x230, lpBuffer=0xd4c328*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4c328*, lpNumberOfBytesWritten=0x299d864*=0x383, lpOverlapped=0x0) returned 1 [0085.535] GetProcessHeap () returned 0xd20000 [0085.535] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4c328, Size=0x30) returned 0xd4c328 [0085.535] GetProcessHeap () returned 0xd20000 [0085.535] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0085.535] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0085.535] GetProcessHeap () returned 0xd20000 [0085.536] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xe0) returned 0xd31b00 [0085.536] ReadFile (in: hFile=0x230, lpBuffer=0xd31b00, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd31b00*, lpNumberOfBytesRead=0x299d7e8*=0xe0, lpOverlapped=0x0) returned 1 [0085.536] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0085.536] WriteFile (in: hFile=0x230, lpBuffer=0xd31b00*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd31b00*, lpNumberOfBytesWritten=0x299d7e4*=0xe0, lpOverlapped=0x0) returned 1 [0085.539] GetProcessHeap () returned 0xd20000 [0085.539] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd31b00 | out: hHeap=0xd20000) returned 1 [0085.539] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0085.539] WriteFile (in: hFile=0x230, lpBuffer=0xd4c328*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4c328*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0085.541] CloseHandle (hObject=0x230) returned 1 [0085.543] GetProcessHeap () returned 0xd20000 [0085.543] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42580 | out: hHeap=0xd20000) returned 1 [0085.543] GetProcessHeap () returned 0xd20000 [0085.543] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4be90 | out: hHeap=0xd20000) returned 1 [0085.544] GetProcessHeap () returned 0xd20000 [0085.544] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0085.544] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\bullet.png") returned="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" [0085.544] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\bullet.png", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\bullet.png.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\bullet.png.[ponce.lorena@aol.com]" [0085.544] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\bullet.png.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\bullet.png.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0085.545] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\bullet.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0085.545] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0085.545] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" [0085.545] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_recover.html")) returned 0x20 [0085.545] GetProcessHeap () returned 0xd20000 [0085.545] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44438 | out: hHeap=0xd20000) returned 1 [0085.545] FindNextFileW (in: hFindFile=0xd49060, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bb141, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bb141, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1687, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="default.css", cAlternateFileName="")) returned 1 [0085.545] lstrcmpiW (lpString1="default.css", lpString2=".") returned 1 [0085.545] lstrcmpiW (lpString1="default.css", lpString2="..") returned 1 [0085.545] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="default.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default.css") returned="C:\\Windows10Upgrade\\resources\\ux\\default.css" [0085.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default.css", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0085.545] GetProcessHeap () returned 0xd20000 [0085.545] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd44408 [0085.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default.css", cchWideChar=-1, lpMultiByteStr=0xd44408, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="default.css", lpUsedDefaultChar=0x0) returned 12 [0085.545] lstrlenA (lpString="default.css") returned 11 [0085.545] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0085.545] lstrlenA (lpString="default.css") returned 11 [0085.546] lstrlenA (lpString=".dll") returned 4 [0085.546] lstrlenA (lpString=".dll") returned 4 [0085.546] lstrlenA (lpString="default.css") returned 11 [0085.546] lstrcmpiA (lpString1=".css", lpString2=".dll") returned -1 [0085.546] lstrlenA (lpString="default.css") returned 11 [0085.546] lstrlenA (lpString=".ini") returned 4 [0085.546] lstrlenA (lpString=".ini") returned 4 [0085.546] lstrlenA (lpString="default.css") returned 11 [0085.546] lstrcmpiA (lpString1=".css", lpString2=".ini") returned -1 [0085.546] lstrlenA (lpString="default.css") returned 11 [0085.546] lstrlenA (lpString=".inc") returned 4 [0085.546] lstrlenA (lpString=".inc") returned 4 [0085.546] lstrlenA (lpString="default.css") returned 11 [0085.546] lstrcmpiA (lpString1=".css", lpString2=".inc") returned -1 [0085.546] lstrcmpiW (lpString1="default.css", lpString2="HOW_RECOVER.html") returned -1 [0085.546] lstrcmpiW (lpString1="default.css", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0085.546] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0085.546] lstrcmpiW (lpString1="default.css", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0085.546] GetProcessHeap () returned 0xd20000 [0085.546] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42828 [0085.546] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0085.547] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=5767) returned 1 [0085.547] GetProcessHeap () returned 0xd20000 [0085.547] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4be90 [0085.547] GetProcessHeap () returned 0xd20000 [0085.547] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0085.547] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\default.css") returned 44 [0085.547] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0085.547] GetProcessHeap () returned 0xd20000 [0085.547] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0085.547] GetProcessHeap () returned 0xd20000 [0085.547] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x389) returned 0xd4c360 [0085.548] lstrlenA (lpString="rsa_encrypt") returned 11 [0085.548] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0085.549] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0085.550] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0085.550] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0085.550] GetProcessHeap () returned 0xd20000 [0085.550] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0085.550] lstrlenA (lpString="010001") returned 6 [0085.550] GetProcessHeap () returned 0xd20000 [0085.550] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc28 [0085.550] GetProcessHeap () returned 0xd20000 [0085.550] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0085.550] GetProcessHeap () returned 0xd20000 [0085.550] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aca8 [0085.550] GetProcessHeap () returned 0xd20000 [0085.550] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0085.550] GetProcessHeap () returned 0xd20000 [0085.550] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0085.550] GetProcessHeap () returned 0xd20000 [0085.550] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44920 [0085.550] GetProcessHeap () returned 0xd20000 [0085.550] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc58 [0085.550] GetProcessHeap () returned 0xd20000 [0085.550] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0085.551] GetProcessHeap () returned 0xd20000 [0085.551] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.551] GetProcessHeap () returned 0xd20000 [0085.551] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0085.551] GetProcessHeap () returned 0xd20000 [0085.551] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0085.551] GetProcessHeap () returned 0xd20000 [0085.551] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd450c8 [0085.551] GetProcessHeap () returned 0xd20000 [0085.551] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0085.551] GetProcessHeap () returned 0xd20000 [0085.551] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44558 [0085.551] GetProcessHeap () returned 0xd20000 [0085.551] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b1b8 [0085.551] GetProcessHeap () returned 0xd20000 [0085.551] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0085.551] GetProcessHeap () returned 0xd20000 [0085.551] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0085.551] GetProcessHeap () returned 0xd20000 [0085.551] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b1b8 | out: hHeap=0xd20000) returned 1 [0085.552] GetProcessHeap () returned 0xd20000 [0085.552] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.552] GetProcessHeap () returned 0xd20000 [0085.552] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44690 [0085.552] GetProcessHeap () returned 0xd20000 [0085.552] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0085.552] GetProcessHeap () returned 0xd20000 [0085.552] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.552] GetProcessHeap () returned 0xd20000 [0085.552] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.552] GetProcessHeap () returned 0xd20000 [0085.552] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.552] GetProcessHeap () returned 0xd20000 [0085.552] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.552] GetProcessHeap () returned 0xd20000 [0085.552] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.552] GetProcessHeap () returned 0xd20000 [0085.552] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4a9d8 [0085.552] GetProcessHeap () returned 0xd20000 [0085.553] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44690 | out: hHeap=0xd20000) returned 1 [0085.553] GetProcessHeap () returned 0xd20000 [0085.553] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0085.553] GetProcessHeap () returned 0xd20000 [0085.553] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a9d8 | out: hHeap=0xd20000) returned 1 [0085.553] GetProcessHeap () returned 0xd20000 [0085.553] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.553] GetProcessHeap () returned 0xd20000 [0085.553] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.553] GetProcessHeap () returned 0xd20000 [0085.553] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.553] GetProcessHeap () returned 0xd20000 [0085.553] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.553] GetProcessHeap () returned 0xd20000 [0085.553] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0085.553] GetProcessHeap () returned 0xd20000 [0085.553] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0085.553] GetProcessHeap () returned 0xd20000 [0085.553] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.553] GetProcessHeap () returned 0xd20000 [0085.553] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.554] GetProcessHeap () returned 0xd20000 [0085.554] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.554] GetProcessHeap () returned 0xd20000 [0085.554] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.554] GetProcessHeap () returned 0xd20000 [0085.554] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.554] GetProcessHeap () returned 0xd20000 [0085.554] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.554] GetProcessHeap () returned 0xd20000 [0085.554] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.554] GetProcessHeap () returned 0xd20000 [0085.554] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.554] GetProcessHeap () returned 0xd20000 [0085.554] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.554] GetProcessHeap () returned 0xd20000 [0085.554] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.554] GetProcessHeap () returned 0xd20000 [0085.554] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.554] GetProcessHeap () returned 0xd20000 [0085.554] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.554] GetProcessHeap () returned 0xd20000 [0085.554] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.555] GetProcessHeap () returned 0xd20000 [0085.555] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.555] GetProcessHeap () returned 0xd20000 [0085.555] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0085.555] GetProcessHeap () returned 0xd20000 [0085.555] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0085.555] GetProcessHeap () returned 0xd20000 [0085.555] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.555] GetProcessHeap () returned 0xd20000 [0085.555] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.555] GetProcessHeap () returned 0xd20000 [0085.555] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.555] GetProcessHeap () returned 0xd20000 [0085.555] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.555] GetProcessHeap () returned 0xd20000 [0085.555] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.555] GetProcessHeap () returned 0xd20000 [0085.555] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.555] GetProcessHeap () returned 0xd20000 [0085.555] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.555] GetProcessHeap () returned 0xd20000 [0085.556] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.556] GetProcessHeap () returned 0xd20000 [0085.556] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.556] GetProcessHeap () returned 0xd20000 [0085.556] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.556] GetProcessHeap () returned 0xd20000 [0085.556] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.556] GetProcessHeap () returned 0xd20000 [0085.556] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.556] GetProcessHeap () returned 0xd20000 [0085.556] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0085.556] GetProcessHeap () returned 0xd20000 [0085.556] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0085.556] GetProcessHeap () returned 0xd20000 [0085.556] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.556] GetProcessHeap () returned 0xd20000 [0085.556] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.556] GetProcessHeap () returned 0xd20000 [0085.556] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.556] GetProcessHeap () returned 0xd20000 [0085.556] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.557] GetProcessHeap () returned 0xd20000 [0085.557] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.557] GetProcessHeap () returned 0xd20000 [0085.557] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.557] GetProcessHeap () returned 0xd20000 [0085.557] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.557] GetProcessHeap () returned 0xd20000 [0085.557] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.557] GetProcessHeap () returned 0xd20000 [0085.557] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.557] GetProcessHeap () returned 0xd20000 [0085.557] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.557] GetProcessHeap () returned 0xd20000 [0085.557] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.557] GetProcessHeap () returned 0xd20000 [0085.557] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.557] GetProcessHeap () returned 0xd20000 [0085.557] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.557] GetProcessHeap () returned 0xd20000 [0085.557] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.557] GetProcessHeap () returned 0xd20000 [0085.558] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.558] GetProcessHeap () returned 0xd20000 [0085.558] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.558] GetProcessHeap () returned 0xd20000 [0085.558] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.558] GetProcessHeap () returned 0xd20000 [0085.558] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.558] GetProcessHeap () returned 0xd20000 [0085.558] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0085.558] GetProcessHeap () returned 0xd20000 [0085.558] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.559] GetProcessHeap () returned 0xd20000 [0085.559] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.559] GetProcessHeap () returned 0xd20000 [0085.559] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.559] GetProcessHeap () returned 0xd20000 [0085.559] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.559] GetProcessHeap () returned 0xd20000 [0085.559] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.559] GetProcessHeap () returned 0xd20000 [0085.559] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.559] GetProcessHeap () returned 0xd20000 [0085.559] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.559] GetProcessHeap () returned 0xd20000 [0085.559] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.559] GetProcessHeap () returned 0xd20000 [0085.559] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.559] GetProcessHeap () returned 0xd20000 [0085.559] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.559] GetProcessHeap () returned 0xd20000 [0085.559] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.560] GetProcessHeap () returned 0xd20000 [0085.560] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.560] GetProcessHeap () returned 0xd20000 [0085.560] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.560] GetProcessHeap () returned 0xd20000 [0085.560] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.560] GetProcessHeap () returned 0xd20000 [0085.560] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.560] GetProcessHeap () returned 0xd20000 [0085.560] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0085.560] GetProcessHeap () returned 0xd20000 [0085.560] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0085.560] GetProcessHeap () returned 0xd20000 [0085.560] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.560] GetProcessHeap () returned 0xd20000 [0085.560] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.560] GetProcessHeap () returned 0xd20000 [0085.560] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.560] GetProcessHeap () returned 0xd20000 [0085.560] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.560] GetProcessHeap () returned 0xd20000 [0085.561] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0085.561] GetProcessHeap () returned 0xd20000 [0085.561] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.561] GetProcessHeap () returned 0xd20000 [0085.561] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.561] GetProcessHeap () returned 0xd20000 [0085.561] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.561] GetProcessHeap () returned 0xd20000 [0085.561] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.561] GetProcessHeap () returned 0xd20000 [0085.561] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.561] GetProcessHeap () returned 0xd20000 [0085.561] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0085.561] GetProcessHeap () returned 0xd20000 [0085.561] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0085.561] GetProcessHeap () returned 0xd20000 [0085.561] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.561] GetProcessHeap () returned 0xd20000 [0085.561] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.561] GetProcessHeap () returned 0xd20000 [0085.561] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.561] GetProcessHeap () returned 0xd20000 [0085.562] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.562] GetProcessHeap () returned 0xd20000 [0085.562] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.562] GetProcessHeap () returned 0xd20000 [0085.562] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.562] GetProcessHeap () returned 0xd20000 [0085.562] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.562] GetProcessHeap () returned 0xd20000 [0085.562] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.562] GetProcessHeap () returned 0xd20000 [0085.562] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.562] GetProcessHeap () returned 0xd20000 [0085.562] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.562] GetProcessHeap () returned 0xd20000 [0085.562] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0085.562] GetProcessHeap () returned 0xd20000 [0085.562] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0085.562] GetProcessHeap () returned 0xd20000 [0085.562] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.562] GetProcessHeap () returned 0xd20000 [0085.562] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.563] GetProcessHeap () returned 0xd20000 [0085.563] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.563] GetProcessHeap () returned 0xd20000 [0085.563] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.563] GetProcessHeap () returned 0xd20000 [0085.563] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.563] GetProcessHeap () returned 0xd20000 [0085.563] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.563] GetProcessHeap () returned 0xd20000 [0085.563] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.563] GetProcessHeap () returned 0xd20000 [0085.563] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.563] GetProcessHeap () returned 0xd20000 [0085.563] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.563] GetProcessHeap () returned 0xd20000 [0085.563] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.563] GetProcessHeap () returned 0xd20000 [0085.563] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.563] GetProcessHeap () returned 0xd20000 [0085.563] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.564] GetProcessHeap () returned 0xd20000 [0085.564] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0085.564] GetProcessHeap () returned 0xd20000 [0085.564] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.564] GetProcessHeap () returned 0xd20000 [0085.564] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.564] GetProcessHeap () returned 0xd20000 [0085.564] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.564] GetProcessHeap () returned 0xd20000 [0085.564] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.564] GetProcessHeap () returned 0xd20000 [0085.564] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.564] GetProcessHeap () returned 0xd20000 [0085.564] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.564] GetProcessHeap () returned 0xd20000 [0085.564] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.564] GetProcessHeap () returned 0xd20000 [0085.564] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.564] GetProcessHeap () returned 0xd20000 [0085.564] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.564] GetProcessHeap () returned 0xd20000 [0085.564] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0085.565] GetProcessHeap () returned 0xd20000 [0085.565] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0085.565] GetProcessHeap () returned 0xd20000 [0085.565] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.565] GetProcessHeap () returned 0xd20000 [0085.565] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.565] GetProcessHeap () returned 0xd20000 [0085.565] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.565] GetProcessHeap () returned 0xd20000 [0085.565] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.565] GetProcessHeap () returned 0xd20000 [0085.565] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.565] GetProcessHeap () returned 0xd20000 [0085.565] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.565] GetProcessHeap () returned 0xd20000 [0085.565] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.565] GetProcessHeap () returned 0xd20000 [0085.565] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.565] GetProcessHeap () returned 0xd20000 [0085.565] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.565] GetProcessHeap () returned 0xd20000 [0085.565] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.565] GetProcessHeap () returned 0xd20000 [0085.566] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.566] GetProcessHeap () returned 0xd20000 [0085.566] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.566] GetProcessHeap () returned 0xd20000 [0085.566] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.566] GetProcessHeap () returned 0xd20000 [0085.566] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.566] GetProcessHeap () returned 0xd20000 [0085.566] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.566] GetProcessHeap () returned 0xd20000 [0085.566] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.566] GetProcessHeap () returned 0xd20000 [0085.566] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.566] GetProcessHeap () returned 0xd20000 [0085.566] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.566] GetProcessHeap () returned 0xd20000 [0085.566] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.566] GetProcessHeap () returned 0xd20000 [0085.566] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.567] GetProcessHeap () returned 0xd20000 [0085.567] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.567] GetProcessHeap () returned 0xd20000 [0085.567] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.567] GetProcessHeap () returned 0xd20000 [0085.567] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.567] GetProcessHeap () returned 0xd20000 [0085.567] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.567] GetProcessHeap () returned 0xd20000 [0085.567] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.567] GetProcessHeap () returned 0xd20000 [0085.567] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.567] GetProcessHeap () returned 0xd20000 [0085.567] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.567] GetProcessHeap () returned 0xd20000 [0085.567] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.567] GetProcessHeap () returned 0xd20000 [0085.567] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0085.568] GetProcessHeap () returned 0xd20000 [0085.568] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0085.568] GetProcessHeap () returned 0xd20000 [0085.568] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.568] GetProcessHeap () returned 0xd20000 [0085.568] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.568] GetProcessHeap () returned 0xd20000 [0085.568] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.568] GetProcessHeap () returned 0xd20000 [0085.568] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.568] GetProcessHeap () returned 0xd20000 [0085.568] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.568] GetProcessHeap () returned 0xd20000 [0085.568] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.568] GetProcessHeap () returned 0xd20000 [0085.568] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.568] GetProcessHeap () returned 0xd20000 [0085.568] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.569] GetProcessHeap () returned 0xd20000 [0085.569] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.569] GetProcessHeap () returned 0xd20000 [0085.569] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.569] GetProcessHeap () returned 0xd20000 [0085.569] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.569] GetProcessHeap () returned 0xd20000 [0085.569] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.569] GetProcessHeap () returned 0xd20000 [0085.569] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.569] GetProcessHeap () returned 0xd20000 [0085.569] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.569] GetProcessHeap () returned 0xd20000 [0085.569] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.569] GetProcessHeap () returned 0xd20000 [0085.569] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.569] GetProcessHeap () returned 0xd20000 [0085.570] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.570] GetProcessHeap () returned 0xd20000 [0085.570] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.570] GetProcessHeap () returned 0xd20000 [0085.570] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.570] GetProcessHeap () returned 0xd20000 [0085.570] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.570] GetProcessHeap () returned 0xd20000 [0085.570] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0085.570] GetProcessHeap () returned 0xd20000 [0085.570] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0085.570] GetProcessHeap () returned 0xd20000 [0085.570] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0085.570] GetProcessHeap () returned 0xd20000 [0085.570] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0085.570] GetProcessHeap () returned 0xd20000 [0085.570] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44558 | out: hHeap=0xd20000) returned 1 [0085.570] GetProcessHeap () returned 0xd20000 [0085.571] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0085.571] GetProcessHeap () returned 0xd20000 [0085.571] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0085.571] GetProcessHeap () returned 0xd20000 [0085.571] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aca8 | out: hHeap=0xd20000) returned 1 [0085.571] GetProcessHeap () returned 0xd20000 [0085.571] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0085.571] GetProcessHeap () returned 0xd20000 [0085.571] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0085.571] GetProcessHeap () returned 0xd20000 [0085.571] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0085.571] WriteFile (in: hFile=0x230, lpBuffer=0xd4c360*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4c360*, lpNumberOfBytesWritten=0x299d864*=0x389, lpOverlapped=0x0) returned 1 [0085.578] GetProcessHeap () returned 0xd20000 [0085.578] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4c360, Size=0x30) returned 0xd4c360 [0085.578] GetProcessHeap () returned 0xd20000 [0085.578] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0085.579] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0085.579] GetProcessHeap () returned 0xd20000 [0085.579] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1690) returned 0xd4c398 [0085.579] ReadFile (in: hFile=0x230, lpBuffer=0xd4c398, nNumberOfBytesToRead=0x1690, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4c398*, lpNumberOfBytesRead=0x299d7e8*=0x1690, lpOverlapped=0x0) returned 1 [0085.580] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0085.580] WriteFile (in: hFile=0x230, lpBuffer=0xd4c398*, nNumberOfBytesToWrite=0x1690, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4c398*, lpNumberOfBytesWritten=0x299d7e4*=0x1690, lpOverlapped=0x0) returned 1 [0085.582] GetProcessHeap () returned 0xd20000 [0085.582] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c398 | out: hHeap=0xd20000) returned 1 [0085.582] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0085.582] WriteFile (in: hFile=0x230, lpBuffer=0xd4c360*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4c360*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0085.584] CloseHandle (hObject=0x230) returned 1 [0085.591] GetProcessHeap () returned 0xd20000 [0085.591] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42828 | out: hHeap=0xd20000) returned 1 [0085.592] GetProcessHeap () returned 0xd20000 [0085.592] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4be90 | out: hHeap=0xd20000) returned 1 [0085.592] GetProcessHeap () returned 0xd20000 [0085.592] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0085.592] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\default.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default.css") returned="C:\\Windows10Upgrade\\resources\\ux\\default.css" [0085.592] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default.css", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default.css.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\default.css.[ponce.lorena@aol.com]" [0085.592] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.css"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default.css.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.css.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0085.593] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\default.css" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0085.593] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0085.593] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" [0085.593] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_recover.html")) returned 0x20 [0085.593] GetProcessHeap () returned 0xd20000 [0085.593] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44408 | out: hHeap=0xd20000) returned 1 [0085.593] FindNextFileW (in: hFindFile=0xd49060, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bc4cd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bc4cd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xf44d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="default.htm", cAlternateFileName="")) returned 1 [0085.593] lstrcmpiW (lpString1="default.htm", lpString2=".") returned 1 [0085.593] lstrcmpiW (lpString1="default.htm", lpString2="..") returned 1 [0085.593] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="default.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\default.htm" [0085.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0085.594] GetProcessHeap () returned 0xd20000 [0085.594] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd446c0 [0085.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default.htm", cchWideChar=-1, lpMultiByteStr=0xd446c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="default.htm", lpUsedDefaultChar=0x0) returned 12 [0085.594] lstrlenA (lpString="default.htm") returned 11 [0085.594] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0085.594] lstrlenA (lpString="default.htm") returned 11 [0085.594] lstrlenA (lpString=".dll") returned 4 [0085.594] lstrlenA (lpString=".dll") returned 4 [0085.594] lstrlenA (lpString="default.htm") returned 11 [0085.594] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0085.594] lstrlenA (lpString="default.htm") returned 11 [0085.594] lstrlenA (lpString=".ini") returned 4 [0085.594] lstrlenA (lpString=".ini") returned 4 [0085.594] lstrlenA (lpString="default.htm") returned 11 [0085.594] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0085.594] lstrlenA (lpString="default.htm") returned 11 [0085.594] lstrlenA (lpString=".inc") returned 4 [0085.594] lstrlenA (lpString=".inc") returned 4 [0085.595] lstrlenA (lpString="default.htm") returned 11 [0085.595] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0085.595] lstrcmpiW (lpString1="default.htm", lpString2="HOW_RECOVER.html") returned -1 [0085.595] lstrcmpiW (lpString1="default.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0085.595] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0085.595] lstrcmpiW (lpString1="default.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0085.595] GetProcessHeap () returned 0xd20000 [0085.595] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd426c0 [0085.595] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0085.595] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=62541) returned 1 [0085.596] GetProcessHeap () returned 0xd20000 [0085.596] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4be90 [0085.596] GetProcessHeap () returned 0xd20000 [0085.596] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0085.596] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\default.htm") returned 44 [0085.596] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0085.596] GetProcessHeap () returned 0xd20000 [0085.596] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0085.596] GetProcessHeap () returned 0xd20000 [0085.596] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4c398 [0085.596] lstrlenA (lpString="rsa_encrypt") returned 11 [0085.596] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0085.598] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0085.598] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0085.598] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0085.598] GetProcessHeap () returned 0xd20000 [0085.599] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0085.599] lstrlenA (lpString="010001") returned 6 [0085.599] GetProcessHeap () returned 0xd20000 [0085.599] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cbc8 [0085.599] GetProcessHeap () returned 0xd20000 [0085.599] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0085.599] GetProcessHeap () returned 0xd20000 [0085.599] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aee8 [0085.599] GetProcessHeap () returned 0xd20000 [0085.599] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0085.599] GetProcessHeap () returned 0xd20000 [0085.599] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ab88 [0085.599] GetProcessHeap () returned 0xd20000 [0085.599] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44b50 [0085.599] GetProcessHeap () returned 0xd20000 [0085.599] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cdb8 [0085.599] GetProcessHeap () returned 0xd20000 [0085.600] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0085.600] GetProcessHeap () returned 0xd20000 [0085.600] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.600] GetProcessHeap () returned 0xd20000 [0085.600] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44c68 [0085.600] GetProcessHeap () returned 0xd20000 [0085.600] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0085.600] GetProcessHeap () returned 0xd20000 [0085.600] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44808 [0085.600] GetProcessHeap () returned 0xd20000 [0085.600] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0085.600] GetProcessHeap () returned 0xd20000 [0085.600] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44510 [0085.600] GetProcessHeap () returned 0xd20000 [0085.600] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b1b8 [0085.600] GetProcessHeap () returned 0xd20000 [0085.600] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0085.600] GetProcessHeap () returned 0xd20000 [0085.600] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0085.600] GetProcessHeap () returned 0xd20000 [0085.601] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b1b8 | out: hHeap=0xd20000) returned 1 [0085.601] GetProcessHeap () returned 0xd20000 [0085.601] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.601] GetProcessHeap () returned 0xd20000 [0085.601] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446f0 [0085.601] GetProcessHeap () returned 0xd20000 [0085.601] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0085.601] GetProcessHeap () returned 0xd20000 [0085.601] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.601] GetProcessHeap () returned 0xd20000 [0085.601] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.601] GetProcessHeap () returned 0xd20000 [0085.601] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.601] GetProcessHeap () returned 0xd20000 [0085.601] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.601] GetProcessHeap () returned 0xd20000 [0085.601] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.601] GetProcessHeap () returned 0xd20000 [0085.601] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b128 [0085.602] GetProcessHeap () returned 0xd20000 [0085.602] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446f0 | out: hHeap=0xd20000) returned 1 [0085.602] GetProcessHeap () returned 0xd20000 [0085.602] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0085.602] GetProcessHeap () returned 0xd20000 [0085.602] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b128 | out: hHeap=0xd20000) returned 1 [0085.602] GetProcessHeap () returned 0xd20000 [0085.602] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.602] GetProcessHeap () returned 0xd20000 [0085.602] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.602] GetProcessHeap () returned 0xd20000 [0085.602] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.602] GetProcessHeap () returned 0xd20000 [0085.602] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.602] GetProcessHeap () returned 0xd20000 [0085.602] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.602] GetProcessHeap () returned 0xd20000 [0085.602] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.603] GetProcessHeap () returned 0xd20000 [0085.603] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.603] GetProcessHeap () returned 0xd20000 [0085.603] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.603] GetProcessHeap () returned 0xd20000 [0085.603] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.603] GetProcessHeap () returned 0xd20000 [0085.603] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.603] GetProcessHeap () returned 0xd20000 [0085.603] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.603] GetProcessHeap () returned 0xd20000 [0085.603] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.603] GetProcessHeap () returned 0xd20000 [0085.603] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.603] GetProcessHeap () returned 0xd20000 [0085.603] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.603] GetProcessHeap () returned 0xd20000 [0085.603] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.603] GetProcessHeap () returned 0xd20000 [0085.604] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.604] GetProcessHeap () returned 0xd20000 [0085.604] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.604] GetProcessHeap () returned 0xd20000 [0085.604] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.604] GetProcessHeap () returned 0xd20000 [0085.604] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.604] GetProcessHeap () returned 0xd20000 [0085.604] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.604] GetProcessHeap () returned 0xd20000 [0085.604] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.604] GetProcessHeap () returned 0xd20000 [0085.604] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.604] GetProcessHeap () returned 0xd20000 [0085.604] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.604] GetProcessHeap () returned 0xd20000 [0085.604] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.604] GetProcessHeap () returned 0xd20000 [0085.604] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.604] GetProcessHeap () returned 0xd20000 [0085.605] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.605] GetProcessHeap () returned 0xd20000 [0085.605] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0085.605] GetProcessHeap () returned 0xd20000 [0085.605] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.605] GetProcessHeap () returned 0xd20000 [0085.605] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.605] GetProcessHeap () returned 0xd20000 [0085.606] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.606] GetProcessHeap () returned 0xd20000 [0085.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0085.606] GetProcessHeap () returned 0xd20000 [0085.606] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.606] GetProcessHeap () returned 0xd20000 [0085.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.606] GetProcessHeap () returned 0xd20000 [0085.606] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.606] GetProcessHeap () returned 0xd20000 [0085.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.606] GetProcessHeap () returned 0xd20000 [0085.606] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.606] GetProcessHeap () returned 0xd20000 [0085.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.606] GetProcessHeap () returned 0xd20000 [0085.606] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.606] GetProcessHeap () returned 0xd20000 [0085.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.607] GetProcessHeap () returned 0xd20000 [0085.607] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.607] GetProcessHeap () returned 0xd20000 [0085.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0085.607] GetProcessHeap () returned 0xd20000 [0085.607] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0085.607] GetProcessHeap () returned 0xd20000 [0085.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.607] GetProcessHeap () returned 0xd20000 [0085.607] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.607] GetProcessHeap () returned 0xd20000 [0085.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.607] GetProcessHeap () returned 0xd20000 [0085.607] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.607] GetProcessHeap () returned 0xd20000 [0085.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.607] GetProcessHeap () returned 0xd20000 [0085.607] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.607] GetProcessHeap () returned 0xd20000 [0085.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.608] GetProcessHeap () returned 0xd20000 [0085.608] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.608] GetProcessHeap () returned 0xd20000 [0085.608] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0085.608] GetProcessHeap () returned 0xd20000 [0085.608] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0085.608] GetProcessHeap () returned 0xd20000 [0085.608] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.608] GetProcessHeap () returned 0xd20000 [0085.608] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.608] GetProcessHeap () returned 0xd20000 [0085.608] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.608] GetProcessHeap () returned 0xd20000 [0085.608] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.608] GetProcessHeap () returned 0xd20000 [0085.608] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.608] GetProcessHeap () returned 0xd20000 [0085.608] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.608] GetProcessHeap () returned 0xd20000 [0085.609] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.609] GetProcessHeap () returned 0xd20000 [0085.609] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.609] GetProcessHeap () returned 0xd20000 [0085.609] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0085.609] GetProcessHeap () returned 0xd20000 [0085.609] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0085.609] GetProcessHeap () returned 0xd20000 [0085.609] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.609] GetProcessHeap () returned 0xd20000 [0085.609] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.609] GetProcessHeap () returned 0xd20000 [0085.609] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.609] GetProcessHeap () returned 0xd20000 [0085.609] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.609] GetProcessHeap () returned 0xd20000 [0085.609] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.609] GetProcessHeap () returned 0xd20000 [0085.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.610] GetProcessHeap () returned 0xd20000 [0085.610] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.610] GetProcessHeap () returned 0xd20000 [0085.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.610] GetProcessHeap () returned 0xd20000 [0085.610] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.610] GetProcessHeap () returned 0xd20000 [0085.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.610] GetProcessHeap () returned 0xd20000 [0085.610] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.610] GetProcessHeap () returned 0xd20000 [0085.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.610] GetProcessHeap () returned 0xd20000 [0085.610] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.610] GetProcessHeap () returned 0xd20000 [0085.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.610] GetProcessHeap () returned 0xd20000 [0085.610] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.611] GetProcessHeap () returned 0xd20000 [0085.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.611] GetProcessHeap () returned 0xd20000 [0085.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0085.611] GetProcessHeap () returned 0xd20000 [0085.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0085.611] GetProcessHeap () returned 0xd20000 [0085.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.611] GetProcessHeap () returned 0xd20000 [0085.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.611] GetProcessHeap () returned 0xd20000 [0085.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0085.611] GetProcessHeap () returned 0xd20000 [0085.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0085.611] GetProcessHeap () returned 0xd20000 [0085.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.611] GetProcessHeap () returned 0xd20000 [0085.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.612] GetProcessHeap () returned 0xd20000 [0085.612] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.612] GetProcessHeap () returned 0xd20000 [0085.612] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.612] GetProcessHeap () returned 0xd20000 [0085.612] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.612] GetProcessHeap () returned 0xd20000 [0085.612] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.612] GetProcessHeap () returned 0xd20000 [0085.612] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0085.612] GetProcessHeap () returned 0xd20000 [0085.612] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0085.612] GetProcessHeap () returned 0xd20000 [0085.612] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.612] GetProcessHeap () returned 0xd20000 [0085.612] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.612] GetProcessHeap () returned 0xd20000 [0085.612] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.613] GetProcessHeap () returned 0xd20000 [0085.613] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.613] GetProcessHeap () returned 0xd20000 [0085.613] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.613] GetProcessHeap () returned 0xd20000 [0085.613] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.613] GetProcessHeap () returned 0xd20000 [0085.613] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.613] GetProcessHeap () returned 0xd20000 [0085.613] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.613] GetProcessHeap () returned 0xd20000 [0085.613] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.613] GetProcessHeap () returned 0xd20000 [0085.613] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.613] GetProcessHeap () returned 0xd20000 [0085.613] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.613] GetProcessHeap () returned 0xd20000 [0085.613] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.614] GetProcessHeap () returned 0xd20000 [0085.614] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.614] GetProcessHeap () returned 0xd20000 [0085.614] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.614] GetProcessHeap () returned 0xd20000 [0085.614] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.614] GetProcessHeap () returned 0xd20000 [0085.614] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.614] GetProcessHeap () returned 0xd20000 [0085.614] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.614] GetProcessHeap () returned 0xd20000 [0085.614] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.614] GetProcessHeap () returned 0xd20000 [0085.614] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.614] GetProcessHeap () returned 0xd20000 [0085.614] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.614] GetProcessHeap () returned 0xd20000 [0085.614] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.615] GetProcessHeap () returned 0xd20000 [0085.615] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.615] GetProcessHeap () returned 0xd20000 [0085.615] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.615] GetProcessHeap () returned 0xd20000 [0085.615] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.615] GetProcessHeap () returned 0xd20000 [0085.615] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.615] GetProcessHeap () returned 0xd20000 [0085.615] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.615] GetProcessHeap () returned 0xd20000 [0085.615] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.615] GetProcessHeap () returned 0xd20000 [0085.615] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.615] GetProcessHeap () returned 0xd20000 [0085.615] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.615] GetProcessHeap () returned 0xd20000 [0085.615] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.616] GetProcessHeap () returned 0xd20000 [0085.616] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.616] GetProcessHeap () returned 0xd20000 [0085.616] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.616] GetProcessHeap () returned 0xd20000 [0085.616] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.616] GetProcessHeap () returned 0xd20000 [0085.616] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.616] GetProcessHeap () returned 0xd20000 [0085.616] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.616] GetProcessHeap () returned 0xd20000 [0085.616] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.616] GetProcessHeap () returned 0xd20000 [0085.616] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.616] GetProcessHeap () returned 0xd20000 [0085.616] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.616] GetProcessHeap () returned 0xd20000 [0085.616] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.616] GetProcessHeap () returned 0xd20000 [0085.617] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.617] GetProcessHeap () returned 0xd20000 [0085.617] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.617] GetProcessHeap () returned 0xd20000 [0085.617] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.617] GetProcessHeap () returned 0xd20000 [0085.617] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0085.617] GetProcessHeap () returned 0xd20000 [0085.617] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0085.617] GetProcessHeap () returned 0xd20000 [0085.617] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.617] GetProcessHeap () returned 0xd20000 [0085.617] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.617] GetProcessHeap () returned 0xd20000 [0085.617] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.617] GetProcessHeap () returned 0xd20000 [0085.617] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.617] GetProcessHeap () returned 0xd20000 [0085.617] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.617] GetProcessHeap () returned 0xd20000 [0085.618] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.618] GetProcessHeap () returned 0xd20000 [0085.618] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.618] GetProcessHeap () returned 0xd20000 [0085.618] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.618] GetProcessHeap () returned 0xd20000 [0085.618] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.618] GetProcessHeap () returned 0xd20000 [0085.618] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.618] GetProcessHeap () returned 0xd20000 [0085.618] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0085.618] GetProcessHeap () returned 0xd20000 [0085.618] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0085.618] GetProcessHeap () returned 0xd20000 [0085.618] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.618] GetProcessHeap () returned 0xd20000 [0085.618] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.618] GetProcessHeap () returned 0xd20000 [0085.618] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0085.619] GetProcessHeap () returned 0xd20000 [0085.619] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0085.619] GetProcessHeap () returned 0xd20000 [0085.619] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.619] GetProcessHeap () returned 0xd20000 [0085.619] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.619] GetProcessHeap () returned 0xd20000 [0085.619] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.619] GetProcessHeap () returned 0xd20000 [0085.619] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.619] GetProcessHeap () returned 0xd20000 [0085.619] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0085.619] GetProcessHeap () returned 0xd20000 [0085.619] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0085.619] GetProcessHeap () returned 0xd20000 [0085.619] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.619] GetProcessHeap () returned 0xd20000 [0085.619] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.619] GetProcessHeap () returned 0xd20000 [0085.619] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.620] GetProcessHeap () returned 0xd20000 [0085.620] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.620] GetProcessHeap () returned 0xd20000 [0085.620] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.620] GetProcessHeap () returned 0xd20000 [0085.620] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.620] GetProcessHeap () returned 0xd20000 [0085.620] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.620] GetProcessHeap () returned 0xd20000 [0085.620] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.620] GetProcessHeap () returned 0xd20000 [0085.620] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.621] GetProcessHeap () returned 0xd20000 [0085.621] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.621] GetProcessHeap () returned 0xd20000 [0085.621] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.621] GetProcessHeap () returned 0xd20000 [0085.621] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.621] GetProcessHeap () returned 0xd20000 [0085.621] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0085.621] GetProcessHeap () returned 0xd20000 [0085.621] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0085.621] GetProcessHeap () returned 0xd20000 [0085.621] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0085.621] GetProcessHeap () returned 0xd20000 [0085.621] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0085.621] GetProcessHeap () returned 0xd20000 [0085.621] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44510 | out: hHeap=0xd20000) returned 1 [0085.622] GetProcessHeap () returned 0xd20000 [0085.622] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ab88 | out: hHeap=0xd20000) returned 1 [0085.622] GetProcessHeap () returned 0xd20000 [0085.622] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0085.622] GetProcessHeap () returned 0xd20000 [0085.622] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aee8 | out: hHeap=0xd20000) returned 1 [0085.622] GetProcessHeap () returned 0xd20000 [0085.622] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0085.622] GetProcessHeap () returned 0xd20000 [0085.622] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.622] GetProcessHeap () returned 0xd20000 [0085.622] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0085.622] WriteFile (in: hFile=0x230, lpBuffer=0xd4c398*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4c398*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0085.629] GetProcessHeap () returned 0xd20000 [0085.629] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4c398, Size=0x30) returned 0xd4c398 [0085.629] GetProcessHeap () returned 0xd20000 [0085.629] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0085.629] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0085.629] GetProcessHeap () returned 0xd20000 [0085.629] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf44d) returned 0xd4c3d0 [0085.630] ReadFile (in: hFile=0x230, lpBuffer=0xd4c3d0, nNumberOfBytesToRead=0xf44d, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4c3d0*, lpNumberOfBytesRead=0x299d7e8*=0xf44d, lpOverlapped=0x0) returned 1 [0085.632] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0085.632] WriteFile (in: hFile=0x230, lpBuffer=0xd4c3d0*, nNumberOfBytesToWrite=0xf44d, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4c3d0*, lpNumberOfBytesWritten=0x299d7e4*=0xf44d, lpOverlapped=0x0) returned 1 [0085.640] GetProcessHeap () returned 0xd20000 [0085.640] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c3d0 | out: hHeap=0xd20000) returned 1 [0085.640] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0085.640] WriteFile (in: hFile=0x230, lpBuffer=0xd4c398*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4c398*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0085.641] CloseHandle (hObject=0x230) returned 1 [0085.649] GetProcessHeap () returned 0xd20000 [0085.649] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd426c0 | out: hHeap=0xd20000) returned 1 [0085.649] GetProcessHeap () returned 0xd20000 [0085.649] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4be90 | out: hHeap=0xd20000) returned 1 [0085.649] GetProcessHeap () returned 0xd20000 [0085.649] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0085.649] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\default.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\default.htm" [0085.649] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\default.htm.[ponce.lorena@aol.com]" [0085.649] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\default.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0085.650] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\default.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0085.650] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0085.650] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" [0085.650] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_recover.html")) returned 0x20 [0085.651] GetProcessHeap () returned 0xd20000 [0085.651] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446c0 | out: hHeap=0xd20000) returned 1 [0085.651] FindNextFileW (in: hFindFile=0xd49060, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bd859, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bd859, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x13e24500, ftLastWriteTime.dwHighDateTime=0x1d2ee61, nFileSizeHigh=0x0, nFileSizeLow=0x1a2c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="default_eos.css", cAlternateFileName="DEFAUL~1.CSS")) returned 1 [0085.651] lstrcmpiW (lpString1="default_eos.css", lpString2=".") returned 1 [0085.651] lstrcmpiW (lpString1="default_eos.css", lpString2="..") returned 1 [0085.651] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="default_eos.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css") returned="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css" [0085.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default_eos.css", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0085.651] GetProcessHeap () returned 0xd20000 [0085.651] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd444c8 [0085.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default_eos.css", cchWideChar=-1, lpMultiByteStr=0xd444c8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="default_eos.css", lpUsedDefaultChar=0x0) returned 16 [0085.651] lstrlenA (lpString="default_eos.css") returned 15 [0085.651] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0085.651] lstrlenA (lpString="default_eos.css") returned 15 [0085.651] lstrlenA (lpString=".dll") returned 4 [0085.651] lstrlenA (lpString=".dll") returned 4 [0085.651] lstrlenA (lpString="default_eos.css") returned 15 [0085.651] lstrcmpiA (lpString1=".css", lpString2=".dll") returned -1 [0085.652] lstrlenA (lpString="default_eos.css") returned 15 [0085.652] lstrlenA (lpString=".ini") returned 4 [0085.652] lstrlenA (lpString=".ini") returned 4 [0085.652] lstrlenA (lpString="default_eos.css") returned 15 [0085.652] lstrcmpiA (lpString1=".css", lpString2=".ini") returned -1 [0085.652] lstrlenA (lpString="default_eos.css") returned 15 [0085.652] lstrlenA (lpString=".inc") returned 4 [0085.652] lstrlenA (lpString=".inc") returned 4 [0085.652] lstrlenA (lpString="default_eos.css") returned 15 [0085.652] lstrcmpiA (lpString1=".css", lpString2=".inc") returned -1 [0085.652] lstrcmpiW (lpString1="default_eos.css", lpString2="HOW_RECOVER.html") returned -1 [0085.652] lstrcmpiW (lpString1="default_eos.css", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0085.652] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0085.652] lstrcmpiW (lpString1="default_eos.css", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0085.653] GetProcessHeap () returned 0xd20000 [0085.653] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42530 [0085.653] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0085.654] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=6700) returned 1 [0085.654] GetProcessHeap () returned 0xd20000 [0085.654] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bb48 [0085.654] GetProcessHeap () returned 0xd20000 [0085.654] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0085.654] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css") returned 48 [0085.654] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0085.654] GetProcessHeap () returned 0xd20000 [0085.654] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0085.655] GetProcessHeap () returned 0xd20000 [0085.655] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x384) returned 0xd4c3d0 [0085.655] lstrlenA (lpString="rsa_encrypt") returned 11 [0085.655] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0085.657] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0085.657] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0085.657] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0085.657] GetProcessHeap () returned 0xd20000 [0085.657] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0085.657] lstrlenA (lpString="010001") returned 6 [0085.657] GetProcessHeap () returned 0xd20000 [0085.657] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd98 [0085.657] GetProcessHeap () returned 0xd20000 [0085.657] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0085.657] GetProcessHeap () returned 0xd20000 [0085.657] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b758 [0085.657] GetProcessHeap () returned 0xd20000 [0085.657] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0085.657] GetProcessHeap () returned 0xd20000 [0085.657] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b248 [0085.657] GetProcessHeap () returned 0xd20000 [0085.658] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44808 [0085.658] GetProcessHeap () returned 0xd20000 [0085.658] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0085.658] GetProcessHeap () returned 0xd20000 [0085.658] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0085.658] GetProcessHeap () returned 0xd20000 [0085.658] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.658] GetProcessHeap () returned 0xd20000 [0085.658] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0085.658] GetProcessHeap () returned 0xd20000 [0085.658] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0085.658] GetProcessHeap () returned 0xd20000 [0085.658] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44a38 [0085.658] GetProcessHeap () returned 0xd20000 [0085.658] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.658] GetProcessHeap () returned 0xd20000 [0085.658] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444e0 [0085.658] GetProcessHeap () returned 0xd20000 [0085.658] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0085.658] GetProcessHeap () returned 0xd20000 [0085.658] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0085.658] GetProcessHeap () returned 0xd20000 [0085.659] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0085.659] GetProcessHeap () returned 0xd20000 [0085.659] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0085.659] GetProcessHeap () returned 0xd20000 [0085.659] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.659] GetProcessHeap () returned 0xd20000 [0085.659] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44510 [0085.659] GetProcessHeap () returned 0xd20000 [0085.659] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.659] GetProcessHeap () returned 0xd20000 [0085.659] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.659] GetProcessHeap () returned 0xd20000 [0085.659] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.659] GetProcessHeap () returned 0xd20000 [0085.659] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.659] GetProcessHeap () returned 0xd20000 [0085.659] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0085.659] GetProcessHeap () returned 0xd20000 [0085.659] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0085.659] GetProcessHeap () returned 0xd20000 [0085.659] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b7e8 [0085.659] GetProcessHeap () returned 0xd20000 [0085.659] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44510 | out: hHeap=0xd20000) returned 1 [0085.660] GetProcessHeap () returned 0xd20000 [0085.660] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0085.660] GetProcessHeap () returned 0xd20000 [0085.660] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0085.660] GetProcessHeap () returned 0xd20000 [0085.660] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.660] GetProcessHeap () returned 0xd20000 [0085.660] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.660] GetProcessHeap () returned 0xd20000 [0085.660] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.660] GetProcessHeap () returned 0xd20000 [0085.660] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.660] GetProcessHeap () returned 0xd20000 [0085.660] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.660] GetProcessHeap () returned 0xd20000 [0085.660] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.660] GetProcessHeap () returned 0xd20000 [0085.660] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.660] GetProcessHeap () returned 0xd20000 [0085.660] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.660] GetProcessHeap () returned 0xd20000 [0085.660] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0085.660] GetProcessHeap () returned 0xd20000 [0085.660] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0085.661] GetProcessHeap () returned 0xd20000 [0085.661] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.661] GetProcessHeap () returned 0xd20000 [0085.661] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.661] GetProcessHeap () returned 0xd20000 [0085.661] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0085.661] GetProcessHeap () returned 0xd20000 [0085.661] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0085.661] GetProcessHeap () returned 0xd20000 [0085.661] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.661] GetProcessHeap () returned 0xd20000 [0085.661] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.661] GetProcessHeap () returned 0xd20000 [0085.661] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.661] GetProcessHeap () returned 0xd20000 [0085.661] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.661] GetProcessHeap () returned 0xd20000 [0085.661] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.661] GetProcessHeap () returned 0xd20000 [0085.661] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.661] GetProcessHeap () returned 0xd20000 [0085.661] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.662] GetProcessHeap () returned 0xd20000 [0085.662] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.662] GetProcessHeap () returned 0xd20000 [0085.662] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.662] GetProcessHeap () returned 0xd20000 [0085.662] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.662] GetProcessHeap () returned 0xd20000 [0085.662] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.662] GetProcessHeap () returned 0xd20000 [0085.662] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.662] GetProcessHeap () returned 0xd20000 [0085.662] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.662] GetProcessHeap () returned 0xd20000 [0085.662] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.662] GetProcessHeap () returned 0xd20000 [0085.662] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0085.662] GetProcessHeap () returned 0xd20000 [0085.662] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.662] GetProcessHeap () returned 0xd20000 [0085.662] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.662] GetProcessHeap () returned 0xd20000 [0085.663] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.663] GetProcessHeap () returned 0xd20000 [0085.663] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.663] GetProcessHeap () returned 0xd20000 [0085.663] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.663] GetProcessHeap () returned 0xd20000 [0085.663] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.663] GetProcessHeap () returned 0xd20000 [0085.663] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.663] GetProcessHeap () returned 0xd20000 [0085.663] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.663] GetProcessHeap () returned 0xd20000 [0085.663] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.663] GetProcessHeap () returned 0xd20000 [0085.663] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.663] GetProcessHeap () returned 0xd20000 [0085.663] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.663] GetProcessHeap () returned 0xd20000 [0085.663] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.663] GetProcessHeap () returned 0xd20000 [0085.663] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.664] GetProcessHeap () returned 0xd20000 [0085.664] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.664] GetProcessHeap () returned 0xd20000 [0085.664] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.664] GetProcessHeap () returned 0xd20000 [0085.664] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0085.664] GetProcessHeap () returned 0xd20000 [0085.664] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0085.664] GetProcessHeap () returned 0xd20000 [0085.664] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.664] GetProcessHeap () returned 0xd20000 [0085.664] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.664] GetProcessHeap () returned 0xd20000 [0085.664] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.664] GetProcessHeap () returned 0xd20000 [0085.664] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.664] GetProcessHeap () returned 0xd20000 [0085.664] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0085.664] GetProcessHeap () returned 0xd20000 [0085.664] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.664] GetProcessHeap () returned 0xd20000 [0085.664] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.664] GetProcessHeap () returned 0xd20000 [0085.665] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.665] GetProcessHeap () returned 0xd20000 [0085.665] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.665] GetProcessHeap () returned 0xd20000 [0085.665] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.665] GetProcessHeap () returned 0xd20000 [0085.665] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0085.665] GetProcessHeap () returned 0xd20000 [0085.665] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0085.665] GetProcessHeap () returned 0xd20000 [0085.665] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.665] GetProcessHeap () returned 0xd20000 [0085.665] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.665] GetProcessHeap () returned 0xd20000 [0085.665] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.665] GetProcessHeap () returned 0xd20000 [0085.665] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.665] GetProcessHeap () returned 0xd20000 [0085.665] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.665] GetProcessHeap () returned 0xd20000 [0085.665] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.666] GetProcessHeap () returned 0xd20000 [0085.666] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.666] GetProcessHeap () returned 0xd20000 [0085.666] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.666] GetProcessHeap () returned 0xd20000 [0085.666] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.666] GetProcessHeap () returned 0xd20000 [0085.666] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.666] GetProcessHeap () returned 0xd20000 [0085.666] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0085.666] GetProcessHeap () returned 0xd20000 [0085.666] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0085.666] GetProcessHeap () returned 0xd20000 [0085.666] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.666] GetProcessHeap () returned 0xd20000 [0085.666] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.666] GetProcessHeap () returned 0xd20000 [0085.666] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.666] GetProcessHeap () returned 0xd20000 [0085.666] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.667] GetProcessHeap () returned 0xd20000 [0085.667] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.667] GetProcessHeap () returned 0xd20000 [0085.667] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.667] GetProcessHeap () returned 0xd20000 [0085.667] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.667] GetProcessHeap () returned 0xd20000 [0085.667] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.667] GetProcessHeap () returned 0xd20000 [0085.667] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.667] GetProcessHeap () returned 0xd20000 [0085.667] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.667] GetProcessHeap () returned 0xd20000 [0085.667] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.667] GetProcessHeap () returned 0xd20000 [0085.667] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.667] GetProcessHeap () returned 0xd20000 [0085.667] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0085.667] GetProcessHeap () returned 0xd20000 [0085.668] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.668] GetProcessHeap () returned 0xd20000 [0085.668] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.668] GetProcessHeap () returned 0xd20000 [0085.668] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.668] GetProcessHeap () returned 0xd20000 [0085.668] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.668] GetProcessHeap () returned 0xd20000 [0085.668] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.668] GetProcessHeap () returned 0xd20000 [0085.668] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.668] GetProcessHeap () returned 0xd20000 [0085.668] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.668] GetProcessHeap () returned 0xd20000 [0085.668] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.668] GetProcessHeap () returned 0xd20000 [0085.668] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.668] GetProcessHeap () returned 0xd20000 [0085.668] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0085.668] GetProcessHeap () returned 0xd20000 [0085.668] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0085.669] GetProcessHeap () returned 0xd20000 [0085.669] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.669] GetProcessHeap () returned 0xd20000 [0085.669] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.669] GetProcessHeap () returned 0xd20000 [0085.669] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.669] GetProcessHeap () returned 0xd20000 [0085.669] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.669] GetProcessHeap () returned 0xd20000 [0085.669] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.669] GetProcessHeap () returned 0xd20000 [0085.669] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.669] GetProcessHeap () returned 0xd20000 [0085.669] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.669] GetProcessHeap () returned 0xd20000 [0085.669] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.669] GetProcessHeap () returned 0xd20000 [0085.669] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.669] GetProcessHeap () returned 0xd20000 [0085.670] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.670] GetProcessHeap () returned 0xd20000 [0085.670] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.670] GetProcessHeap () returned 0xd20000 [0085.670] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.670] GetProcessHeap () returned 0xd20000 [0085.670] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.670] GetProcessHeap () returned 0xd20000 [0085.670] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.670] GetProcessHeap () returned 0xd20000 [0085.670] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.670] GetProcessHeap () returned 0xd20000 [0085.670] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.670] GetProcessHeap () returned 0xd20000 [0085.670] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.670] GetProcessHeap () returned 0xd20000 [0085.670] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.670] GetProcessHeap () returned 0xd20000 [0085.670] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.671] GetProcessHeap () returned 0xd20000 [0085.671] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.671] GetProcessHeap () returned 0xd20000 [0085.671] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.671] GetProcessHeap () returned 0xd20000 [0085.671] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.671] GetProcessHeap () returned 0xd20000 [0085.671] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.671] GetProcessHeap () returned 0xd20000 [0085.671] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.671] GetProcessHeap () returned 0xd20000 [0085.671] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.671] GetProcessHeap () returned 0xd20000 [0085.671] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.671] GetProcessHeap () returned 0xd20000 [0085.671] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.671] GetProcessHeap () returned 0xd20000 [0085.671] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.672] GetProcessHeap () returned 0xd20000 [0085.672] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0085.672] GetProcessHeap () returned 0xd20000 [0085.672] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0085.672] GetProcessHeap () returned 0xd20000 [0085.672] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.672] GetProcessHeap () returned 0xd20000 [0085.672] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.672] GetProcessHeap () returned 0xd20000 [0085.672] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.672] GetProcessHeap () returned 0xd20000 [0085.672] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.672] GetProcessHeap () returned 0xd20000 [0085.672] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.672] GetProcessHeap () returned 0xd20000 [0085.672] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.672] GetProcessHeap () returned 0xd20000 [0085.672] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.672] GetProcessHeap () returned 0xd20000 [0085.672] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.672] GetProcessHeap () returned 0xd20000 [0085.673] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.673] GetProcessHeap () returned 0xd20000 [0085.673] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.673] GetProcessHeap () returned 0xd20000 [0085.673] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.673] GetProcessHeap () returned 0xd20000 [0085.673] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.673] GetProcessHeap () returned 0xd20000 [0085.673] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.673] GetProcessHeap () returned 0xd20000 [0085.673] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.673] GetProcessHeap () returned 0xd20000 [0085.673] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.673] GetProcessHeap () returned 0xd20000 [0085.673] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.673] GetProcessHeap () returned 0xd20000 [0085.673] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.673] GetProcessHeap () returned 0xd20000 [0085.673] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.673] GetProcessHeap () returned 0xd20000 [0085.673] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.674] GetProcessHeap () returned 0xd20000 [0085.674] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.674] GetProcessHeap () returned 0xd20000 [0085.674] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.674] GetProcessHeap () returned 0xd20000 [0085.674] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.674] GetProcessHeap () returned 0xd20000 [0085.674] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.674] GetProcessHeap () returned 0xd20000 [0085.674] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.674] GetProcessHeap () returned 0xd20000 [0085.674] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.674] GetProcessHeap () returned 0xd20000 [0085.674] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.674] GetProcessHeap () returned 0xd20000 [0085.674] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.674] GetProcessHeap () returned 0xd20000 [0085.674] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.674] GetProcessHeap () returned 0xd20000 [0085.674] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.674] GetProcessHeap () returned 0xd20000 [0085.674] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.675] GetProcessHeap () returned 0xd20000 [0085.675] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.675] GetProcessHeap () returned 0xd20000 [0085.675] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.675] GetProcessHeap () returned 0xd20000 [0085.675] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.675] GetProcessHeap () returned 0xd20000 [0085.675] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.675] GetProcessHeap () returned 0xd20000 [0085.675] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0085.675] GetProcessHeap () returned 0xd20000 [0085.675] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0085.675] GetProcessHeap () returned 0xd20000 [0085.675] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.675] GetProcessHeap () returned 0xd20000 [0085.675] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.675] GetProcessHeap () returned 0xd20000 [0085.675] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.675] GetProcessHeap () returned 0xd20000 [0085.675] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.675] GetProcessHeap () returned 0xd20000 [0085.676] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.676] GetProcessHeap () returned 0xd20000 [0085.676] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.676] GetProcessHeap () returned 0xd20000 [0085.676] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.676] GetProcessHeap () returned 0xd20000 [0085.676] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.676] GetProcessHeap () returned 0xd20000 [0085.676] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0085.676] GetProcessHeap () returned 0xd20000 [0085.676] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0085.676] GetProcessHeap () returned 0xd20000 [0085.676] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0085.676] GetProcessHeap () returned 0xd20000 [0085.676] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0085.676] GetProcessHeap () returned 0xd20000 [0085.676] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0085.676] GetProcessHeap () returned 0xd20000 [0085.676] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0085.676] GetProcessHeap () returned 0xd20000 [0085.676] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444e0 | out: hHeap=0xd20000) returned 1 [0085.677] GetProcessHeap () returned 0xd20000 [0085.677] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b248 | out: hHeap=0xd20000) returned 1 [0085.677] GetProcessHeap () returned 0xd20000 [0085.677] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0085.677] GetProcessHeap () returned 0xd20000 [0085.677] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b758 | out: hHeap=0xd20000) returned 1 [0085.677] GetProcessHeap () returned 0xd20000 [0085.677] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0085.677] GetProcessHeap () returned 0xd20000 [0085.677] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.677] GetProcessHeap () returned 0xd20000 [0085.677] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0085.677] WriteFile (in: hFile=0x230, lpBuffer=0xd4c3d0*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4c3d0*, lpNumberOfBytesWritten=0x299d864*=0x384, lpOverlapped=0x0) returned 1 [0085.682] GetProcessHeap () returned 0xd20000 [0085.682] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4c3d0, Size=0x30) returned 0xd4c3d0 [0085.682] GetProcessHeap () returned 0xd20000 [0085.682] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0085.682] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0085.682] GetProcessHeap () returned 0xd20000 [0085.682] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1a30) returned 0xd4c408 [0085.682] ReadFile (in: hFile=0x230, lpBuffer=0xd4c408, nNumberOfBytesToRead=0x1a30, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4c408*, lpNumberOfBytesRead=0x299d7e8*=0x1a30, lpOverlapped=0x0) returned 1 [0085.684] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0085.684] WriteFile (in: hFile=0x230, lpBuffer=0xd4c408*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4c408*, lpNumberOfBytesWritten=0x299d7e4*=0x1a30, lpOverlapped=0x0) returned 1 [0085.685] GetProcessHeap () returned 0xd20000 [0085.686] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c408 | out: hHeap=0xd20000) returned 1 [0085.686] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0085.686] WriteFile (in: hFile=0x230, lpBuffer=0xd4c3d0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4c3d0*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0085.687] CloseHandle (hObject=0x230) returned 1 [0085.689] GetProcessHeap () returned 0xd20000 [0085.689] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42530 | out: hHeap=0xd20000) returned 1 [0085.689] GetProcessHeap () returned 0xd20000 [0085.689] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bb48 | out: hHeap=0xd20000) returned 1 [0085.689] GetProcessHeap () returned 0xd20000 [0085.689] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0085.689] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css") returned="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css" [0085.689] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css.[ponce.lorena@aol.com]" [0085.690] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.css"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.css.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0085.690] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\default_eos.css" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0085.690] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0085.690] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" [0085.690] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_recover.html")) returned 0x20 [0085.691] GetProcessHeap () returned 0xd20000 [0085.691] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444c8 | out: hHeap=0xd20000) returned 1 [0085.691] FindNextFileW (in: hFindFile=0xd49060, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3bff6c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3bff6c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea75e900, ftLastWriteTime.dwHighDateTime=0x1d2ee61, nFileSizeHigh=0x0, nFileSizeLow=0xda3a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="default_eos.htm", cAlternateFileName="DEFAUL~1.HTM")) returned 1 [0085.691] lstrcmpiW (lpString1="default_eos.htm", lpString2=".") returned 1 [0085.691] lstrcmpiW (lpString1="default_eos.htm", lpString2="..") returned 1 [0085.691] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="default_eos.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" [0085.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default_eos.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0085.691] GetProcessHeap () returned 0xd20000 [0085.691] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd445d0 [0085.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default_eos.htm", cchWideChar=-1, lpMultiByteStr=0xd445d0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="default_eos.htm", lpUsedDefaultChar=0x0) returned 16 [0085.691] lstrlenA (lpString="default_eos.htm") returned 15 [0085.691] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0085.691] lstrlenA (lpString="default_eos.htm") returned 15 [0085.691] lstrlenA (lpString=".dll") returned 4 [0085.691] lstrlenA (lpString=".dll") returned 4 [0085.691] lstrlenA (lpString="default_eos.htm") returned 15 [0085.691] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0085.691] lstrlenA (lpString="default_eos.htm") returned 15 [0085.692] lstrlenA (lpString=".ini") returned 4 [0085.692] lstrlenA (lpString=".ini") returned 4 [0085.692] lstrlenA (lpString="default_eos.htm") returned 15 [0085.692] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0085.692] lstrlenA (lpString="default_eos.htm") returned 15 [0085.692] lstrlenA (lpString=".inc") returned 4 [0085.692] lstrlenA (lpString=".inc") returned 4 [0085.692] lstrlenA (lpString="default_eos.htm") returned 15 [0085.692] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0085.692] lstrcmpiW (lpString1="default_eos.htm", lpString2="HOW_RECOVER.html") returned -1 [0085.692] lstrcmpiW (lpString1="default_eos.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0085.692] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0085.692] lstrcmpiW (lpString1="default_eos.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0085.692] GetProcessHeap () returned 0xd20000 [0085.692] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd424e0 [0085.692] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0085.693] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=55866) returned 1 [0085.693] GetProcessHeap () returned 0xd20000 [0085.693] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4be18 [0085.693] GetProcessHeap () returned 0xd20000 [0085.693] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0085.693] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm") returned 48 [0085.693] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0085.693] GetProcessHeap () returned 0xd20000 [0085.693] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0085.693] GetProcessHeap () returned 0xd20000 [0085.693] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x386) returned 0xd4c408 [0085.694] lstrlenA (lpString="rsa_encrypt") returned 11 [0085.694] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0085.696] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0085.696] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0085.696] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0085.696] GetProcessHeap () returned 0xd20000 [0085.696] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0085.696] lstrlenA (lpString="010001") returned 6 [0085.696] GetProcessHeap () returned 0xd20000 [0085.696] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cdb8 [0085.696] GetProcessHeap () returned 0xd20000 [0085.696] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0085.696] GetProcessHeap () returned 0xd20000 [0085.696] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b128 [0085.696] GetProcessHeap () returned 0xd20000 [0085.696] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0085.696] GetProcessHeap () returned 0xd20000 [0085.696] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ab88 [0085.696] GetProcessHeap () returned 0xd20000 [0085.696] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd450c8 [0085.697] GetProcessHeap () returned 0xd20000 [0085.697] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd38 [0085.697] GetProcessHeap () returned 0xd20000 [0085.697] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44c68 [0085.697] GetProcessHeap () returned 0xd20000 [0085.697] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.697] GetProcessHeap () returned 0xd20000 [0085.697] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0085.697] GetProcessHeap () returned 0xd20000 [0085.697] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0085.697] GetProcessHeap () returned 0xd20000 [0085.697] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44fb0 [0085.697] GetProcessHeap () returned 0xd20000 [0085.697] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.697] GetProcessHeap () returned 0xd20000 [0085.697] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444c8 [0085.697] GetProcessHeap () returned 0xd20000 [0085.697] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b6c8 [0085.697] GetProcessHeap () returned 0xd20000 [0085.697] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0085.697] GetProcessHeap () returned 0xd20000 [0085.698] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0085.698] GetProcessHeap () returned 0xd20000 [0085.698] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b6c8 | out: hHeap=0xd20000) returned 1 [0085.698] GetProcessHeap () returned 0xd20000 [0085.698] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.698] GetProcessHeap () returned 0xd20000 [0085.698] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44588 [0085.698] GetProcessHeap () returned 0xd20000 [0085.698] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.698] GetProcessHeap () returned 0xd20000 [0085.698] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.698] GetProcessHeap () returned 0xd20000 [0085.698] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.698] GetProcessHeap () returned 0xd20000 [0085.698] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.698] GetProcessHeap () returned 0xd20000 [0085.698] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.698] GetProcessHeap () returned 0xd20000 [0085.699] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.699] GetProcessHeap () returned 0xd20000 [0085.699] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4ad38 [0085.699] GetProcessHeap () returned 0xd20000 [0085.699] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44588 | out: hHeap=0xd20000) returned 1 [0085.699] GetProcessHeap () returned 0xd20000 [0085.699] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0085.699] GetProcessHeap () returned 0xd20000 [0085.699] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ad38 | out: hHeap=0xd20000) returned 1 [0085.699] GetProcessHeap () returned 0xd20000 [0085.699] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0085.699] GetProcessHeap () returned 0xd20000 [0085.699] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.699] GetProcessHeap () returned 0xd20000 [0085.699] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.699] GetProcessHeap () returned 0xd20000 [0085.699] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.699] GetProcessHeap () returned 0xd20000 [0085.699] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.700] GetProcessHeap () returned 0xd20000 [0085.700] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.700] GetProcessHeap () returned 0xd20000 [0085.700] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.700] GetProcessHeap () returned 0xd20000 [0085.700] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.700] GetProcessHeap () returned 0xd20000 [0085.700] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.700] GetProcessHeap () returned 0xd20000 [0085.700] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.700] GetProcessHeap () returned 0xd20000 [0085.700] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0085.700] GetProcessHeap () returned 0xd20000 [0085.700] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0085.700] GetProcessHeap () returned 0xd20000 [0085.700] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.700] GetProcessHeap () returned 0xd20000 [0085.700] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.700] GetProcessHeap () returned 0xd20000 [0085.700] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.700] GetProcessHeap () returned 0xd20000 [0085.701] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.701] GetProcessHeap () returned 0xd20000 [0085.701] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.701] GetProcessHeap () returned 0xd20000 [0085.701] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.701] GetProcessHeap () returned 0xd20000 [0085.701] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.701] GetProcessHeap () returned 0xd20000 [0085.701] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.701] GetProcessHeap () returned 0xd20000 [0085.701] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0085.701] GetProcessHeap () returned 0xd20000 [0085.701] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0085.701] GetProcessHeap () returned 0xd20000 [0085.701] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.701] GetProcessHeap () returned 0xd20000 [0085.701] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.701] GetProcessHeap () returned 0xd20000 [0085.701] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.701] GetProcessHeap () returned 0xd20000 [0085.701] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.702] GetProcessHeap () returned 0xd20000 [0085.702] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.702] GetProcessHeap () returned 0xd20000 [0085.702] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.702] GetProcessHeap () returned 0xd20000 [0085.702] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.702] GetProcessHeap () returned 0xd20000 [0085.702] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.702] GetProcessHeap () returned 0xd20000 [0085.702] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0085.702] GetProcessHeap () returned 0xd20000 [0085.702] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0085.702] GetProcessHeap () returned 0xd20000 [0085.702] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.702] GetProcessHeap () returned 0xd20000 [0085.702] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.702] GetProcessHeap () returned 0xd20000 [0085.702] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.702] GetProcessHeap () returned 0xd20000 [0085.702] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.703] GetProcessHeap () returned 0xd20000 [0085.703] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.703] GetProcessHeap () returned 0xd20000 [0085.703] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.703] GetProcessHeap () returned 0xd20000 [0085.703] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.703] GetProcessHeap () returned 0xd20000 [0085.703] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.703] GetProcessHeap () returned 0xd20000 [0085.703] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.703] GetProcessHeap () returned 0xd20000 [0085.703] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.703] GetProcessHeap () returned 0xd20000 [0085.703] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.703] GetProcessHeap () returned 0xd20000 [0085.703] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.703] GetProcessHeap () returned 0xd20000 [0085.703] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.703] GetProcessHeap () returned 0xd20000 [0085.703] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.704] GetProcessHeap () returned 0xd20000 [0085.704] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.704] GetProcessHeap () returned 0xd20000 [0085.704] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.704] GetProcessHeap () returned 0xd20000 [0085.704] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.704] GetProcessHeap () returned 0xd20000 [0085.704] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.704] GetProcessHeap () returned 0xd20000 [0085.704] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.704] GetProcessHeap () returned 0xd20000 [0085.704] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.704] GetProcessHeap () returned 0xd20000 [0085.704] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0085.704] GetProcessHeap () returned 0xd20000 [0085.704] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0085.704] GetProcessHeap () returned 0xd20000 [0085.704] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.704] GetProcessHeap () returned 0xd20000 [0085.704] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.705] GetProcessHeap () returned 0xd20000 [0085.705] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.705] GetProcessHeap () returned 0xd20000 [0085.705] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.705] GetProcessHeap () returned 0xd20000 [0085.705] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.705] GetProcessHeap () returned 0xd20000 [0085.705] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.705] GetProcessHeap () returned 0xd20000 [0085.705] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0085.705] GetProcessHeap () returned 0xd20000 [0085.705] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0085.705] GetProcessHeap () returned 0xd20000 [0085.705] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.705] GetProcessHeap () returned 0xd20000 [0085.705] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.705] GetProcessHeap () returned 0xd20000 [0085.705] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.705] GetProcessHeap () returned 0xd20000 [0085.705] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.705] GetProcessHeap () returned 0xd20000 [0085.706] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.706] GetProcessHeap () returned 0xd20000 [0085.706] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.706] GetProcessHeap () returned 0xd20000 [0085.706] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.706] GetProcessHeap () returned 0xd20000 [0085.706] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.706] GetProcessHeap () returned 0xd20000 [0085.706] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.706] GetProcessHeap () returned 0xd20000 [0085.706] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.706] GetProcessHeap () returned 0xd20000 [0085.706] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.706] GetProcessHeap () returned 0xd20000 [0085.706] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.706] GetProcessHeap () returned 0xd20000 [0085.706] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.706] GetProcessHeap () returned 0xd20000 [0085.706] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.706] GetProcessHeap () returned 0xd20000 [0085.707] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.707] GetProcessHeap () returned 0xd20000 [0085.707] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.707] GetProcessHeap () returned 0xd20000 [0085.707] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.707] GetProcessHeap () returned 0xd20000 [0085.707] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.707] GetProcessHeap () returned 0xd20000 [0085.707] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.707] GetProcessHeap () returned 0xd20000 [0085.707] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.707] GetProcessHeap () returned 0xd20000 [0085.707] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.707] GetProcessHeap () returned 0xd20000 [0085.707] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.707] GetProcessHeap () returned 0xd20000 [0085.707] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.707] GetProcessHeap () returned 0xd20000 [0085.707] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.707] GetProcessHeap () returned 0xd20000 [0085.707] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.708] GetProcessHeap () returned 0xd20000 [0085.708] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.708] GetProcessHeap () returned 0xd20000 [0085.708] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.708] GetProcessHeap () returned 0xd20000 [0085.708] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.708] GetProcessHeap () returned 0xd20000 [0085.708] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.708] GetProcessHeap () returned 0xd20000 [0085.708] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.708] GetProcessHeap () returned 0xd20000 [0085.708] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.708] GetProcessHeap () returned 0xd20000 [0085.708] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.708] GetProcessHeap () returned 0xd20000 [0085.708] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.708] GetProcessHeap () returned 0xd20000 [0085.708] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.708] GetProcessHeap () returned 0xd20000 [0085.708] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.709] GetProcessHeap () returned 0xd20000 [0085.709] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.709] GetProcessHeap () returned 0xd20000 [0085.709] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.709] GetProcessHeap () returned 0xd20000 [0085.709] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.709] GetProcessHeap () returned 0xd20000 [0085.709] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.709] GetProcessHeap () returned 0xd20000 [0085.709] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.709] GetProcessHeap () returned 0xd20000 [0085.709] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.709] GetProcessHeap () returned 0xd20000 [0085.709] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.709] GetProcessHeap () returned 0xd20000 [0085.709] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.709] GetProcessHeap () returned 0xd20000 [0085.709] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.709] GetProcessHeap () returned 0xd20000 [0085.709] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.710] GetProcessHeap () returned 0xd20000 [0085.710] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.710] GetProcessHeap () returned 0xd20000 [0085.710] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.710] GetProcessHeap () returned 0xd20000 [0085.710] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.710] GetProcessHeap () returned 0xd20000 [0085.710] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.710] GetProcessHeap () returned 0xd20000 [0085.710] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.710] GetProcessHeap () returned 0xd20000 [0085.710] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.710] GetProcessHeap () returned 0xd20000 [0085.710] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.710] GetProcessHeap () returned 0xd20000 [0085.710] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.710] GetProcessHeap () returned 0xd20000 [0085.710] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.710] GetProcessHeap () returned 0xd20000 [0085.710] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0085.711] GetProcessHeap () returned 0xd20000 [0085.711] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0085.711] GetProcessHeap () returned 0xd20000 [0085.711] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.711] GetProcessHeap () returned 0xd20000 [0085.711] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.711] GetProcessHeap () returned 0xd20000 [0085.711] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.711] GetProcessHeap () returned 0xd20000 [0085.711] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.711] GetProcessHeap () returned 0xd20000 [0085.711] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.711] GetProcessHeap () returned 0xd20000 [0085.711] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.711] GetProcessHeap () returned 0xd20000 [0085.711] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.711] GetProcessHeap () returned 0xd20000 [0085.711] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.711] GetProcessHeap () returned 0xd20000 [0085.711] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0085.712] GetProcessHeap () returned 0xd20000 [0085.712] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0085.712] GetProcessHeap () returned 0xd20000 [0085.712] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.712] GetProcessHeap () returned 0xd20000 [0085.712] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.712] GetProcessHeap () returned 0xd20000 [0085.712] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.712] GetProcessHeap () returned 0xd20000 [0085.712] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.712] GetProcessHeap () returned 0xd20000 [0085.712] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.712] GetProcessHeap () returned 0xd20000 [0085.712] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.712] GetProcessHeap () returned 0xd20000 [0085.712] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.712] GetProcessHeap () returned 0xd20000 [0085.712] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.712] GetProcessHeap () returned 0xd20000 [0085.712] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.712] GetProcessHeap () returned 0xd20000 [0085.713] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.713] GetProcessHeap () returned 0xd20000 [0085.713] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.713] GetProcessHeap () returned 0xd20000 [0085.713] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.713] GetProcessHeap () returned 0xd20000 [0085.713] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.713] GetProcessHeap () returned 0xd20000 [0085.713] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.713] GetProcessHeap () returned 0xd20000 [0085.713] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0085.713] GetProcessHeap () returned 0xd20000 [0085.713] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0085.713] GetProcessHeap () returned 0xd20000 [0085.713] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.713] GetProcessHeap () returned 0xd20000 [0085.713] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.713] GetProcessHeap () returned 0xd20000 [0085.713] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.713] GetProcessHeap () returned 0xd20000 [0085.713] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.714] GetProcessHeap () returned 0xd20000 [0085.714] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.714] GetProcessHeap () returned 0xd20000 [0085.714] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.714] GetProcessHeap () returned 0xd20000 [0085.714] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.715] GetProcessHeap () returned 0xd20000 [0085.715] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.715] GetProcessHeap () returned 0xd20000 [0085.715] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.715] GetProcessHeap () returned 0xd20000 [0085.715] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.715] GetProcessHeap () returned 0xd20000 [0085.715] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.715] GetProcessHeap () returned 0xd20000 [0085.715] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.715] GetProcessHeap () returned 0xd20000 [0085.715] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0085.715] GetProcessHeap () returned 0xd20000 [0085.715] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.715] GetProcessHeap () returned 0xd20000 [0085.715] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0085.716] GetProcessHeap () returned 0xd20000 [0085.716] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.716] GetProcessHeap () returned 0xd20000 [0085.716] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.716] GetProcessHeap () returned 0xd20000 [0085.716] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.716] GetProcessHeap () returned 0xd20000 [0085.716] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.716] GetProcessHeap () returned 0xd20000 [0085.716] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.716] GetProcessHeap () returned 0xd20000 [0085.716] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0085.716] GetProcessHeap () returned 0xd20000 [0085.716] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0085.716] GetProcessHeap () returned 0xd20000 [0085.716] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0085.716] GetProcessHeap () returned 0xd20000 [0085.716] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0085.716] GetProcessHeap () returned 0xd20000 [0085.716] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.717] GetProcessHeap () returned 0xd20000 [0085.717] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.717] GetProcessHeap () returned 0xd20000 [0085.717] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0085.717] GetProcessHeap () returned 0xd20000 [0085.717] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0085.717] GetProcessHeap () returned 0xd20000 [0085.717] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0085.717] GetProcessHeap () returned 0xd20000 [0085.717] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0085.717] GetProcessHeap () returned 0xd20000 [0085.717] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444c8 | out: hHeap=0xd20000) returned 1 [0085.717] GetProcessHeap () returned 0xd20000 [0085.717] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ab88 | out: hHeap=0xd20000) returned 1 [0085.717] GetProcessHeap () returned 0xd20000 [0085.717] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0085.717] GetProcessHeap () returned 0xd20000 [0085.717] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b128 | out: hHeap=0xd20000) returned 1 [0085.718] GetProcessHeap () returned 0xd20000 [0085.718] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0085.718] GetProcessHeap () returned 0xd20000 [0085.718] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.718] GetProcessHeap () returned 0xd20000 [0085.718] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0085.718] WriteFile (in: hFile=0x230, lpBuffer=0xd4c408*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4c408*, lpNumberOfBytesWritten=0x299d864*=0x386, lpOverlapped=0x0) returned 1 [0085.725] GetProcessHeap () returned 0xd20000 [0085.726] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4c408, Size=0x30) returned 0xd4c408 [0085.726] GetProcessHeap () returned 0xd20000 [0085.726] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0085.726] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0085.726] GetProcessHeap () returned 0xd20000 [0085.726] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xda40) returned 0xd4c440 [0085.727] ReadFile (in: hFile=0x230, lpBuffer=0xd4c440, nNumberOfBytesToRead=0xda40, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4c440*, lpNumberOfBytesRead=0x299d7e8*=0xda40, lpOverlapped=0x0) returned 1 [0085.733] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0085.733] WriteFile (in: hFile=0x230, lpBuffer=0xd4c440*, nNumberOfBytesToWrite=0xda40, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4c440*, lpNumberOfBytesWritten=0x299d7e4*=0xda40, lpOverlapped=0x0) returned 1 [0085.753] GetProcessHeap () returned 0xd20000 [0085.754] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c440 | out: hHeap=0xd20000) returned 1 [0085.754] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0085.754] WriteFile (in: hFile=0x230, lpBuffer=0xd4c408*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4c408*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0085.756] CloseHandle (hObject=0x230) returned 1 [0085.759] GetProcessHeap () returned 0xd20000 [0085.759] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd424e0 | out: hHeap=0xd20000) returned 1 [0085.759] GetProcessHeap () returned 0xd20000 [0085.760] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4be18 | out: hHeap=0xd20000) returned 1 [0085.760] GetProcessHeap () returned 0xd20000 [0085.760] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0085.760] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" [0085.760] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm.[ponce.lorena@aol.com]" [0085.760] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_eos.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0085.761] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\default_eos.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0085.761] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0085.761] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" [0085.761] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_recover.html")) returned 0x20 [0085.761] GetProcessHeap () returned 0xd20000 [0085.762] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445d0 | out: hHeap=0xd20000) returned 1 [0085.762] FindNextFileW (in: hFindFile=0xd49060, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c12fc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c12fc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1468, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="default_oobe.css", cAlternateFileName="DEFAUL~2.CSS")) returned 1 [0085.762] lstrcmpiW (lpString1="default_oobe.css", lpString2=".") returned 1 [0085.762] lstrcmpiW (lpString1="default_oobe.css", lpString2="..") returned 1 [0085.762] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="default_oobe.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css") returned="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css" [0085.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default_oobe.css", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0085.762] GetProcessHeap () returned 0xd20000 [0085.762] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x11) returned 0xd36748 [0085.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default_oobe.css", cchWideChar=-1, lpMultiByteStr=0xd36748, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="default_oobe.css", lpUsedDefaultChar=0x0) returned 17 [0085.762] lstrlenA (lpString="default_oobe.css") returned 16 [0085.762] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0085.762] lstrlenA (lpString="default_oobe.css") returned 16 [0085.762] lstrlenA (lpString=".dll") returned 4 [0085.762] lstrlenA (lpString=".dll") returned 4 [0085.762] lstrlenA (lpString="default_oobe.css") returned 16 [0085.762] lstrcmpiA (lpString1=".css", lpString2=".dll") returned -1 [0085.762] lstrlenA (lpString="default_oobe.css") returned 16 [0085.762] lstrlenA (lpString=".ini") returned 4 [0085.763] lstrlenA (lpString=".ini") returned 4 [0085.763] lstrlenA (lpString="default_oobe.css") returned 16 [0085.763] lstrcmpiA (lpString1=".css", lpString2=".ini") returned -1 [0085.763] lstrlenA (lpString="default_oobe.css") returned 16 [0085.763] lstrlenA (lpString=".inc") returned 4 [0085.763] lstrlenA (lpString=".inc") returned 4 [0085.763] lstrlenA (lpString="default_oobe.css") returned 16 [0085.763] lstrcmpiA (lpString1=".css", lpString2=".inc") returned -1 [0085.763] lstrcmpiW (lpString1="default_oobe.css", lpString2="HOW_RECOVER.html") returned -1 [0085.763] lstrcmpiW (lpString1="default_oobe.css", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0085.763] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0085.763] lstrcmpiW (lpString1="default_oobe.css", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0085.763] GetProcessHeap () returned 0xd20000 [0085.763] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd424e0 [0085.763] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0085.764] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=5224) returned 1 [0085.764] GetProcessHeap () returned 0xd20000 [0085.764] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c0e8 [0085.764] GetProcessHeap () returned 0xd20000 [0085.764] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0085.764] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css") returned 49 [0085.764] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0085.764] GetProcessHeap () returned 0xd20000 [0085.764] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0085.765] GetProcessHeap () returned 0xd20000 [0085.765] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x388) returned 0xd4c440 [0085.765] lstrlenA (lpString="rsa_encrypt") returned 11 [0085.765] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0085.767] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0085.767] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0085.767] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0085.767] GetProcessHeap () returned 0xd20000 [0085.767] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0085.767] lstrlenA (lpString="010001") returned 6 [0085.768] GetProcessHeap () returned 0xd20000 [0085.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cdb8 [0085.768] GetProcessHeap () returned 0xd20000 [0085.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0085.768] GetProcessHeap () returned 0xd20000 [0085.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4a948 [0085.768] GetProcessHeap () returned 0xd20000 [0085.768] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0085.768] GetProcessHeap () returned 0xd20000 [0085.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b128 [0085.768] GetProcessHeap () returned 0xd20000 [0085.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd451e0 [0085.768] GetProcessHeap () returned 0xd20000 [0085.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd28 [0085.768] GetProcessHeap () returned 0xd20000 [0085.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0085.769] GetProcessHeap () returned 0xd20000 [0085.769] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.769] GetProcessHeap () returned 0xd20000 [0085.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0085.769] GetProcessHeap () returned 0xd20000 [0085.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0085.769] GetProcessHeap () returned 0xd20000 [0085.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44920 [0085.769] GetProcessHeap () returned 0xd20000 [0085.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0085.769] GetProcessHeap () returned 0xd20000 [0085.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44588 [0085.769] GetProcessHeap () returned 0xd20000 [0085.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0085.769] GetProcessHeap () returned 0xd20000 [0085.769] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0085.769] GetProcessHeap () returned 0xd20000 [0085.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0085.770] GetProcessHeap () returned 0xd20000 [0085.770] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0085.770] GetProcessHeap () returned 0xd20000 [0085.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.770] GetProcessHeap () returned 0xd20000 [0085.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444c8 [0085.770] GetProcessHeap () returned 0xd20000 [0085.770] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0085.770] GetProcessHeap () returned 0xd20000 [0085.770] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.770] GetProcessHeap () returned 0xd20000 [0085.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.770] GetProcessHeap () returned 0xd20000 [0085.770] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.770] GetProcessHeap () returned 0xd20000 [0085.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.770] GetProcessHeap () returned 0xd20000 [0085.771] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.771] GetProcessHeap () returned 0xd20000 [0085.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4adc8 [0085.771] GetProcessHeap () returned 0xd20000 [0085.771] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444c8 | out: hHeap=0xd20000) returned 1 [0085.771] GetProcessHeap () returned 0xd20000 [0085.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0085.771] GetProcessHeap () returned 0xd20000 [0085.771] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4adc8 | out: hHeap=0xd20000) returned 1 [0085.771] GetProcessHeap () returned 0xd20000 [0085.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.771] GetProcessHeap () returned 0xd20000 [0085.771] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.771] GetProcessHeap () returned 0xd20000 [0085.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.771] GetProcessHeap () returned 0xd20000 [0085.771] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.771] GetProcessHeap () returned 0xd20000 [0085.772] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.772] GetProcessHeap () returned 0xd20000 [0085.772] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.772] GetProcessHeap () returned 0xd20000 [0085.772] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.772] GetProcessHeap () returned 0xd20000 [0085.772] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.772] GetProcessHeap () returned 0xd20000 [0085.772] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.772] GetProcessHeap () returned 0xd20000 [0085.772] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.772] GetProcessHeap () returned 0xd20000 [0085.772] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.772] GetProcessHeap () returned 0xd20000 [0085.772] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.772] GetProcessHeap () returned 0xd20000 [0085.772] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0085.773] GetProcessHeap () returned 0xd20000 [0085.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0085.773] GetProcessHeap () returned 0xd20000 [0085.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.773] GetProcessHeap () returned 0xd20000 [0085.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.773] GetProcessHeap () returned 0xd20000 [0085.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.773] GetProcessHeap () returned 0xd20000 [0085.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.773] GetProcessHeap () returned 0xd20000 [0085.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0085.773] GetProcessHeap () returned 0xd20000 [0085.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.773] GetProcessHeap () returned 0xd20000 [0085.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.773] GetProcessHeap () returned 0xd20000 [0085.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.773] GetProcessHeap () returned 0xd20000 [0085.774] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.774] GetProcessHeap () returned 0xd20000 [0085.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.774] GetProcessHeap () returned 0xd20000 [0085.774] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0085.774] GetProcessHeap () returned 0xd20000 [0085.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0085.774] GetProcessHeap () returned 0xd20000 [0085.774] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.774] GetProcessHeap () returned 0xd20000 [0085.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.774] GetProcessHeap () returned 0xd20000 [0085.774] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.774] GetProcessHeap () returned 0xd20000 [0085.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.774] GetProcessHeap () returned 0xd20000 [0085.774] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.774] GetProcessHeap () returned 0xd20000 [0085.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.774] GetProcessHeap () returned 0xd20000 [0085.775] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.775] GetProcessHeap () returned 0xd20000 [0085.775] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.775] GetProcessHeap () returned 0xd20000 [0085.775] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.775] GetProcessHeap () returned 0xd20000 [0085.775] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.775] GetProcessHeap () returned 0xd20000 [0085.775] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0085.775] GetProcessHeap () returned 0xd20000 [0085.775] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0085.775] GetProcessHeap () returned 0xd20000 [0085.775] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.775] GetProcessHeap () returned 0xd20000 [0085.775] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.775] GetProcessHeap () returned 0xd20000 [0085.775] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.775] GetProcessHeap () returned 0xd20000 [0085.775] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.775] GetProcessHeap () returned 0xd20000 [0085.776] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.776] GetProcessHeap () returned 0xd20000 [0085.776] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.776] GetProcessHeap () returned 0xd20000 [0085.776] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.776] GetProcessHeap () returned 0xd20000 [0085.776] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.776] GetProcessHeap () returned 0xd20000 [0085.776] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.776] GetProcessHeap () returned 0xd20000 [0085.776] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.776] GetProcessHeap () returned 0xd20000 [0085.776] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.776] GetProcessHeap () returned 0xd20000 [0085.776] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.776] GetProcessHeap () returned 0xd20000 [0085.776] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0085.776] GetProcessHeap () returned 0xd20000 [0085.776] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.777] GetProcessHeap () returned 0xd20000 [0085.777] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.777] GetProcessHeap () returned 0xd20000 [0085.777] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.777] GetProcessHeap () returned 0xd20000 [0085.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.778] GetProcessHeap () returned 0xd20000 [0085.778] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.778] GetProcessHeap () returned 0xd20000 [0085.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.778] GetProcessHeap () returned 0xd20000 [0085.778] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.778] GetProcessHeap () returned 0xd20000 [0085.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.778] GetProcessHeap () returned 0xd20000 [0085.778] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.778] GetProcessHeap () returned 0xd20000 [0085.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0085.778] GetProcessHeap () returned 0xd20000 [0085.778] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0085.778] GetProcessHeap () returned 0xd20000 [0085.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.778] GetProcessHeap () returned 0xd20000 [0085.778] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.778] GetProcessHeap () returned 0xd20000 [0085.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.779] GetProcessHeap () returned 0xd20000 [0085.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.779] GetProcessHeap () returned 0xd20000 [0085.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.779] GetProcessHeap () returned 0xd20000 [0085.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.779] GetProcessHeap () returned 0xd20000 [0085.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.779] GetProcessHeap () returned 0xd20000 [0085.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.779] GetProcessHeap () returned 0xd20000 [0085.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.779] GetProcessHeap () returned 0xd20000 [0085.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.779] GetProcessHeap () returned 0xd20000 [0085.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.782] GetProcessHeap () returned 0xd20000 [0085.782] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.782] GetProcessHeap () returned 0xd20000 [0085.782] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.782] GetProcessHeap () returned 0xd20000 [0085.782] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.782] GetProcessHeap () returned 0xd20000 [0085.782] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.782] GetProcessHeap () returned 0xd20000 [0085.782] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.782] GetProcessHeap () returned 0xd20000 [0085.782] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.782] GetProcessHeap () returned 0xd20000 [0085.782] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.782] GetProcessHeap () returned 0xd20000 [0085.782] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.782] GetProcessHeap () returned 0xd20000 [0085.782] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.783] GetProcessHeap () returned 0xd20000 [0085.783] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.783] GetProcessHeap () returned 0xd20000 [0085.783] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.783] GetProcessHeap () returned 0xd20000 [0085.783] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.783] GetProcessHeap () returned 0xd20000 [0085.783] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.783] GetProcessHeap () returned 0xd20000 [0085.783] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.783] GetProcessHeap () returned 0xd20000 [0085.783] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.783] GetProcessHeap () returned 0xd20000 [0085.783] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.783] GetProcessHeap () returned 0xd20000 [0085.783] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.783] GetProcessHeap () returned 0xd20000 [0085.783] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0085.783] GetProcessHeap () returned 0xd20000 [0085.783] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0085.784] GetProcessHeap () returned 0xd20000 [0085.784] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.784] GetProcessHeap () returned 0xd20000 [0085.784] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.784] GetProcessHeap () returned 0xd20000 [0085.784] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.784] GetProcessHeap () returned 0xd20000 [0085.784] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.784] GetProcessHeap () returned 0xd20000 [0085.784] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.784] GetProcessHeap () returned 0xd20000 [0085.784] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.784] GetProcessHeap () returned 0xd20000 [0085.784] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.784] GetProcessHeap () returned 0xd20000 [0085.784] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.784] GetProcessHeap () returned 0xd20000 [0085.784] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.784] GetProcessHeap () returned 0xd20000 [0085.784] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.785] GetProcessHeap () returned 0xd20000 [0085.785] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.785] GetProcessHeap () returned 0xd20000 [0085.785] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.785] GetProcessHeap () returned 0xd20000 [0085.785] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.785] GetProcessHeap () returned 0xd20000 [0085.785] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.785] GetProcessHeap () returned 0xd20000 [0085.785] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.785] GetProcessHeap () returned 0xd20000 [0085.785] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.785] GetProcessHeap () returned 0xd20000 [0085.785] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.785] GetProcessHeap () returned 0xd20000 [0085.785] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.785] GetProcessHeap () returned 0xd20000 [0085.785] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.785] GetProcessHeap () returned 0xd20000 [0085.785] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.785] GetProcessHeap () returned 0xd20000 [0085.786] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.786] GetProcessHeap () returned 0xd20000 [0085.786] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.786] GetProcessHeap () returned 0xd20000 [0085.786] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.786] GetProcessHeap () returned 0xd20000 [0085.786] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.786] GetProcessHeap () returned 0xd20000 [0085.786] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.786] GetProcessHeap () returned 0xd20000 [0085.786] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.786] GetProcessHeap () returned 0xd20000 [0085.786] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.786] GetProcessHeap () returned 0xd20000 [0085.786] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.786] GetProcessHeap () returned 0xd20000 [0085.786] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.786] GetProcessHeap () returned 0xd20000 [0085.786] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.786] GetProcessHeap () returned 0xd20000 [0085.787] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.787] GetProcessHeap () returned 0xd20000 [0085.787] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.787] GetProcessHeap () returned 0xd20000 [0085.787] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.787] GetProcessHeap () returned 0xd20000 [0085.787] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.787] GetProcessHeap () returned 0xd20000 [0085.787] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0085.787] GetProcessHeap () returned 0xd20000 [0085.787] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0085.787] GetProcessHeap () returned 0xd20000 [0085.787] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.787] GetProcessHeap () returned 0xd20000 [0085.787] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.787] GetProcessHeap () returned 0xd20000 [0085.787] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.787] GetProcessHeap () returned 0xd20000 [0085.787] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.788] GetProcessHeap () returned 0xd20000 [0085.788] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.788] GetProcessHeap () returned 0xd20000 [0085.788] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.788] GetProcessHeap () returned 0xd20000 [0085.788] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.788] GetProcessHeap () returned 0xd20000 [0085.788] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.788] GetProcessHeap () returned 0xd20000 [0085.788] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0085.788] GetProcessHeap () returned 0xd20000 [0085.788] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0085.788] GetProcessHeap () returned 0xd20000 [0085.788] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.788] GetProcessHeap () returned 0xd20000 [0085.788] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.788] GetProcessHeap () returned 0xd20000 [0085.788] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.788] GetProcessHeap () returned 0xd20000 [0085.788] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.789] GetProcessHeap () returned 0xd20000 [0085.789] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.789] GetProcessHeap () returned 0xd20000 [0085.789] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.789] GetProcessHeap () returned 0xd20000 [0085.789] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.789] GetProcessHeap () returned 0xd20000 [0085.789] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.789] GetProcessHeap () returned 0xd20000 [0085.789] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0085.789] GetProcessHeap () returned 0xd20000 [0085.789] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0085.789] GetProcessHeap () returned 0xd20000 [0085.789] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.789] GetProcessHeap () returned 0xd20000 [0085.789] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.789] GetProcessHeap () returned 0xd20000 [0085.789] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.789] GetProcessHeap () returned 0xd20000 [0085.790] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.790] GetProcessHeap () returned 0xd20000 [0085.790] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.790] GetProcessHeap () returned 0xd20000 [0085.790] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.790] GetProcessHeap () returned 0xd20000 [0085.790] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0085.790] GetProcessHeap () returned 0xd20000 [0085.790] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0085.790] GetProcessHeap () returned 0xd20000 [0085.790] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.790] GetProcessHeap () returned 0xd20000 [0085.790] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.790] GetProcessHeap () returned 0xd20000 [0085.790] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0085.790] GetProcessHeap () returned 0xd20000 [0085.790] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0085.790] GetProcessHeap () returned 0xd20000 [0085.790] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.790] GetProcessHeap () returned 0xd20000 [0085.791] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.791] GetProcessHeap () returned 0xd20000 [0085.791] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.791] GetProcessHeap () returned 0xd20000 [0085.791] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.791] GetProcessHeap () returned 0xd20000 [0085.791] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.791] GetProcessHeap () returned 0xd20000 [0085.791] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.791] GetProcessHeap () returned 0xd20000 [0085.791] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.791] GetProcessHeap () returned 0xd20000 [0085.791] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.791] GetProcessHeap () returned 0xd20000 [0085.791] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.791] GetProcessHeap () returned 0xd20000 [0085.791] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.791] GetProcessHeap () returned 0xd20000 [0085.791] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0085.791] GetProcessHeap () returned 0xd20000 [0085.792] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0085.792] GetProcessHeap () returned 0xd20000 [0085.792] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0085.792] GetProcessHeap () returned 0xd20000 [0085.792] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0085.792] GetProcessHeap () returned 0xd20000 [0085.792] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44588 | out: hHeap=0xd20000) returned 1 [0085.792] GetProcessHeap () returned 0xd20000 [0085.792] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b128 | out: hHeap=0xd20000) returned 1 [0085.793] GetProcessHeap () returned 0xd20000 [0085.793] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0085.793] GetProcessHeap () returned 0xd20000 [0085.793] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a948 | out: hHeap=0xd20000) returned 1 [0085.793] GetProcessHeap () returned 0xd20000 [0085.794] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0085.794] GetProcessHeap () returned 0xd20000 [0085.794] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.794] GetProcessHeap () returned 0xd20000 [0085.794] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0085.794] WriteFile (in: hFile=0x230, lpBuffer=0xd4c440*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4c440*, lpNumberOfBytesWritten=0x299d864*=0x388, lpOverlapped=0x0) returned 1 [0085.801] GetProcessHeap () returned 0xd20000 [0085.801] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4c440, Size=0x30) returned 0xd4c440 [0085.802] GetProcessHeap () returned 0xd20000 [0085.802] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0085.802] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0085.802] GetProcessHeap () returned 0xd20000 [0085.802] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1470) returned 0xd4c478 [0085.802] ReadFile (in: hFile=0x230, lpBuffer=0xd4c478, nNumberOfBytesToRead=0x1470, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4c478*, lpNumberOfBytesRead=0x299d7e8*=0x1470, lpOverlapped=0x0) returned 1 [0085.806] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0085.806] WriteFile (in: hFile=0x230, lpBuffer=0xd4c478*, nNumberOfBytesToWrite=0x1470, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4c478*, lpNumberOfBytesWritten=0x299d7e4*=0x1470, lpOverlapped=0x0) returned 1 [0085.812] GetProcessHeap () returned 0xd20000 [0085.812] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c478 | out: hHeap=0xd20000) returned 1 [0085.812] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0085.812] WriteFile (in: hFile=0x230, lpBuffer=0xd4c440*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4c440*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0085.814] CloseHandle (hObject=0x230) returned 1 [0085.817] GetProcessHeap () returned 0xd20000 [0085.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd424e0 | out: hHeap=0xd20000) returned 1 [0085.817] GetProcessHeap () returned 0xd20000 [0085.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c0e8 | out: hHeap=0xd20000) returned 1 [0085.817] GetProcessHeap () returned 0xd20000 [0085.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0085.818] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css") returned="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css" [0085.818] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css.[ponce.lorena@aol.com]" [0085.818] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.css"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.css.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0085.819] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.css" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0085.819] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0085.819] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" [0085.819] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_recover.html")) returned 0x20 [0085.819] GetProcessHeap () returned 0xd20000 [0085.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36748 | out: hHeap=0xd20000) returned 1 [0085.819] FindNextFileW (in: hFindFile=0xd49060, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c2685, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c2685, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x7f589b00, ftLastWriteTime.dwHighDateTime=0x1d2ea8c, nFileSizeHigh=0x0, nFileSizeLow=0x100ae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="default_oobe.htm", cAlternateFileName="DEFAUL~2.HTM")) returned 1 [0085.819] lstrcmpiW (lpString1="default_oobe.htm", lpString2=".") returned 1 [0085.819] lstrcmpiW (lpString1="default_oobe.htm", lpString2="..") returned 1 [0085.819] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="default_oobe.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" [0085.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default_oobe.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0085.819] GetProcessHeap () returned 0xd20000 [0085.819] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x11) returned 0xd36568 [0085.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="default_oobe.htm", cchWideChar=-1, lpMultiByteStr=0xd36568, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="default_oobe.htm", lpUsedDefaultChar=0x0) returned 17 [0085.820] lstrlenA (lpString="default_oobe.htm") returned 16 [0085.820] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0085.820] lstrlenA (lpString="default_oobe.htm") returned 16 [0085.820] lstrlenA (lpString=".dll") returned 4 [0085.820] lstrlenA (lpString=".dll") returned 4 [0085.820] lstrlenA (lpString="default_oobe.htm") returned 16 [0085.820] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0085.820] lstrlenA (lpString="default_oobe.htm") returned 16 [0085.820] lstrlenA (lpString=".ini") returned 4 [0085.820] lstrlenA (lpString=".ini") returned 4 [0085.820] lstrlenA (lpString="default_oobe.htm") returned 16 [0085.820] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0085.820] lstrlenA (lpString="default_oobe.htm") returned 16 [0085.820] lstrlenA (lpString=".inc") returned 4 [0085.820] lstrlenA (lpString=".inc") returned 4 [0085.820] lstrlenA (lpString="default_oobe.htm") returned 16 [0085.821] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0085.821] lstrcmpiW (lpString1="default_oobe.htm", lpString2="HOW_RECOVER.html") returned -1 [0085.821] lstrcmpiW (lpString1="default_oobe.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0085.821] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0085.821] lstrcmpiW (lpString1="default_oobe.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0085.821] GetProcessHeap () returned 0xd20000 [0085.821] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd424b8 [0085.821] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0085.821] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=65710) returned 1 [0085.821] GetProcessHeap () returned 0xd20000 [0085.822] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c250 [0085.822] GetProcessHeap () returned 0xd20000 [0085.822] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0085.822] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm") returned 49 [0085.822] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0085.822] GetProcessHeap () returned 0xd20000 [0085.822] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0085.822] GetProcessHeap () returned 0xd20000 [0085.822] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x382) returned 0xd4c478 [0085.822] lstrlenA (lpString="rsa_encrypt") returned 11 [0085.822] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0085.825] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0085.825] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0085.825] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0085.825] GetProcessHeap () returned 0xd20000 [0085.825] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0085.825] lstrlenA (lpString="010001") returned 6 [0085.825] GetProcessHeap () returned 0xd20000 [0085.826] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc58 [0085.826] GetProcessHeap () returned 0xd20000 [0085.826] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0085.826] GetProcessHeap () returned 0xd20000 [0085.826] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b128 [0085.826] GetProcessHeap () returned 0xd20000 [0085.826] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0085.826] GetProcessHeap () returned 0xd20000 [0085.826] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4adc8 [0085.826] GetProcessHeap () returned 0xd20000 [0085.826] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44fb0 [0085.826] GetProcessHeap () returned 0xd20000 [0085.826] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd28 [0085.826] GetProcessHeap () returned 0xd20000 [0085.826] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0085.826] GetProcessHeap () returned 0xd20000 [0085.826] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.827] GetProcessHeap () returned 0xd20000 [0085.827] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0085.827] GetProcessHeap () returned 0xd20000 [0085.827] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0085.827] GetProcessHeap () returned 0xd20000 [0085.827] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44920 [0085.827] GetProcessHeap () returned 0xd20000 [0085.827] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.827] GetProcessHeap () returned 0xd20000 [0085.827] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444c8 [0085.827] GetProcessHeap () returned 0xd20000 [0085.827] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0085.827] GetProcessHeap () returned 0xd20000 [0085.827] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0085.827] GetProcessHeap () returned 0xd20000 [0085.827] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0085.827] GetProcessHeap () returned 0xd20000 [0085.827] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0085.828] GetProcessHeap () returned 0xd20000 [0085.828] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0085.828] GetProcessHeap () returned 0xd20000 [0085.828] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44660 [0085.828] GetProcessHeap () returned 0xd20000 [0085.828] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.828] GetProcessHeap () returned 0xd20000 [0085.828] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0085.828] GetProcessHeap () returned 0xd20000 [0085.828] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.828] GetProcessHeap () returned 0xd20000 [0085.828] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.828] GetProcessHeap () returned 0xd20000 [0085.828] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.828] GetProcessHeap () returned 0xd20000 [0085.828] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.828] GetProcessHeap () returned 0xd20000 [0085.828] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b3f8 [0085.828] GetProcessHeap () returned 0xd20000 [0085.828] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44660 | out: hHeap=0xd20000) returned 1 [0085.828] GetProcessHeap () returned 0xd20000 [0085.829] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0085.829] GetProcessHeap () returned 0xd20000 [0085.829] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b3f8 | out: hHeap=0xd20000) returned 1 [0085.829] GetProcessHeap () returned 0xd20000 [0085.829] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.829] GetProcessHeap () returned 0xd20000 [0085.829] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.829] GetProcessHeap () returned 0xd20000 [0085.829] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.829] GetProcessHeap () returned 0xd20000 [0085.829] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.829] GetProcessHeap () returned 0xd20000 [0085.829] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.829] GetProcessHeap () returned 0xd20000 [0085.829] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.829] GetProcessHeap () returned 0xd20000 [0085.829] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.830] GetProcessHeap () returned 0xd20000 [0085.830] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.830] GetProcessHeap () returned 0xd20000 [0085.830] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.830] GetProcessHeap () returned 0xd20000 [0085.830] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.830] GetProcessHeap () returned 0xd20000 [0085.830] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.830] GetProcessHeap () returned 0xd20000 [0085.830] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.830] GetProcessHeap () returned 0xd20000 [0085.830] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.830] GetProcessHeap () returned 0xd20000 [0085.830] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.830] GetProcessHeap () returned 0xd20000 [0085.830] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.830] GetProcessHeap () returned 0xd20000 [0085.830] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.830] GetProcessHeap () returned 0xd20000 [0085.830] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.831] GetProcessHeap () returned 0xd20000 [0085.831] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.831] GetProcessHeap () returned 0xd20000 [0085.831] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.831] GetProcessHeap () returned 0xd20000 [0085.831] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.831] GetProcessHeap () returned 0xd20000 [0085.831] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0085.831] GetProcessHeap () returned 0xd20000 [0085.831] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0085.831] GetProcessHeap () returned 0xd20000 [0085.831] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.831] GetProcessHeap () returned 0xd20000 [0085.831] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.831] GetProcessHeap () returned 0xd20000 [0085.831] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.831] GetProcessHeap () returned 0xd20000 [0085.831] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.832] GetProcessHeap () returned 0xd20000 [0085.832] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.832] GetProcessHeap () returned 0xd20000 [0085.832] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.832] GetProcessHeap () returned 0xd20000 [0085.832] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0085.832] GetProcessHeap () returned 0xd20000 [0085.832] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0085.832] GetProcessHeap () returned 0xd20000 [0085.832] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.832] GetProcessHeap () returned 0xd20000 [0085.832] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.832] GetProcessHeap () returned 0xd20000 [0085.832] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.832] GetProcessHeap () returned 0xd20000 [0085.832] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.832] GetProcessHeap () returned 0xd20000 [0085.832] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.832] GetProcessHeap () returned 0xd20000 [0085.832] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.833] GetProcessHeap () returned 0xd20000 [0085.833] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.833] GetProcessHeap () returned 0xd20000 [0085.833] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.833] GetProcessHeap () returned 0xd20000 [0085.833] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.833] GetProcessHeap () returned 0xd20000 [0085.833] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.833] GetProcessHeap () returned 0xd20000 [0085.833] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.833] GetProcessHeap () returned 0xd20000 [0085.833] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.833] GetProcessHeap () returned 0xd20000 [0085.833] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.833] GetProcessHeap () returned 0xd20000 [0085.833] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.833] GetProcessHeap () returned 0xd20000 [0085.833] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.833] GetProcessHeap () returned 0xd20000 [0085.834] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.834] GetProcessHeap () returned 0xd20000 [0085.834] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.834] GetProcessHeap () returned 0xd20000 [0085.834] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.834] GetProcessHeap () returned 0xd20000 [0085.834] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.834] GetProcessHeap () returned 0xd20000 [0085.834] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.834] GetProcessHeap () returned 0xd20000 [0085.834] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.834] GetProcessHeap () returned 0xd20000 [0085.834] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.834] GetProcessHeap () returned 0xd20000 [0085.834] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.834] GetProcessHeap () returned 0xd20000 [0085.834] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.835] GetProcessHeap () returned 0xd20000 [0085.835] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.835] GetProcessHeap () returned 0xd20000 [0085.835] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.835] GetProcessHeap () returned 0xd20000 [0085.835] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.835] GetProcessHeap () returned 0xd20000 [0085.835] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.835] GetProcessHeap () returned 0xd20000 [0085.835] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.835] GetProcessHeap () returned 0xd20000 [0085.835] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.835] GetProcessHeap () returned 0xd20000 [0085.835] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.835] GetProcessHeap () returned 0xd20000 [0085.835] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.835] GetProcessHeap () returned 0xd20000 [0085.835] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.835] GetProcessHeap () returned 0xd20000 [0085.836] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.836] GetProcessHeap () returned 0xd20000 [0085.836] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.836] GetProcessHeap () returned 0xd20000 [0085.836] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.836] GetProcessHeap () returned 0xd20000 [0085.836] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.836] GetProcessHeap () returned 0xd20000 [0085.836] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.836] GetProcessHeap () returned 0xd20000 [0085.836] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.836] GetProcessHeap () returned 0xd20000 [0085.836] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.836] GetProcessHeap () returned 0xd20000 [0085.836] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.836] GetProcessHeap () returned 0xd20000 [0085.836] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.836] GetProcessHeap () returned 0xd20000 [0085.836] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.837] GetProcessHeap () returned 0xd20000 [0085.837] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.837] GetProcessHeap () returned 0xd20000 [0085.837] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.837] GetProcessHeap () returned 0xd20000 [0085.837] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.837] GetProcessHeap () returned 0xd20000 [0085.837] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.837] GetProcessHeap () returned 0xd20000 [0085.837] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.837] GetProcessHeap () returned 0xd20000 [0085.837] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.837] GetProcessHeap () returned 0xd20000 [0085.837] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.837] GetProcessHeap () returned 0xd20000 [0085.837] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.837] GetProcessHeap () returned 0xd20000 [0085.837] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.838] GetProcessHeap () returned 0xd20000 [0085.838] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.838] GetProcessHeap () returned 0xd20000 [0085.838] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.838] GetProcessHeap () returned 0xd20000 [0085.838] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0085.838] GetProcessHeap () returned 0xd20000 [0085.838] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0085.838] GetProcessHeap () returned 0xd20000 [0085.838] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.838] GetProcessHeap () returned 0xd20000 [0085.838] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.838] GetProcessHeap () returned 0xd20000 [0085.838] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.838] GetProcessHeap () returned 0xd20000 [0085.838] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.838] GetProcessHeap () returned 0xd20000 [0085.838] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.838] GetProcessHeap () returned 0xd20000 [0085.839] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.839] GetProcessHeap () returned 0xd20000 [0085.839] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.839] GetProcessHeap () returned 0xd20000 [0085.839] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.839] GetProcessHeap () returned 0xd20000 [0085.840] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0085.840] GetProcessHeap () returned 0xd20000 [0085.840] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0085.840] GetProcessHeap () returned 0xd20000 [0085.840] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.840] GetProcessHeap () returned 0xd20000 [0085.840] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.840] GetProcessHeap () returned 0xd20000 [0085.840] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.840] GetProcessHeap () returned 0xd20000 [0085.840] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.840] GetProcessHeap () returned 0xd20000 [0085.840] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.840] GetProcessHeap () returned 0xd20000 [0085.840] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.841] GetProcessHeap () returned 0xd20000 [0085.841] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.841] GetProcessHeap () returned 0xd20000 [0085.841] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.841] GetProcessHeap () returned 0xd20000 [0085.841] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.841] GetProcessHeap () returned 0xd20000 [0085.841] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.841] GetProcessHeap () returned 0xd20000 [0085.841] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.841] GetProcessHeap () returned 0xd20000 [0085.841] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.841] GetProcessHeap () returned 0xd20000 [0085.841] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.841] GetProcessHeap () returned 0xd20000 [0085.841] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.841] GetProcessHeap () returned 0xd20000 [0085.841] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0085.842] GetProcessHeap () returned 0xd20000 [0085.842] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0085.842] GetProcessHeap () returned 0xd20000 [0085.842] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.842] GetProcessHeap () returned 0xd20000 [0085.842] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.842] GetProcessHeap () returned 0xd20000 [0085.842] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.842] GetProcessHeap () returned 0xd20000 [0085.842] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.842] GetProcessHeap () returned 0xd20000 [0085.842] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.842] GetProcessHeap () returned 0xd20000 [0085.842] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.842] GetProcessHeap () returned 0xd20000 [0085.842] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.842] GetProcessHeap () returned 0xd20000 [0085.842] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.842] GetProcessHeap () returned 0xd20000 [0085.843] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.843] GetProcessHeap () returned 0xd20000 [0085.843] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.843] GetProcessHeap () returned 0xd20000 [0085.843] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.843] GetProcessHeap () returned 0xd20000 [0085.843] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.843] GetProcessHeap () returned 0xd20000 [0085.843] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.843] GetProcessHeap () returned 0xd20000 [0085.843] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.843] GetProcessHeap () returned 0xd20000 [0085.843] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.843] GetProcessHeap () returned 0xd20000 [0085.843] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.843] GetProcessHeap () returned 0xd20000 [0085.843] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.843] GetProcessHeap () returned 0xd20000 [0085.843] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.844] GetProcessHeap () returned 0xd20000 [0085.844] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.844] GetProcessHeap () returned 0xd20000 [0085.844] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.844] GetProcessHeap () returned 0xd20000 [0085.844] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0085.844] GetProcessHeap () returned 0xd20000 [0085.844] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0085.844] GetProcessHeap () returned 0xd20000 [0085.844] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0085.844] GetProcessHeap () returned 0xd20000 [0085.844] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0085.844] GetProcessHeap () returned 0xd20000 [0085.844] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.844] GetProcessHeap () returned 0xd20000 [0085.844] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.844] GetProcessHeap () returned 0xd20000 [0085.844] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.844] GetProcessHeap () returned 0xd20000 [0085.845] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.845] GetProcessHeap () returned 0xd20000 [0085.845] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.845] GetProcessHeap () returned 0xd20000 [0085.845] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.845] GetProcessHeap () returned 0xd20000 [0085.845] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.845] GetProcessHeap () returned 0xd20000 [0085.845] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.845] GetProcessHeap () returned 0xd20000 [0085.845] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.845] GetProcessHeap () returned 0xd20000 [0085.845] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.845] GetProcessHeap () returned 0xd20000 [0085.845] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0085.845] GetProcessHeap () returned 0xd20000 [0085.845] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0085.845] GetProcessHeap () returned 0xd20000 [0085.845] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.846] GetProcessHeap () returned 0xd20000 [0085.846] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.846] GetProcessHeap () returned 0xd20000 [0085.846] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.846] GetProcessHeap () returned 0xd20000 [0085.846] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.846] GetProcessHeap () returned 0xd20000 [0085.846] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0085.846] GetProcessHeap () returned 0xd20000 [0085.846] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0085.846] GetProcessHeap () returned 0xd20000 [0085.846] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.846] GetProcessHeap () returned 0xd20000 [0085.846] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.846] GetProcessHeap () returned 0xd20000 [0085.846] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.846] GetProcessHeap () returned 0xd20000 [0085.846] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.847] GetProcessHeap () returned 0xd20000 [0085.847] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0085.847] GetProcessHeap () returned 0xd20000 [0085.847] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0085.847] GetProcessHeap () returned 0xd20000 [0085.847] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.847] GetProcessHeap () returned 0xd20000 [0085.847] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.847] GetProcessHeap () returned 0xd20000 [0085.847] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0085.847] GetProcessHeap () returned 0xd20000 [0085.847] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0085.847] GetProcessHeap () returned 0xd20000 [0085.847] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.847] GetProcessHeap () returned 0xd20000 [0085.847] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.847] GetProcessHeap () returned 0xd20000 [0085.847] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.847] GetProcessHeap () returned 0xd20000 [0085.847] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.848] GetProcessHeap () returned 0xd20000 [0085.848] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.848] GetProcessHeap () returned 0xd20000 [0085.848] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.848] GetProcessHeap () returned 0xd20000 [0085.848] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0085.848] GetProcessHeap () returned 0xd20000 [0085.848] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0085.848] GetProcessHeap () returned 0xd20000 [0085.848] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0085.848] GetProcessHeap () returned 0xd20000 [0085.848] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0085.848] GetProcessHeap () returned 0xd20000 [0085.848] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444c8 | out: hHeap=0xd20000) returned 1 [0085.848] GetProcessHeap () returned 0xd20000 [0085.848] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4adc8 | out: hHeap=0xd20000) returned 1 [0085.848] GetProcessHeap () returned 0xd20000 [0085.848] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0085.849] GetProcessHeap () returned 0xd20000 [0085.849] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b128 | out: hHeap=0xd20000) returned 1 [0085.849] GetProcessHeap () returned 0xd20000 [0085.849] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0085.849] GetProcessHeap () returned 0xd20000 [0085.849] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.849] GetProcessHeap () returned 0xd20000 [0085.849] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0085.849] WriteFile (in: hFile=0x230, lpBuffer=0xd4c478*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4c478*, lpNumberOfBytesWritten=0x299d864*=0x382, lpOverlapped=0x0) returned 1 [0085.856] GetProcessHeap () returned 0xd20000 [0085.856] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4c478, Size=0x30) returned 0xd4c478 [0085.856] GetProcessHeap () returned 0xd20000 [0085.856] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0085.856] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0085.856] GetProcessHeap () returned 0xd20000 [0085.856] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x100b0) returned 0xd4c4b0 [0085.857] ReadFile (in: hFile=0x230, lpBuffer=0xd4c4b0, nNumberOfBytesToRead=0x100b0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4c4b0*, lpNumberOfBytesRead=0x299d7e8*=0x100b0, lpOverlapped=0x0) returned 1 [0085.860] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0085.860] WriteFile (in: hFile=0x230, lpBuffer=0xd4c4b0*, nNumberOfBytesToWrite=0x100b0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4c4b0*, lpNumberOfBytesWritten=0x299d7e4*=0x100b0, lpOverlapped=0x0) returned 1 [0085.863] GetProcessHeap () returned 0xd20000 [0085.863] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c4b0 | out: hHeap=0xd20000) returned 1 [0085.863] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0085.863] WriteFile (in: hFile=0x230, lpBuffer=0xd4c478*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4c478*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0085.865] CloseHandle (hObject=0x230) returned 1 [0085.871] GetProcessHeap () returned 0xd20000 [0085.871] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd424b8 | out: hHeap=0xd20000) returned 1 [0085.871] GetProcessHeap () returned 0xd20000 [0085.871] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c250 | out: hHeap=0xd20000) returned 1 [0085.872] GetProcessHeap () returned 0xd20000 [0085.872] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0085.872] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" [0085.872] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm.[ponce.lorena@aol.com]" [0085.872] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\default_oobe.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0085.873] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\default_oobe.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0085.873] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0085.873] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" [0085.873] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_recover.html")) returned 0x20 [0085.873] GetProcessHeap () returned 0xd20000 [0085.873] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36568 | out: hHeap=0xd20000) returned 1 [0085.873] FindNextFileW (in: hFindFile=0xd49060, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3c4d9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea5f6eb5, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA", cAlternateFileName="")) returned 1 [0085.873] lstrcmpiW (lpString1="EULA", lpString2=".") returned 1 [0085.873] lstrcmpiW (lpString1="EULA", lpString2="..") returned 1 [0085.873] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="EULA" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA" [0085.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0085.873] GetProcessHeap () returned 0xd20000 [0085.873] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x5) returned 0xd3ccf8 [0085.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA", cchWideChar=-1, lpMultiByteStr=0xd3ccf8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA", lpUsedDefaultChar=0x0) returned 5 [0085.874] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0085.874] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0085.874] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0085.874] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0085.874] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0085.874] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0085.874] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0085.874] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0085.874] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0085.874] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0085.874] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0085.874] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0085.874] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0085.874] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0085.874] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0085.874] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0085.875] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0085.875] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0085.875] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0085.875] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0085.875] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0085.875] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0085.875] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0085.875] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0085.875] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0085.875] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0085.875] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0085.875] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0085.875] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0085.875] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0085.875] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0085.875] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0085.876] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0085.876] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0085.876] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0085.876] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0085.876] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0085.876] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0085.876] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0085.876] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0085.876] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0085.876] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0085.876] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="EULA", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0085.876] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0085.876] GetProcessHeap () returned 0xd20000 [0085.876] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cbd8 [0085.876] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned 38 [0085.876] GetProcessHeap () returned 0xd20000 [0085.876] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4e) returned 0xd3c308 [0085.876] lstrcpyW (in: lpString1=0xd3c308, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0085.877] GetProcessHeap () returned 0xd20000 [0085.877] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.877] FindNextFileW (in: hFindFile=0xd49060, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="eula.css", cAlternateFileName="")) returned 1 [0085.877] lstrcmpiW (lpString1="eula.css", lpString2=".") returned 1 [0085.877] lstrcmpiW (lpString1="eula.css", lpString2="..") returned 1 [0085.877] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="eula.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\eula.css") returned="C:\\Windows10Upgrade\\resources\\ux\\eula.css" [0085.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eula.css", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0085.877] GetProcessHeap () returned 0xd20000 [0085.877] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x9) returned 0xd445a0 [0085.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="eula.css", cchWideChar=-1, lpMultiByteStr=0xd445a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="eula.css", lpUsedDefaultChar=0x0) returned 9 [0085.877] lstrlenA (lpString="eula.css") returned 8 [0085.877] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0085.877] lstrlenA (lpString="eula.css") returned 8 [0085.877] lstrlenA (lpString=".dll") returned 4 [0085.877] lstrlenA (lpString=".dll") returned 4 [0085.877] lstrlenA (lpString="eula.css") returned 8 [0085.877] lstrcmpiA (lpString1=".css", lpString2=".dll") returned -1 [0085.877] lstrlenA (lpString="eula.css") returned 8 [0085.878] lstrlenA (lpString=".ini") returned 4 [0085.878] lstrlenA (lpString=".ini") returned 4 [0085.878] lstrlenA (lpString="eula.css") returned 8 [0085.878] lstrcmpiA (lpString1=".css", lpString2=".ini") returned -1 [0085.878] lstrlenA (lpString="eula.css") returned 8 [0085.878] lstrlenA (lpString=".inc") returned 4 [0085.878] lstrlenA (lpString=".inc") returned 4 [0085.878] lstrlenA (lpString="eula.css") returned 8 [0085.878] lstrcmpiA (lpString1=".css", lpString2=".inc") returned -1 [0085.878] lstrcmpiW (lpString1="eula.css", lpString2="HOW_RECOVER.html") returned -1 [0085.878] lstrcmpiW (lpString1="eula.css", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0085.878] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0085.878] lstrcmpiW (lpString1="eula.css", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0085.878] GetProcessHeap () returned 0xd20000 [0085.878] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd426c0 [0085.878] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\eula.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0085.880] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=82) returned 1 [0085.880] GetProcessHeap () returned 0xd20000 [0085.880] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4be18 [0085.880] GetProcessHeap () returned 0xd20000 [0085.880] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0085.880] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\eula.css") returned 41 [0085.880] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0085.880] GetProcessHeap () returned 0xd20000 [0085.880] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0085.880] GetProcessHeap () returned 0xd20000 [0085.881] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x38e) returned 0xd4c4b0 [0085.881] lstrlenA (lpString="rsa_encrypt") returned 11 [0085.881] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0085.883] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0085.883] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0085.883] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0085.883] GetProcessHeap () returned 0xd20000 [0085.883] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0085.883] lstrlenA (lpString="010001") returned 6 [0085.883] GetProcessHeap () returned 0xd20000 [0085.883] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd28 [0085.883] GetProcessHeap () returned 0xd20000 [0085.883] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0085.883] GetProcessHeap () returned 0xd20000 [0085.883] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b6c8 [0085.883] GetProcessHeap () returned 0xd20000 [0085.884] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0085.884] GetProcessHeap () returned 0xd20000 [0085.884] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b1b8 [0085.884] GetProcessHeap () returned 0xd20000 [0085.884] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44808 [0085.884] GetProcessHeap () returned 0xd20000 [0085.884] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc98 [0085.884] GetProcessHeap () returned 0xd20000 [0085.884] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0085.884] GetProcessHeap () returned 0xd20000 [0085.884] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.884] GetProcessHeap () returned 0xd20000 [0085.884] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0085.884] GetProcessHeap () returned 0xd20000 [0085.884] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0085.884] GetProcessHeap () returned 0xd20000 [0085.884] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44b50 [0085.884] GetProcessHeap () returned 0xd20000 [0085.885] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.885] GetProcessHeap () returned 0xd20000 [0085.885] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44678 [0085.885] GetProcessHeap () returned 0xd20000 [0085.885] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4adc8 [0085.885] GetProcessHeap () returned 0xd20000 [0085.885] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0085.885] GetProcessHeap () returned 0xd20000 [0085.885] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0085.885] GetProcessHeap () returned 0xd20000 [0085.885] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4adc8 | out: hHeap=0xd20000) returned 1 [0085.885] GetProcessHeap () returned 0xd20000 [0085.885] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.885] GetProcessHeap () returned 0xd20000 [0085.885] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44468 [0085.885] GetProcessHeap () returned 0xd20000 [0085.885] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.885] GetProcessHeap () returned 0xd20000 [0085.886] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.886] GetProcessHeap () returned 0xd20000 [0085.886] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.886] GetProcessHeap () returned 0xd20000 [0085.886] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.886] GetProcessHeap () returned 0xd20000 [0085.886] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.886] GetProcessHeap () returned 0xd20000 [0085.886] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.886] GetProcessHeap () returned 0xd20000 [0085.886] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4af78 [0085.886] GetProcessHeap () returned 0xd20000 [0085.886] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44468 | out: hHeap=0xd20000) returned 1 [0085.886] GetProcessHeap () returned 0xd20000 [0085.886] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0085.886] GetProcessHeap () returned 0xd20000 [0085.886] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4af78 | out: hHeap=0xd20000) returned 1 [0085.887] GetProcessHeap () returned 0xd20000 [0085.887] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.887] GetProcessHeap () returned 0xd20000 [0085.887] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.887] GetProcessHeap () returned 0xd20000 [0085.887] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0085.887] GetProcessHeap () returned 0xd20000 [0085.887] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0085.887] GetProcessHeap () returned 0xd20000 [0085.887] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.887] GetProcessHeap () returned 0xd20000 [0085.887] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.887] GetProcessHeap () returned 0xd20000 [0085.887] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.887] GetProcessHeap () returned 0xd20000 [0085.887] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.887] GetProcessHeap () returned 0xd20000 [0085.887] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.888] GetProcessHeap () returned 0xd20000 [0085.888] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.888] GetProcessHeap () returned 0xd20000 [0085.888] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.888] GetProcessHeap () returned 0xd20000 [0085.888] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.888] GetProcessHeap () returned 0xd20000 [0085.888] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.888] GetProcessHeap () returned 0xd20000 [0085.888] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.888] GetProcessHeap () returned 0xd20000 [0085.888] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.888] GetProcessHeap () returned 0xd20000 [0085.888] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.888] GetProcessHeap () returned 0xd20000 [0085.888] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0085.888] GetProcessHeap () returned 0xd20000 [0085.888] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.889] GetProcessHeap () returned 0xd20000 [0085.889] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.889] GetProcessHeap () returned 0xd20000 [0085.889] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.889] GetProcessHeap () returned 0xd20000 [0085.889] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.889] GetProcessHeap () returned 0xd20000 [0085.889] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.889] GetProcessHeap () returned 0xd20000 [0085.889] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.889] GetProcessHeap () returned 0xd20000 [0085.889] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.889] GetProcessHeap () returned 0xd20000 [0085.889] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.889] GetProcessHeap () returned 0xd20000 [0085.889] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.889] GetProcessHeap () returned 0xd20000 [0085.889] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0085.890] GetProcessHeap () returned 0xd20000 [0085.890] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0085.890] GetProcessHeap () returned 0xd20000 [0085.890] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.890] GetProcessHeap () returned 0xd20000 [0085.890] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.890] GetProcessHeap () returned 0xd20000 [0085.890] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.890] GetProcessHeap () returned 0xd20000 [0085.890] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.890] GetProcessHeap () returned 0xd20000 [0085.890] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.890] GetProcessHeap () returned 0xd20000 [0085.890] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.890] GetProcessHeap () returned 0xd20000 [0085.890] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.890] GetProcessHeap () returned 0xd20000 [0085.890] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.891] GetProcessHeap () returned 0xd20000 [0085.891] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.891] GetProcessHeap () returned 0xd20000 [0085.891] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.891] GetProcessHeap () returned 0xd20000 [0085.891] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.891] GetProcessHeap () returned 0xd20000 [0085.891] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.891] GetProcessHeap () returned 0xd20000 [0085.891] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.891] GetProcessHeap () returned 0xd20000 [0085.891] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.891] GetProcessHeap () returned 0xd20000 [0085.891] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.891] GetProcessHeap () returned 0xd20000 [0085.891] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.891] GetProcessHeap () returned 0xd20000 [0085.891] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.892] GetProcessHeap () returned 0xd20000 [0085.892] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.892] GetProcessHeap () returned 0xd20000 [0085.892] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.892] GetProcessHeap () returned 0xd20000 [0085.892] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.892] GetProcessHeap () returned 0xd20000 [0085.892] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.892] GetProcessHeap () returned 0xd20000 [0085.892] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.892] GetProcessHeap () returned 0xd20000 [0085.892] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.892] GetProcessHeap () returned 0xd20000 [0085.892] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.892] GetProcessHeap () returned 0xd20000 [0085.892] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.892] GetProcessHeap () returned 0xd20000 [0085.892] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.892] GetProcessHeap () returned 0xd20000 [0085.893] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.893] GetProcessHeap () returned 0xd20000 [0085.893] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.893] GetProcessHeap () returned 0xd20000 [0085.893] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0085.893] GetProcessHeap () returned 0xd20000 [0085.893] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0085.893] GetProcessHeap () returned 0xd20000 [0085.893] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.893] GetProcessHeap () returned 0xd20000 [0085.893] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.893] GetProcessHeap () returned 0xd20000 [0085.893] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.893] GetProcessHeap () returned 0xd20000 [0085.893] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.893] GetProcessHeap () returned 0xd20000 [0085.893] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.893] GetProcessHeap () returned 0xd20000 [0085.894] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.894] GetProcessHeap () returned 0xd20000 [0085.894] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.894] GetProcessHeap () returned 0xd20000 [0085.894] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.894] GetProcessHeap () returned 0xd20000 [0085.894] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.894] GetProcessHeap () returned 0xd20000 [0085.894] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.894] GetProcessHeap () returned 0xd20000 [0085.894] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.894] GetProcessHeap () returned 0xd20000 [0085.894] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.894] GetProcessHeap () returned 0xd20000 [0085.894] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.894] GetProcessHeap () returned 0xd20000 [0085.894] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.894] GetProcessHeap () returned 0xd20000 [0085.894] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.895] GetProcessHeap () returned 0xd20000 [0085.895] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.895] GetProcessHeap () returned 0xd20000 [0085.895] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.895] GetProcessHeap () returned 0xd20000 [0085.895] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.895] GetProcessHeap () returned 0xd20000 [0085.895] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.895] GetProcessHeap () returned 0xd20000 [0085.895] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.895] GetProcessHeap () returned 0xd20000 [0085.895] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.895] GetProcessHeap () returned 0xd20000 [0085.895] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.895] GetProcessHeap () returned 0xd20000 [0085.895] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.895] GetProcessHeap () returned 0xd20000 [0085.896] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.896] GetProcessHeap () returned 0xd20000 [0085.896] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.896] GetProcessHeap () returned 0xd20000 [0085.896] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.896] GetProcessHeap () returned 0xd20000 [0085.896] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.896] GetProcessHeap () returned 0xd20000 [0085.896] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.896] GetProcessHeap () returned 0xd20000 [0085.896] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.896] GetProcessHeap () returned 0xd20000 [0085.896] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.896] GetProcessHeap () returned 0xd20000 [0085.896] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.896] GetProcessHeap () returned 0xd20000 [0085.896] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.896] GetProcessHeap () returned 0xd20000 [0085.896] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.897] GetProcessHeap () returned 0xd20000 [0085.897] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.897] GetProcessHeap () returned 0xd20000 [0085.897] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0085.897] GetProcessHeap () returned 0xd20000 [0085.897] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0085.897] GetProcessHeap () returned 0xd20000 [0085.897] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.897] GetProcessHeap () returned 0xd20000 [0085.897] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.897] GetProcessHeap () returned 0xd20000 [0085.897] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.897] GetProcessHeap () returned 0xd20000 [0085.897] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.897] GetProcessHeap () returned 0xd20000 [0085.897] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.897] GetProcessHeap () returned 0xd20000 [0085.897] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.898] GetProcessHeap () returned 0xd20000 [0085.898] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.898] GetProcessHeap () returned 0xd20000 [0085.898] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.898] GetProcessHeap () returned 0xd20000 [0085.898] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0085.898] GetProcessHeap () returned 0xd20000 [0085.898] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0085.898] GetProcessHeap () returned 0xd20000 [0085.898] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.898] GetProcessHeap () returned 0xd20000 [0085.898] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.898] GetProcessHeap () returned 0xd20000 [0085.898] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.898] GetProcessHeap () returned 0xd20000 [0085.898] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.898] GetProcessHeap () returned 0xd20000 [0085.898] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.899] GetProcessHeap () returned 0xd20000 [0085.899] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.899] GetProcessHeap () returned 0xd20000 [0085.899] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.899] GetProcessHeap () returned 0xd20000 [0085.899] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.899] GetProcessHeap () returned 0xd20000 [0085.899] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0085.899] GetProcessHeap () returned 0xd20000 [0085.899] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0085.899] GetProcessHeap () returned 0xd20000 [0085.899] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.899] GetProcessHeap () returned 0xd20000 [0085.899] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.899] GetProcessHeap () returned 0xd20000 [0085.899] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.899] GetProcessHeap () returned 0xd20000 [0085.900] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.900] GetProcessHeap () returned 0xd20000 [0085.900] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.900] GetProcessHeap () returned 0xd20000 [0085.900] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.900] GetProcessHeap () returned 0xd20000 [0085.900] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0085.900] GetProcessHeap () returned 0xd20000 [0085.900] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0085.900] GetProcessHeap () returned 0xd20000 [0085.900] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.900] GetProcessHeap () returned 0xd20000 [0085.900] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.900] GetProcessHeap () returned 0xd20000 [0085.900] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0085.900] GetProcessHeap () returned 0xd20000 [0085.900] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0085.900] GetProcessHeap () returned 0xd20000 [0085.901] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.901] GetProcessHeap () returned 0xd20000 [0085.901] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.901] GetProcessHeap () returned 0xd20000 [0085.901] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.901] GetProcessHeap () returned 0xd20000 [0085.901] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.901] GetProcessHeap () returned 0xd20000 [0085.901] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.901] GetProcessHeap () returned 0xd20000 [0085.901] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.901] GetProcessHeap () returned 0xd20000 [0085.901] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.901] GetProcessHeap () returned 0xd20000 [0085.903] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.903] GetProcessHeap () returned 0xd20000 [0085.903] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.903] GetProcessHeap () returned 0xd20000 [0085.903] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.903] GetProcessHeap () returned 0xd20000 [0085.903] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.903] GetProcessHeap () returned 0xd20000 [0085.903] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.903] GetProcessHeap () returned 0xd20000 [0085.903] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0085.903] GetProcessHeap () returned 0xd20000 [0085.903] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0085.903] GetProcessHeap () returned 0xd20000 [0085.903] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.903] GetProcessHeap () returned 0xd20000 [0085.903] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.903] GetProcessHeap () returned 0xd20000 [0085.904] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.904] GetProcessHeap () returned 0xd20000 [0085.904] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.904] GetProcessHeap () returned 0xd20000 [0085.904] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0085.904] GetProcessHeap () returned 0xd20000 [0085.904] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0085.904] GetProcessHeap () returned 0xd20000 [0085.904] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.904] GetProcessHeap () returned 0xd20000 [0085.904] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.904] GetProcessHeap () returned 0xd20000 [0085.904] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.904] GetProcessHeap () returned 0xd20000 [0085.904] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.904] GetProcessHeap () returned 0xd20000 [0085.904] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.904] GetProcessHeap () returned 0xd20000 [0085.905] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.905] GetProcessHeap () returned 0xd20000 [0085.905] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0085.905] GetProcessHeap () returned 0xd20000 [0085.905] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.905] GetProcessHeap () returned 0xd20000 [0085.905] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.905] GetProcessHeap () returned 0xd20000 [0085.905] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.905] GetProcessHeap () returned 0xd20000 [0085.905] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0085.905] GetProcessHeap () returned 0xd20000 [0085.905] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0085.905] GetProcessHeap () returned 0xd20000 [0085.905] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.905] GetProcessHeap () returned 0xd20000 [0085.905] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.905] GetProcessHeap () returned 0xd20000 [0085.906] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.906] GetProcessHeap () returned 0xd20000 [0085.906] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.906] GetProcessHeap () returned 0xd20000 [0085.906] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.906] GetProcessHeap () returned 0xd20000 [0085.906] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.906] GetProcessHeap () returned 0xd20000 [0085.906] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.906] GetProcessHeap () returned 0xd20000 [0085.906] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.906] GetProcessHeap () returned 0xd20000 [0085.906] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.906] GetProcessHeap () returned 0xd20000 [0085.906] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.906] GetProcessHeap () returned 0xd20000 [0085.906] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.906] GetProcessHeap () returned 0xd20000 [0085.907] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.907] GetProcessHeap () returned 0xd20000 [0085.907] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0085.907] GetProcessHeap () returned 0xd20000 [0085.907] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0085.907] GetProcessHeap () returned 0xd20000 [0085.907] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0085.907] GetProcessHeap () returned 0xd20000 [0085.907] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0085.907] GetProcessHeap () returned 0xd20000 [0085.907] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44678 | out: hHeap=0xd20000) returned 1 [0085.907] GetProcessHeap () returned 0xd20000 [0085.907] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b1b8 | out: hHeap=0xd20000) returned 1 [0085.907] GetProcessHeap () returned 0xd20000 [0085.907] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0085.907] GetProcessHeap () returned 0xd20000 [0085.907] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b6c8 | out: hHeap=0xd20000) returned 1 [0085.908] GetProcessHeap () returned 0xd20000 [0085.908] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0085.908] GetProcessHeap () returned 0xd20000 [0085.908] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.908] GetProcessHeap () returned 0xd20000 [0085.908] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0085.908] WriteFile (in: hFile=0x230, lpBuffer=0xd4c4b0*, nNumberOfBytesToWrite=0x38e, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4c4b0*, lpNumberOfBytesWritten=0x299d864*=0x38e, lpOverlapped=0x0) returned 1 [0085.915] GetProcessHeap () returned 0xd20000 [0085.915] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4c4b0, Size=0x30) returned 0xd4c4b0 [0085.915] GetProcessHeap () returned 0xd20000 [0085.915] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0085.915] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0085.915] GetProcessHeap () returned 0xd20000 [0085.915] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x60) returned 0xd2f168 [0085.915] ReadFile (in: hFile=0x230, lpBuffer=0xd2f168, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd2f168*, lpNumberOfBytesRead=0x299d7e8*=0x60, lpOverlapped=0x0) returned 1 [0085.916] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0085.916] WriteFile (in: hFile=0x230, lpBuffer=0xd2f168*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd2f168*, lpNumberOfBytesWritten=0x299d7e4*=0x60, lpOverlapped=0x0) returned 1 [0085.917] GetProcessHeap () returned 0xd20000 [0085.917] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f168 | out: hHeap=0xd20000) returned 1 [0085.917] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0085.918] WriteFile (in: hFile=0x230, lpBuffer=0xd4c4b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4c4b0*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0085.919] CloseHandle (hObject=0x230) returned 1 [0085.925] GetProcessHeap () returned 0xd20000 [0085.925] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd426c0 | out: hHeap=0xd20000) returned 1 [0085.925] GetProcessHeap () returned 0xd20000 [0085.925] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4be18 | out: hHeap=0xd20000) returned 1 [0085.925] GetProcessHeap () returned 0xd20000 [0085.925] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0085.925] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\eula.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\eula.css") returned="C:\\Windows10Upgrade\\resources\\ux\\eula.css" [0085.925] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\eula.css", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\eula.css.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\eula.css.[ponce.lorena@aol.com]" [0085.925] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\eula.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula.css"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\eula.css.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula.css.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0085.926] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\eula.css" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0085.926] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0085.926] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" [0085.926] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_recover.html")) returned 0x20 [0085.927] GetProcessHeap () returned 0xd20000 [0085.927] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445a0 | out: hHeap=0xd20000) returned 1 [0085.927] FindNextFileW (in: hFindFile=0xd49060, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xef0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GetStarted.png", cAlternateFileName="GETSTA~1.PNG")) returned 1 [0085.927] lstrcmpiW (lpString1="GetStarted.png", lpString2=".") returned 1 [0085.927] lstrcmpiW (lpString1="GetStarted.png", lpString2="..") returned 1 [0085.927] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="GetStarted.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png") returned="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" [0085.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetStarted.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0085.927] GetProcessHeap () returned 0xd20000 [0085.927] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd44468 [0085.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetStarted.png", cchWideChar=-1, lpMultiByteStr=0xd44468, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetStarted.png", lpUsedDefaultChar=0x0) returned 15 [0085.927] lstrlenA (lpString="GetStarted.png") returned 14 [0085.927] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0085.927] lstrlenA (lpString="GetStarted.png") returned 14 [0085.927] lstrlenA (lpString=".dll") returned 4 [0085.927] lstrlenA (lpString=".dll") returned 4 [0085.927] lstrlenA (lpString="GetStarted.png") returned 14 [0085.928] lstrcmpiA (lpString1=".png", lpString2=".dll") returned 1 [0085.928] lstrlenA (lpString="GetStarted.png") returned 14 [0085.928] lstrlenA (lpString=".ini") returned 4 [0085.928] lstrlenA (lpString=".ini") returned 4 [0085.928] lstrlenA (lpString="GetStarted.png") returned 14 [0085.928] lstrcmpiA (lpString1=".png", lpString2=".ini") returned 1 [0085.928] lstrlenA (lpString="GetStarted.png") returned 14 [0085.928] lstrlenA (lpString=".inc") returned 4 [0085.928] lstrlenA (lpString=".inc") returned 4 [0085.928] lstrlenA (lpString="GetStarted.png") returned 14 [0085.928] lstrcmpiA (lpString1=".png", lpString2=".inc") returned 1 [0085.928] lstrcmpiW (lpString1="GetStarted.png", lpString2="HOW_RECOVER.html") returned -1 [0085.928] lstrcmpiW (lpString1="GetStarted.png", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0085.928] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0085.928] lstrcmpiW (lpString1="GetStarted.png", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0085.928] GetProcessHeap () returned 0xd20000 [0085.928] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd426c0 [0085.928] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0085.929] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=3824) returned 1 [0085.929] GetProcessHeap () returned 0xd20000 [0085.929] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c070 [0085.929] GetProcessHeap () returned 0xd20000 [0085.929] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0085.929] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png") returned 47 [0085.929] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0085.930] GetProcessHeap () returned 0xd20000 [0085.930] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0085.930] GetProcessHeap () returned 0xd20000 [0085.930] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4c4e8 [0085.930] lstrlenA (lpString="rsa_encrypt") returned 11 [0085.930] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0085.932] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0085.932] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0085.932] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0085.932] GetProcessHeap () returned 0xd20000 [0085.932] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0085.932] lstrlenA (lpString="010001") returned 6 [0085.932] GetProcessHeap () returned 0xd20000 [0085.932] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc48 [0085.932] GetProcessHeap () returned 0xd20000 [0085.933] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0085.933] GetProcessHeap () returned 0xd20000 [0085.933] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b3f8 [0085.933] GetProcessHeap () returned 0xd20000 [0085.934] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0085.934] GetProcessHeap () returned 0xd20000 [0085.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aaf8 [0085.934] GetProcessHeap () returned 0xd20000 [0085.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd450c8 [0085.934] GetProcessHeap () returned 0xd20000 [0085.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc98 [0085.934] GetProcessHeap () returned 0xd20000 [0085.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0085.934] GetProcessHeap () returned 0xd20000 [0085.934] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.934] GetProcessHeap () returned 0xd20000 [0085.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0085.934] GetProcessHeap () returned 0xd20000 [0085.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0085.934] GetProcessHeap () returned 0xd20000 [0085.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd45410 [0085.934] GetProcessHeap () returned 0xd20000 [0085.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.935] GetProcessHeap () returned 0xd20000 [0085.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44660 [0085.935] GetProcessHeap () returned 0xd20000 [0085.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b368 [0085.935] GetProcessHeap () returned 0xd20000 [0085.935] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0085.935] GetProcessHeap () returned 0xd20000 [0085.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0085.935] GetProcessHeap () returned 0xd20000 [0085.935] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b368 | out: hHeap=0xd20000) returned 1 [0085.935] GetProcessHeap () returned 0xd20000 [0085.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.935] GetProcessHeap () returned 0xd20000 [0085.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44438 [0085.935] GetProcessHeap () returned 0xd20000 [0085.935] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.935] GetProcessHeap () returned 0xd20000 [0085.935] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.936] GetProcessHeap () returned 0xd20000 [0085.936] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.936] GetProcessHeap () returned 0xd20000 [0085.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.936] GetProcessHeap () returned 0xd20000 [0085.936] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.936] GetProcessHeap () returned 0xd20000 [0085.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.936] GetProcessHeap () returned 0xd20000 [0085.936] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4af78 [0085.936] GetProcessHeap () returned 0xd20000 [0085.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44438 | out: hHeap=0xd20000) returned 1 [0085.936] GetProcessHeap () returned 0xd20000 [0085.936] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0085.936] GetProcessHeap () returned 0xd20000 [0085.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4af78 | out: hHeap=0xd20000) returned 1 [0085.936] GetProcessHeap () returned 0xd20000 [0085.936] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.936] GetProcessHeap () returned 0xd20000 [0085.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.937] GetProcessHeap () returned 0xd20000 [0085.937] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.937] GetProcessHeap () returned 0xd20000 [0085.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.937] GetProcessHeap () returned 0xd20000 [0085.937] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.937] GetProcessHeap () returned 0xd20000 [0085.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.937] GetProcessHeap () returned 0xd20000 [0085.937] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.937] GetProcessHeap () returned 0xd20000 [0085.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.937] GetProcessHeap () returned 0xd20000 [0085.937] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.937] GetProcessHeap () returned 0xd20000 [0085.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.937] GetProcessHeap () returned 0xd20000 [0085.937] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.938] GetProcessHeap () returned 0xd20000 [0085.938] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.938] GetProcessHeap () returned 0xd20000 [0085.938] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.938] GetProcessHeap () returned 0xd20000 [0085.938] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.938] GetProcessHeap () returned 0xd20000 [0085.938] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.938] GetProcessHeap () returned 0xd20000 [0085.938] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.938] GetProcessHeap () returned 0xd20000 [0085.938] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.938] GetProcessHeap () returned 0xd20000 [0085.938] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.938] GetProcessHeap () returned 0xd20000 [0085.938] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.938] GetProcessHeap () returned 0xd20000 [0085.938] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.938] GetProcessHeap () returned 0xd20000 [0085.939] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.939] GetProcessHeap () returned 0xd20000 [0085.939] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.939] GetProcessHeap () returned 0xd20000 [0085.939] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.939] GetProcessHeap () returned 0xd20000 [0085.939] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.939] GetProcessHeap () returned 0xd20000 [0085.939] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.939] GetProcessHeap () returned 0xd20000 [0085.939] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.939] GetProcessHeap () returned 0xd20000 [0085.939] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0085.939] GetProcessHeap () returned 0xd20000 [0085.939] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.939] GetProcessHeap () returned 0xd20000 [0085.939] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.939] GetProcessHeap () returned 0xd20000 [0085.939] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.940] GetProcessHeap () returned 0xd20000 [0085.940] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.940] GetProcessHeap () returned 0xd20000 [0085.940] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.940] GetProcessHeap () returned 0xd20000 [0085.940] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.940] GetProcessHeap () returned 0xd20000 [0085.940] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.940] GetProcessHeap () returned 0xd20000 [0085.940] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.940] GetProcessHeap () returned 0xd20000 [0085.940] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.940] GetProcessHeap () returned 0xd20000 [0085.940] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.940] GetProcessHeap () returned 0xd20000 [0085.940] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.940] GetProcessHeap () returned 0xd20000 [0085.940] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.940] GetProcessHeap () returned 0xd20000 [0085.940] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.940] GetProcessHeap () returned 0xd20000 [0085.941] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.941] GetProcessHeap () returned 0xd20000 [0085.941] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.941] GetProcessHeap () returned 0xd20000 [0085.941] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.941] GetProcessHeap () returned 0xd20000 [0085.941] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.941] GetProcessHeap () returned 0xd20000 [0085.941] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.941] GetProcessHeap () returned 0xd20000 [0085.941] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.941] GetProcessHeap () returned 0xd20000 [0085.941] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.941] GetProcessHeap () returned 0xd20000 [0085.941] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.941] GetProcessHeap () returned 0xd20000 [0085.941] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.941] GetProcessHeap () returned 0xd20000 [0085.941] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.941] GetProcessHeap () returned 0xd20000 [0085.941] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.942] GetProcessHeap () returned 0xd20000 [0085.942] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.942] GetProcessHeap () returned 0xd20000 [0085.942] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.942] GetProcessHeap () returned 0xd20000 [0085.942] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.942] GetProcessHeap () returned 0xd20000 [0085.942] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0085.942] GetProcessHeap () returned 0xd20000 [0085.942] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0085.942] GetProcessHeap () returned 0xd20000 [0085.942] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.942] GetProcessHeap () returned 0xd20000 [0085.942] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.942] GetProcessHeap () returned 0xd20000 [0085.942] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.942] GetProcessHeap () returned 0xd20000 [0085.942] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.942] GetProcessHeap () returned 0xd20000 [0085.943] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.943] GetProcessHeap () returned 0xd20000 [0085.943] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.943] GetProcessHeap () returned 0xd20000 [0085.943] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.943] GetProcessHeap () returned 0xd20000 [0085.943] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.943] GetProcessHeap () returned 0xd20000 [0085.943] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0085.943] GetProcessHeap () returned 0xd20000 [0085.943] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0085.943] GetProcessHeap () returned 0xd20000 [0085.943] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.943] GetProcessHeap () returned 0xd20000 [0085.943] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.943] GetProcessHeap () returned 0xd20000 [0085.943] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.943] GetProcessHeap () returned 0xd20000 [0085.943] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.944] GetProcessHeap () returned 0xd20000 [0085.944] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.944] GetProcessHeap () returned 0xd20000 [0085.944] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.944] GetProcessHeap () returned 0xd20000 [0085.944] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.944] GetProcessHeap () returned 0xd20000 [0085.944] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.944] GetProcessHeap () returned 0xd20000 [0085.944] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.944] GetProcessHeap () returned 0xd20000 [0085.944] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.944] GetProcessHeap () returned 0xd20000 [0085.944] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.944] GetProcessHeap () returned 0xd20000 [0085.944] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.944] GetProcessHeap () returned 0xd20000 [0085.944] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.944] GetProcessHeap () returned 0xd20000 [0085.945] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.945] GetProcessHeap () returned 0xd20000 [0085.945] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0085.945] GetProcessHeap () returned 0xd20000 [0085.945] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0085.945] GetProcessHeap () returned 0xd20000 [0085.945] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.945] GetProcessHeap () returned 0xd20000 [0085.945] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.945] GetProcessHeap () returned 0xd20000 [0085.945] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0085.945] GetProcessHeap () returned 0xd20000 [0085.945] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.945] GetProcessHeap () returned 0xd20000 [0085.945] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.945] GetProcessHeap () returned 0xd20000 [0085.945] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.945] GetProcessHeap () returned 0xd20000 [0085.945] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.946] GetProcessHeap () returned 0xd20000 [0085.946] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.946] GetProcessHeap () returned 0xd20000 [0085.946] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.946] GetProcessHeap () returned 0xd20000 [0085.946] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.946] GetProcessHeap () returned 0xd20000 [0085.946] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.946] GetProcessHeap () returned 0xd20000 [0085.946] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.946] GetProcessHeap () returned 0xd20000 [0085.946] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0085.946] GetProcessHeap () returned 0xd20000 [0085.946] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.946] GetProcessHeap () returned 0xd20000 [0085.946] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0085.946] GetProcessHeap () returned 0xd20000 [0085.946] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.946] GetProcessHeap () returned 0xd20000 [0085.947] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.947] GetProcessHeap () returned 0xd20000 [0085.947] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.947] GetProcessHeap () returned 0xd20000 [0085.947] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.947] GetProcessHeap () returned 0xd20000 [0085.947] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.947] GetProcessHeap () returned 0xd20000 [0085.947] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0085.947] GetProcessHeap () returned 0xd20000 [0085.947] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0085.947] GetProcessHeap () returned 0xd20000 [0085.947] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0085.947] GetProcessHeap () returned 0xd20000 [0085.947] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0085.947] GetProcessHeap () returned 0xd20000 [0085.947] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.948] GetProcessHeap () returned 0xd20000 [0085.948] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.948] GetProcessHeap () returned 0xd20000 [0085.948] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.948] GetProcessHeap () returned 0xd20000 [0085.948] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.948] GetProcessHeap () returned 0xd20000 [0085.948] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.948] GetProcessHeap () returned 0xd20000 [0085.948] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.948] GetProcessHeap () returned 0xd20000 [0085.948] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.948] GetProcessHeap () returned 0xd20000 [0085.948] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.948] GetProcessHeap () returned 0xd20000 [0085.948] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.948] GetProcessHeap () returned 0xd20000 [0085.949] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.949] GetProcessHeap () returned 0xd20000 [0085.949] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0085.949] GetProcessHeap () returned 0xd20000 [0085.949] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0085.949] GetProcessHeap () returned 0xd20000 [0085.949] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.949] GetProcessHeap () returned 0xd20000 [0085.949] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.949] GetProcessHeap () returned 0xd20000 [0085.949] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.949] GetProcessHeap () returned 0xd20000 [0085.949] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.949] GetProcessHeap () returned 0xd20000 [0085.949] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0085.949] GetProcessHeap () returned 0xd20000 [0085.949] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0085.949] GetProcessHeap () returned 0xd20000 [0085.949] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0085.950] GetProcessHeap () returned 0xd20000 [0085.950] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.950] GetProcessHeap () returned 0xd20000 [0085.950] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.950] GetProcessHeap () returned 0xd20000 [0085.950] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.950] GetProcessHeap () returned 0xd20000 [0085.950] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0085.950] GetProcessHeap () returned 0xd20000 [0085.950] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0085.950] GetProcessHeap () returned 0xd20000 [0085.950] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.950] GetProcessHeap () returned 0xd20000 [0085.950] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.950] GetProcessHeap () returned 0xd20000 [0085.950] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0085.950] GetProcessHeap () returned 0xd20000 [0085.950] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0085.950] GetProcessHeap () returned 0xd20000 [0085.951] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.951] GetProcessHeap () returned 0xd20000 [0085.951] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.951] GetProcessHeap () returned 0xd20000 [0085.951] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.951] GetProcessHeap () returned 0xd20000 [0085.951] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.951] GetProcessHeap () returned 0xd20000 [0085.951] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.951] GetProcessHeap () returned 0xd20000 [0085.951] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.951] GetProcessHeap () returned 0xd20000 [0085.951] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.951] GetProcessHeap () returned 0xd20000 [0085.951] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.951] GetProcessHeap () returned 0xd20000 [0085.951] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.951] GetProcessHeap () returned 0xd20000 [0085.952] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.952] GetProcessHeap () returned 0xd20000 [0085.952] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.952] GetProcessHeap () returned 0xd20000 [0085.952] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.952] GetProcessHeap () returned 0xd20000 [0085.952] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.952] GetProcessHeap () returned 0xd20000 [0085.952] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.952] GetProcessHeap () returned 0xd20000 [0085.952] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0085.952] GetProcessHeap () returned 0xd20000 [0085.952] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0085.952] GetProcessHeap () returned 0xd20000 [0085.952] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.952] GetProcessHeap () returned 0xd20000 [0085.952] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.952] GetProcessHeap () returned 0xd20000 [0085.952] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.953] GetProcessHeap () returned 0xd20000 [0085.953] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.953] GetProcessHeap () returned 0xd20000 [0085.953] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.953] GetProcessHeap () returned 0xd20000 [0085.953] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.953] GetProcessHeap () returned 0xd20000 [0085.953] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0085.953] GetProcessHeap () returned 0xd20000 [0085.953] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0085.953] GetProcessHeap () returned 0xd20000 [0085.953] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.953] GetProcessHeap () returned 0xd20000 [0085.953] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.953] GetProcessHeap () returned 0xd20000 [0085.953] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.953] GetProcessHeap () returned 0xd20000 [0085.953] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.954] GetProcessHeap () returned 0xd20000 [0085.954] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.954] GetProcessHeap () returned 0xd20000 [0085.954] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.954] GetProcessHeap () returned 0xd20000 [0085.954] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.954] GetProcessHeap () returned 0xd20000 [0085.954] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.954] GetProcessHeap () returned 0xd20000 [0085.954] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.954] GetProcessHeap () returned 0xd20000 [0085.954] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.954] GetProcessHeap () returned 0xd20000 [0085.954] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0085.954] GetProcessHeap () returned 0xd20000 [0085.954] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0085.954] GetProcessHeap () returned 0xd20000 [0085.954] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0085.955] GetProcessHeap () returned 0xd20000 [0085.955] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0085.955] GetProcessHeap () returned 0xd20000 [0085.955] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0085.955] GetProcessHeap () returned 0xd20000 [0085.955] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0085.955] GetProcessHeap () returned 0xd20000 [0085.955] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44660 | out: hHeap=0xd20000) returned 1 [0085.955] GetProcessHeap () returned 0xd20000 [0085.955] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aaf8 | out: hHeap=0xd20000) returned 1 [0085.955] GetProcessHeap () returned 0xd20000 [0085.955] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0085.955] GetProcessHeap () returned 0xd20000 [0085.955] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b3f8 | out: hHeap=0xd20000) returned 1 [0085.955] GetProcessHeap () returned 0xd20000 [0085.955] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0085.955] GetProcessHeap () returned 0xd20000 [0085.955] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.956] GetProcessHeap () returned 0xd20000 [0085.956] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0085.956] WriteFile (in: hFile=0x230, lpBuffer=0xd4c4e8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4c4e8*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0085.966] GetProcessHeap () returned 0xd20000 [0085.967] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4c4e8, Size=0x30) returned 0xd4c4e8 [0085.967] GetProcessHeap () returned 0xd20000 [0085.967] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0085.967] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0085.967] GetProcessHeap () returned 0xd20000 [0085.967] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xef0) returned 0xd4c520 [0085.967] ReadFile (in: hFile=0x230, lpBuffer=0xd4c520, nNumberOfBytesToRead=0xef0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4c520*, lpNumberOfBytesRead=0x299d7e8*=0xef0, lpOverlapped=0x0) returned 1 [0085.967] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0085.967] WriteFile (in: hFile=0x230, lpBuffer=0xd4c520*, nNumberOfBytesToWrite=0xef0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4c520*, lpNumberOfBytesWritten=0x299d7e4*=0xef0, lpOverlapped=0x0) returned 1 [0085.969] GetProcessHeap () returned 0xd20000 [0085.969] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c520 | out: hHeap=0xd20000) returned 1 [0085.969] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0085.970] WriteFile (in: hFile=0x230, lpBuffer=0xd4c4e8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4c4e8*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0085.971] CloseHandle (hObject=0x230) returned 1 [0085.977] GetProcessHeap () returned 0xd20000 [0085.977] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd426c0 | out: hHeap=0xd20000) returned 1 [0085.977] GetProcessHeap () returned 0xd20000 [0085.977] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c070 | out: hHeap=0xd20000) returned 1 [0085.977] GetProcessHeap () returned 0xd20000 [0085.977] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0085.977] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png") returned="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" [0085.977] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png.[ponce.lorena@aol.com]" [0085.977] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstarted.png.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0085.978] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\GetStarted.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0085.979] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0085.979] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" [0085.979] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_recover.html")) returned 0x20 [0085.979] GetProcessHeap () returned 0xd20000 [0085.979] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44468 | out: hHeap=0xd20000) returned 1 [0085.979] FindNextFileW (in: hFindFile=0xd49060, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea600acc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea600acc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xfe3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GetStartedHoverOver.png", cAlternateFileName="GETSTA~2.PNG")) returned 1 [0085.979] lstrcmpiW (lpString1="GetStartedHoverOver.png", lpString2=".") returned 1 [0085.979] lstrcmpiW (lpString1="GetStartedHoverOver.png", lpString2="..") returned 1 [0085.979] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="GetStartedHoverOver.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png") returned="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" [0085.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetStartedHoverOver.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0085.979] GetProcessHeap () returned 0xd20000 [0085.979] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x18) returned 0xd36748 [0085.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetStartedHoverOver.png", cchWideChar=-1, lpMultiByteStr=0xd36748, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetStartedHoverOver.png", lpUsedDefaultChar=0x0) returned 24 [0085.979] lstrlenA (lpString="GetStartedHoverOver.png") returned 23 [0085.979] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0085.980] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0085.980] lstrlenA (lpString="GetStartedHoverOver.png") returned 23 [0085.980] lstrcmpiA (lpString1="GetStartedHoverOver.png", lpString2=".[ponce.lorena@aol.com]") returned 1 [0085.980] lstrlenA (lpString="GetStartedHoverOver.png") returned 23 [0085.980] lstrlenA (lpString=".dll") returned 4 [0085.980] lstrlenA (lpString=".dll") returned 4 [0085.980] lstrlenA (lpString="GetStartedHoverOver.png") returned 23 [0085.980] lstrcmpiA (lpString1=".png", lpString2=".dll") returned 1 [0085.980] lstrlenA (lpString="GetStartedHoverOver.png") returned 23 [0085.980] lstrlenA (lpString=".ini") returned 4 [0085.980] lstrlenA (lpString=".ini") returned 4 [0085.980] lstrlenA (lpString="GetStartedHoverOver.png") returned 23 [0085.980] lstrcmpiA (lpString1=".png", lpString2=".ini") returned 1 [0085.981] lstrlenA (lpString="GetStartedHoverOver.png") returned 23 [0085.981] lstrlenA (lpString=".inc") returned 4 [0085.981] lstrlenA (lpString=".inc") returned 4 [0085.981] lstrlenA (lpString="GetStartedHoverOver.png") returned 23 [0085.981] lstrcmpiA (lpString1=".png", lpString2=".inc") returned 1 [0085.981] lstrcmpiW (lpString1="GetStartedHoverOver.png", lpString2="HOW_RECOVER.html") returned -1 [0085.981] lstrcmpiW (lpString1="GetStartedHoverOver.png", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0085.981] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0085.981] lstrcmpiW (lpString1="GetStartedHoverOver.png", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0085.981] GetProcessHeap () returned 0xd20000 [0085.981] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42418 [0085.981] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0085.982] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=4067) returned 1 [0085.982] GetProcessHeap () returned 0xd20000 [0085.982] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4be90 [0085.982] GetProcessHeap () returned 0xd20000 [0085.982] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0085.982] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png") returned 56 [0085.982] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0085.982] GetProcessHeap () returned 0xd20000 [0085.982] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0085.982] GetProcessHeap () returned 0xd20000 [0085.982] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x38d) returned 0xd4c520 [0085.983] lstrlenA (lpString="rsa_encrypt") returned 11 [0085.983] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0085.985] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0085.985] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0085.985] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0085.985] GetProcessHeap () returned 0xd20000 [0085.985] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0085.985] lstrlenA (lpString="010001") returned 6 [0085.985] GetProcessHeap () returned 0xd20000 [0085.985] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc98 [0085.985] GetProcessHeap () returned 0xd20000 [0085.985] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0085.986] GetProcessHeap () returned 0xd20000 [0085.986] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aa68 [0085.986] GetProcessHeap () returned 0xd20000 [0085.986] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0085.986] GetProcessHeap () returned 0xd20000 [0085.986] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b008 [0085.986] GetProcessHeap () returned 0xd20000 [0085.986] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd450c8 [0085.986] GetProcessHeap () returned 0xd20000 [0085.986] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0085.986] GetProcessHeap () returned 0xd20000 [0085.986] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0085.986] GetProcessHeap () returned 0xd20000 [0085.986] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.986] GetProcessHeap () returned 0xd20000 [0085.986] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0085.986] GetProcessHeap () returned 0xd20000 [0085.986] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0085.986] GetProcessHeap () returned 0xd20000 [0085.987] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44808 [0085.987] GetProcessHeap () returned 0xd20000 [0085.987] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.987] GetProcessHeap () returned 0xd20000 [0085.987] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44510 [0085.987] GetProcessHeap () returned 0xd20000 [0085.987] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b098 [0085.987] GetProcessHeap () returned 0xd20000 [0085.987] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0085.987] GetProcessHeap () returned 0xd20000 [0085.987] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0085.987] GetProcessHeap () returned 0xd20000 [0085.987] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b098 | out: hHeap=0xd20000) returned 1 [0085.987] GetProcessHeap () returned 0xd20000 [0085.987] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.987] GetProcessHeap () returned 0xd20000 [0085.987] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44660 [0085.987] GetProcessHeap () returned 0xd20000 [0085.987] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.988] GetProcessHeap () returned 0xd20000 [0085.988] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.988] GetProcessHeap () returned 0xd20000 [0085.988] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0085.988] GetProcessHeap () returned 0xd20000 [0085.988] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0085.988] GetProcessHeap () returned 0xd20000 [0085.988] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0085.988] GetProcessHeap () returned 0xd20000 [0085.988] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0085.988] GetProcessHeap () returned 0xd20000 [0085.988] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b518 [0085.988] GetProcessHeap () returned 0xd20000 [0085.988] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44660 | out: hHeap=0xd20000) returned 1 [0085.988] GetProcessHeap () returned 0xd20000 [0085.988] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0085.988] GetProcessHeap () returned 0xd20000 [0085.988] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0085.988] GetProcessHeap () returned 0xd20000 [0085.989] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.989] GetProcessHeap () returned 0xd20000 [0085.989] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.989] GetProcessHeap () returned 0xd20000 [0085.989] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0085.989] GetProcessHeap () returned 0xd20000 [0085.989] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0085.989] GetProcessHeap () returned 0xd20000 [0085.989] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.989] GetProcessHeap () returned 0xd20000 [0085.989] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.989] GetProcessHeap () returned 0xd20000 [0085.989] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.989] GetProcessHeap () returned 0xd20000 [0085.989] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.989] GetProcessHeap () returned 0xd20000 [0085.989] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.989] GetProcessHeap () returned 0xd20000 [0085.990] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.990] GetProcessHeap () returned 0xd20000 [0085.990] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0085.990] GetProcessHeap () returned 0xd20000 [0085.990] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0085.990] GetProcessHeap () returned 0xd20000 [0085.990] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.990] GetProcessHeap () returned 0xd20000 [0085.990] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.990] GetProcessHeap () returned 0xd20000 [0085.990] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.990] GetProcessHeap () returned 0xd20000 [0085.990] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.990] GetProcessHeap () returned 0xd20000 [0085.990] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.990] GetProcessHeap () returned 0xd20000 [0085.990] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.990] GetProcessHeap () returned 0xd20000 [0085.990] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.991] GetProcessHeap () returned 0xd20000 [0085.991] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.991] GetProcessHeap () returned 0xd20000 [0085.991] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.991] GetProcessHeap () returned 0xd20000 [0085.991] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.991] GetProcessHeap () returned 0xd20000 [0085.991] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0085.991] GetProcessHeap () returned 0xd20000 [0085.991] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0085.991] GetProcessHeap () returned 0xd20000 [0085.991] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.991] GetProcessHeap () returned 0xd20000 [0085.991] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.991] GetProcessHeap () returned 0xd20000 [0085.991] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.991] GetProcessHeap () returned 0xd20000 [0085.991] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.992] GetProcessHeap () returned 0xd20000 [0085.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.992] GetProcessHeap () returned 0xd20000 [0085.992] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.992] GetProcessHeap () returned 0xd20000 [0085.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.992] GetProcessHeap () returned 0xd20000 [0085.992] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.992] GetProcessHeap () returned 0xd20000 [0085.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0085.992] GetProcessHeap () returned 0xd20000 [0085.992] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0085.992] GetProcessHeap () returned 0xd20000 [0085.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.992] GetProcessHeap () returned 0xd20000 [0085.992] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.992] GetProcessHeap () returned 0xd20000 [0085.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.992] GetProcessHeap () returned 0xd20000 [0085.993] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.993] GetProcessHeap () returned 0xd20000 [0085.993] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.993] GetProcessHeap () returned 0xd20000 [0085.993] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.993] GetProcessHeap () returned 0xd20000 [0085.993] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.993] GetProcessHeap () returned 0xd20000 [0085.993] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.993] GetProcessHeap () returned 0xd20000 [0085.993] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0085.993] GetProcessHeap () returned 0xd20000 [0085.993] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0085.993] GetProcessHeap () returned 0xd20000 [0085.993] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.993] GetProcessHeap () returned 0xd20000 [0085.993] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.993] GetProcessHeap () returned 0xd20000 [0085.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.994] GetProcessHeap () returned 0xd20000 [0085.994] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.994] GetProcessHeap () returned 0xd20000 [0085.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.994] GetProcessHeap () returned 0xd20000 [0085.994] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.994] GetProcessHeap () returned 0xd20000 [0085.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.994] GetProcessHeap () returned 0xd20000 [0085.994] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.994] GetProcessHeap () returned 0xd20000 [0085.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.994] GetProcessHeap () returned 0xd20000 [0085.994] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.994] GetProcessHeap () returned 0xd20000 [0085.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.994] GetProcessHeap () returned 0xd20000 [0085.995] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.995] GetProcessHeap () returned 0xd20000 [0085.995] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.995] GetProcessHeap () returned 0xd20000 [0085.995] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.995] GetProcessHeap () returned 0xd20000 [0085.995] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0085.995] GetProcessHeap () returned 0xd20000 [0085.995] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0085.995] GetProcessHeap () returned 0xd20000 [0085.995] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.996] GetProcessHeap () returned 0xd20000 [0085.996] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.996] GetProcessHeap () returned 0xd20000 [0085.996] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.996] GetProcessHeap () returned 0xd20000 [0085.996] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.996] GetProcessHeap () returned 0xd20000 [0085.996] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0085.996] GetProcessHeap () returned 0xd20000 [0085.996] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0085.996] GetProcessHeap () returned 0xd20000 [0085.997] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.997] GetProcessHeap () returned 0xd20000 [0085.997] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.997] GetProcessHeap () returned 0xd20000 [0085.997] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0085.997] GetProcessHeap () returned 0xd20000 [0085.997] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0085.997] GetProcessHeap () returned 0xd20000 [0085.997] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.997] GetProcessHeap () returned 0xd20000 [0085.997] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.997] GetProcessHeap () returned 0xd20000 [0085.997] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.997] GetProcessHeap () returned 0xd20000 [0085.997] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.997] GetProcessHeap () returned 0xd20000 [0085.997] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.997] GetProcessHeap () returned 0xd20000 [0085.998] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.998] GetProcessHeap () returned 0xd20000 [0085.998] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.998] GetProcessHeap () returned 0xd20000 [0085.998] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.998] GetProcessHeap () returned 0xd20000 [0085.998] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0085.998] GetProcessHeap () returned 0xd20000 [0085.998] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0085.998] GetProcessHeap () returned 0xd20000 [0085.998] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.998] GetProcessHeap () returned 0xd20000 [0085.998] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.998] GetProcessHeap () returned 0xd20000 [0085.998] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.998] GetProcessHeap () returned 0xd20000 [0085.998] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.998] GetProcessHeap () returned 0xd20000 [0085.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.999] GetProcessHeap () returned 0xd20000 [0085.999] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.999] GetProcessHeap () returned 0xd20000 [0085.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.999] GetProcessHeap () returned 0xd20000 [0085.999] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0085.999] GetProcessHeap () returned 0xd20000 [0085.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0085.999] GetProcessHeap () returned 0xd20000 [0085.999] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0085.999] GetProcessHeap () returned 0xd20000 [0085.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0085.999] GetProcessHeap () returned 0xd20000 [0085.999] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0085.999] GetProcessHeap () returned 0xd20000 [0085.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0085.999] GetProcessHeap () returned 0xd20000 [0085.999] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.000] GetProcessHeap () returned 0xd20000 [0086.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0086.000] GetProcessHeap () returned 0xd20000 [0086.000] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0086.000] GetProcessHeap () returned 0xd20000 [0086.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0086.000] GetProcessHeap () returned 0xd20000 [0086.000] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0086.000] GetProcessHeap () returned 0xd20000 [0086.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.000] GetProcessHeap () returned 0xd20000 [0086.000] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.000] GetProcessHeap () returned 0xd20000 [0086.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0086.000] GetProcessHeap () returned 0xd20000 [0086.000] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0086.000] GetProcessHeap () returned 0xd20000 [0086.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.000] GetProcessHeap () returned 0xd20000 [0086.001] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.001] GetProcessHeap () returned 0xd20000 [0086.001] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.001] GetProcessHeap () returned 0xd20000 [0086.001] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.001] GetProcessHeap () returned 0xd20000 [0086.001] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.001] GetProcessHeap () returned 0xd20000 [0086.001] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.001] GetProcessHeap () returned 0xd20000 [0086.001] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.001] GetProcessHeap () returned 0xd20000 [0086.001] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.001] GetProcessHeap () returned 0xd20000 [0086.001] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.001] GetProcessHeap () returned 0xd20000 [0086.001] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.001] GetProcessHeap () returned 0xd20000 [0086.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.002] GetProcessHeap () returned 0xd20000 [0086.002] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.002] GetProcessHeap () returned 0xd20000 [0086.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0086.002] GetProcessHeap () returned 0xd20000 [0086.002] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0086.002] GetProcessHeap () returned 0xd20000 [0086.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.002] GetProcessHeap () returned 0xd20000 [0086.002] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.002] GetProcessHeap () returned 0xd20000 [0086.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.002] GetProcessHeap () returned 0xd20000 [0086.002] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.002] GetProcessHeap () returned 0xd20000 [0086.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0086.002] GetProcessHeap () returned 0xd20000 [0086.003] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0086.003] GetProcessHeap () returned 0xd20000 [0086.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0086.003] GetProcessHeap () returned 0xd20000 [0086.003] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0086.003] GetProcessHeap () returned 0xd20000 [0086.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.003] GetProcessHeap () returned 0xd20000 [0086.003] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.003] GetProcessHeap () returned 0xd20000 [0086.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.003] GetProcessHeap () returned 0xd20000 [0086.003] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.003] GetProcessHeap () returned 0xd20000 [0086.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0086.003] GetProcessHeap () returned 0xd20000 [0086.003] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0086.003] GetProcessHeap () returned 0xd20000 [0086.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.003] GetProcessHeap () returned 0xd20000 [0086.004] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.004] GetProcessHeap () returned 0xd20000 [0086.004] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0086.004] GetProcessHeap () returned 0xd20000 [0086.004] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0086.004] GetProcessHeap () returned 0xd20000 [0086.004] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.004] GetProcessHeap () returned 0xd20000 [0086.004] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.004] GetProcessHeap () returned 0xd20000 [0086.004] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.004] GetProcessHeap () returned 0xd20000 [0086.004] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.004] GetProcessHeap () returned 0xd20000 [0086.004] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.004] GetProcessHeap () returned 0xd20000 [0086.004] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.004] GetProcessHeap () returned 0xd20000 [0086.004] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.005] GetProcessHeap () returned 0xd20000 [0086.005] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.005] GetProcessHeap () returned 0xd20000 [0086.005] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.005] GetProcessHeap () returned 0xd20000 [0086.005] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.005] GetProcessHeap () returned 0xd20000 [0086.005] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.005] GetProcessHeap () returned 0xd20000 [0086.005] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.005] GetProcessHeap () returned 0xd20000 [0086.005] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.005] GetProcessHeap () returned 0xd20000 [0086.005] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.005] GetProcessHeap () returned 0xd20000 [0086.005] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.005] GetProcessHeap () returned 0xd20000 [0086.005] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.005] GetProcessHeap () returned 0xd20000 [0086.006] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0086.006] GetProcessHeap () returned 0xd20000 [0086.006] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0086.006] GetProcessHeap () returned 0xd20000 [0086.006] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.006] GetProcessHeap () returned 0xd20000 [0086.006] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.006] GetProcessHeap () returned 0xd20000 [0086.006] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0086.006] GetProcessHeap () returned 0xd20000 [0086.006] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0086.006] GetProcessHeap () returned 0xd20000 [0086.006] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.006] GetProcessHeap () returned 0xd20000 [0086.006] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.006] GetProcessHeap () returned 0xd20000 [0086.006] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.006] GetProcessHeap () returned 0xd20000 [0086.007] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.007] GetProcessHeap () returned 0xd20000 [0086.007] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.007] GetProcessHeap () returned 0xd20000 [0086.007] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.007] GetProcessHeap () returned 0xd20000 [0086.007] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0086.007] GetProcessHeap () returned 0xd20000 [0086.007] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0086.007] GetProcessHeap () returned 0xd20000 [0086.007] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0086.007] GetProcessHeap () returned 0xd20000 [0086.007] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0086.007] GetProcessHeap () returned 0xd20000 [0086.007] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.007] GetProcessHeap () returned 0xd20000 [0086.007] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.007] GetProcessHeap () returned 0xd20000 [0086.008] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.008] GetProcessHeap () returned 0xd20000 [0086.008] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.008] GetProcessHeap () returned 0xd20000 [0086.008] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0086.008] GetProcessHeap () returned 0xd20000 [0086.008] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0086.008] GetProcessHeap () returned 0xd20000 [0086.008] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0086.008] GetProcessHeap () returned 0xd20000 [0086.008] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0086.008] GetProcessHeap () returned 0xd20000 [0086.008] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44510 | out: hHeap=0xd20000) returned 1 [0086.008] GetProcessHeap () returned 0xd20000 [0086.008] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b008 | out: hHeap=0xd20000) returned 1 [0086.008] GetProcessHeap () returned 0xd20000 [0086.008] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0086.008] GetProcessHeap () returned 0xd20000 [0086.008] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aa68 | out: hHeap=0xd20000) returned 1 [0086.009] GetProcessHeap () returned 0xd20000 [0086.009] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0086.009] GetProcessHeap () returned 0xd20000 [0086.009] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0086.009] GetProcessHeap () returned 0xd20000 [0086.009] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0086.009] WriteFile (in: hFile=0x230, lpBuffer=0xd4c520*, nNumberOfBytesToWrite=0x38d, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4c520*, lpNumberOfBytesWritten=0x299d864*=0x38d, lpOverlapped=0x0) returned 1 [0086.016] GetProcessHeap () returned 0xd20000 [0086.016] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4c520, Size=0x30) returned 0xd4c520 [0086.016] GetProcessHeap () returned 0xd20000 [0086.016] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0086.016] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0086.016] GetProcessHeap () returned 0xd20000 [0086.016] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xff0) returned 0xd4c558 [0086.016] ReadFile (in: hFile=0x230, lpBuffer=0xd4c558, nNumberOfBytesToRead=0xff0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4c558*, lpNumberOfBytesRead=0x299d7e8*=0xff0, lpOverlapped=0x0) returned 1 [0086.017] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0086.017] WriteFile (in: hFile=0x230, lpBuffer=0xd4c558*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4c558*, lpNumberOfBytesWritten=0x299d7e4*=0xff0, lpOverlapped=0x0) returned 1 [0086.018] GetProcessHeap () returned 0xd20000 [0086.018] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c558 | out: hHeap=0xd20000) returned 1 [0086.019] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0086.019] WriteFile (in: hFile=0x230, lpBuffer=0xd4c520*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4c520*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0086.020] CloseHandle (hObject=0x230) returned 1 [0086.023] GetProcessHeap () returned 0xd20000 [0086.023] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42418 | out: hHeap=0xd20000) returned 1 [0086.023] GetProcessHeap () returned 0xd20000 [0086.023] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4be90 | out: hHeap=0xd20000) returned 1 [0086.023] GetProcessHeap () returned 0xd20000 [0086.023] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0086.023] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png") returned="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" [0086.023] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png.[ponce.lorena@aol.com]" [0086.023] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\getstartedhoverover.png.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0086.024] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\GetStartedHoverOver.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0086.024] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0086.024] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" [0086.024] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_recover.html")) returned 0x20 [0086.024] GetProcessHeap () returned 0xd20000 [0086.024] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36748 | out: hHeap=0xd20000) returned 1 [0086.024] FindNextFileW (in: hFindFile=0xd49060, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea600acc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea600acc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x43f3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="loading.gif", cAlternateFileName="")) returned 1 [0086.025] lstrcmpiW (lpString1="loading.gif", lpString2=".") returned 1 [0086.025] lstrcmpiW (lpString1="loading.gif", lpString2="..") returned 1 [0086.025] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="loading.gif" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\loading.gif") returned="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" [0086.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loading.gif", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0086.025] GetProcessHeap () returned 0xd20000 [0086.025] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd445a0 [0086.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="loading.gif", cchWideChar=-1, lpMultiByteStr=0xd445a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="loading.gif", lpUsedDefaultChar=0x0) returned 12 [0086.025] lstrlenA (lpString="loading.gif") returned 11 [0086.025] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0086.025] lstrlenA (lpString="loading.gif") returned 11 [0086.025] lstrlenA (lpString=".dll") returned 4 [0086.025] lstrlenA (lpString=".dll") returned 4 [0086.025] lstrlenA (lpString="loading.gif") returned 11 [0086.025] lstrcmpiA (lpString1=".gif", lpString2=".dll") returned 1 [0086.025] lstrlenA (lpString="loading.gif") returned 11 [0086.025] lstrlenA (lpString=".ini") returned 4 [0086.025] lstrlenA (lpString=".ini") returned 4 [0086.026] lstrlenA (lpString="loading.gif") returned 11 [0086.026] lstrcmpiA (lpString1=".gif", lpString2=".ini") returned -1 [0086.026] lstrlenA (lpString="loading.gif") returned 11 [0086.026] lstrlenA (lpString=".inc") returned 4 [0086.026] lstrlenA (lpString=".inc") returned 4 [0086.026] lstrlenA (lpString="loading.gif") returned 11 [0086.026] lstrcmpiA (lpString1=".gif", lpString2=".inc") returned -1 [0086.026] lstrcmpiW (lpString1="loading.gif", lpString2="HOW_RECOVER.html") returned 1 [0086.026] lstrcmpiW (lpString1="loading.gif", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0086.026] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0086.026] lstrcmpiW (lpString1="loading.gif", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0086.026] GetProcessHeap () returned 0xd20000 [0086.026] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd426c0 [0086.026] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0086.027] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=17395) returned 1 [0086.027] GetProcessHeap () returned 0xd20000 [0086.027] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bd28 [0086.027] GetProcessHeap () returned 0xd20000 [0086.027] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0086.027] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\loading.gif") returned 44 [0086.027] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0086.027] GetProcessHeap () returned 0xd20000 [0086.027] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0086.027] GetProcessHeap () returned 0xd20000 [0086.028] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x38d) returned 0xd4c558 [0086.028] lstrlenA (lpString="rsa_encrypt") returned 11 [0086.028] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0086.048] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0086.048] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0086.048] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0086.048] GetProcessHeap () returned 0xd20000 [0086.048] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0086.048] lstrlenA (lpString="010001") returned 6 [0086.048] GetProcessHeap () returned 0xd20000 [0086.048] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc98 [0086.048] GetProcessHeap () returned 0xd20000 [0086.048] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0086.048] GetProcessHeap () returned 0xd20000 [0086.048] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aa68 [0086.049] GetProcessHeap () returned 0xd20000 [0086.049] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0086.049] GetProcessHeap () returned 0xd20000 [0086.049] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0086.049] GetProcessHeap () returned 0xd20000 [0086.049] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd451e0 [0086.049] GetProcessHeap () returned 0xd20000 [0086.049] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0086.049] GetProcessHeap () returned 0xd20000 [0086.049] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0086.049] GetProcessHeap () returned 0xd20000 [0086.049] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.049] GetProcessHeap () returned 0xd20000 [0086.049] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0086.049] GetProcessHeap () returned 0xd20000 [0086.049] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0086.049] GetProcessHeap () returned 0xd20000 [0086.049] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44d80 [0086.049] GetProcessHeap () returned 0xd20000 [0086.049] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.049] GetProcessHeap () returned 0xd20000 [0086.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44558 [0086.050] GetProcessHeap () returned 0xd20000 [0086.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b2d8 [0086.050] GetProcessHeap () returned 0xd20000 [0086.050] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0086.050] GetProcessHeap () returned 0xd20000 [0086.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0086.050] GetProcessHeap () returned 0xd20000 [0086.050] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b2d8 | out: hHeap=0xd20000) returned 1 [0086.050] GetProcessHeap () returned 0xd20000 [0086.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.050] GetProcessHeap () returned 0xd20000 [0086.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446c0 [0086.050] GetProcessHeap () returned 0xd20000 [0086.050] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.050] GetProcessHeap () returned 0xd20000 [0086.050] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.050] GetProcessHeap () returned 0xd20000 [0086.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.051] GetProcessHeap () returned 0xd20000 [0086.051] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.051] GetProcessHeap () returned 0xd20000 [0086.051] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.051] GetProcessHeap () returned 0xd20000 [0086.051] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.051] GetProcessHeap () returned 0xd20000 [0086.051] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b758 [0086.051] GetProcessHeap () returned 0xd20000 [0086.051] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446c0 | out: hHeap=0xd20000) returned 1 [0086.051] GetProcessHeap () returned 0xd20000 [0086.051] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44c68 [0086.051] GetProcessHeap () returned 0xd20000 [0086.051] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b758 | out: hHeap=0xd20000) returned 1 [0086.051] GetProcessHeap () returned 0xd20000 [0086.051] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.051] GetProcessHeap () returned 0xd20000 [0086.052] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.052] GetProcessHeap () returned 0xd20000 [0086.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0086.052] GetProcessHeap () returned 0xd20000 [0086.052] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0086.052] GetProcessHeap () returned 0xd20000 [0086.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.052] GetProcessHeap () returned 0xd20000 [0086.052] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.052] GetProcessHeap () returned 0xd20000 [0086.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.052] GetProcessHeap () returned 0xd20000 [0086.052] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.052] GetProcessHeap () returned 0xd20000 [0086.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.052] GetProcessHeap () returned 0xd20000 [0086.052] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.052] GetProcessHeap () returned 0xd20000 [0086.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.053] GetProcessHeap () returned 0xd20000 [0086.053] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.053] GetProcessHeap () returned 0xd20000 [0086.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.053] GetProcessHeap () returned 0xd20000 [0086.053] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.053] GetProcessHeap () returned 0xd20000 [0086.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.053] GetProcessHeap () returned 0xd20000 [0086.053] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.053] GetProcessHeap () returned 0xd20000 [0086.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.053] GetProcessHeap () returned 0xd20000 [0086.053] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.053] GetProcessHeap () returned 0xd20000 [0086.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.053] GetProcessHeap () returned 0xd20000 [0086.053] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.054] GetProcessHeap () returned 0xd20000 [0086.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0086.054] GetProcessHeap () returned 0xd20000 [0086.054] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0086.054] GetProcessHeap () returned 0xd20000 [0086.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.054] GetProcessHeap () returned 0xd20000 [0086.054] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.054] GetProcessHeap () returned 0xd20000 [0086.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.054] GetProcessHeap () returned 0xd20000 [0086.054] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.054] GetProcessHeap () returned 0xd20000 [0086.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0086.054] GetProcessHeap () returned 0xd20000 [0086.054] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0086.054] GetProcessHeap () returned 0xd20000 [0086.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.055] GetProcessHeap () returned 0xd20000 [0086.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.055] GetProcessHeap () returned 0xd20000 [0086.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0086.055] GetProcessHeap () returned 0xd20000 [0086.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0086.055] GetProcessHeap () returned 0xd20000 [0086.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.055] GetProcessHeap () returned 0xd20000 [0086.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.055] GetProcessHeap () returned 0xd20000 [0086.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.055] GetProcessHeap () returned 0xd20000 [0086.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.055] GetProcessHeap () returned 0xd20000 [0086.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.055] GetProcessHeap () returned 0xd20000 [0086.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.055] GetProcessHeap () returned 0xd20000 [0086.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.056] GetProcessHeap () returned 0xd20000 [0086.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.056] GetProcessHeap () returned 0xd20000 [0086.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0086.056] GetProcessHeap () returned 0xd20000 [0086.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0086.056] GetProcessHeap () returned 0xd20000 [0086.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.056] GetProcessHeap () returned 0xd20000 [0086.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.056] GetProcessHeap () returned 0xd20000 [0086.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.056] GetProcessHeap () returned 0xd20000 [0086.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.056] GetProcessHeap () returned 0xd20000 [0086.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.056] GetProcessHeap () returned 0xd20000 [0086.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.057] GetProcessHeap () returned 0xd20000 [0086.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.057] GetProcessHeap () returned 0xd20000 [0086.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.057] GetProcessHeap () returned 0xd20000 [0086.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.057] GetProcessHeap () returned 0xd20000 [0086.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.057] GetProcessHeap () returned 0xd20000 [0086.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.057] GetProcessHeap () returned 0xd20000 [0086.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.057] GetProcessHeap () returned 0xd20000 [0086.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.057] GetProcessHeap () returned 0xd20000 [0086.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.057] GetProcessHeap () returned 0xd20000 [0086.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0086.057] GetProcessHeap () returned 0xd20000 [0086.058] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0086.058] GetProcessHeap () returned 0xd20000 [0086.058] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0086.058] GetProcessHeap () returned 0xd20000 [0086.058] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0086.058] GetProcessHeap () returned 0xd20000 [0086.058] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0086.058] GetProcessHeap () returned 0xd20000 [0086.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0086.059] GetProcessHeap () returned 0xd20000 [0086.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.059] GetProcessHeap () returned 0xd20000 [0086.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.059] GetProcessHeap () returned 0xd20000 [0086.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.059] GetProcessHeap () returned 0xd20000 [0086.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.059] GetProcessHeap () returned 0xd20000 [0086.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0086.059] GetProcessHeap () returned 0xd20000 [0086.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0086.059] GetProcessHeap () returned 0xd20000 [0086.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.059] GetProcessHeap () returned 0xd20000 [0086.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.059] GetProcessHeap () returned 0xd20000 [0086.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0086.060] GetProcessHeap () returned 0xd20000 [0086.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0086.060] GetProcessHeap () returned 0xd20000 [0086.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0086.060] GetProcessHeap () returned 0xd20000 [0086.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0086.060] GetProcessHeap () returned 0xd20000 [0086.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.060] GetProcessHeap () returned 0xd20000 [0086.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.060] GetProcessHeap () returned 0xd20000 [0086.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.060] GetProcessHeap () returned 0xd20000 [0086.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.060] GetProcessHeap () returned 0xd20000 [0086.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0086.060] GetProcessHeap () returned 0xd20000 [0086.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0086.060] GetProcessHeap () returned 0xd20000 [0086.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0086.061] GetProcessHeap () returned 0xd20000 [0086.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0086.061] GetProcessHeap () returned 0xd20000 [0086.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.061] GetProcessHeap () returned 0xd20000 [0086.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.061] GetProcessHeap () returned 0xd20000 [0086.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0086.061] GetProcessHeap () returned 0xd20000 [0086.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0086.061] GetProcessHeap () returned 0xd20000 [0086.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.061] GetProcessHeap () returned 0xd20000 [0086.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.061] GetProcessHeap () returned 0xd20000 [0086.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.061] GetProcessHeap () returned 0xd20000 [0086.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.062] GetProcessHeap () returned 0xd20000 [0086.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.062] GetProcessHeap () returned 0xd20000 [0086.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.062] GetProcessHeap () returned 0xd20000 [0086.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0086.062] GetProcessHeap () returned 0xd20000 [0086.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0086.062] GetProcessHeap () returned 0xd20000 [0086.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0086.062] GetProcessHeap () returned 0xd20000 [0086.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0086.062] GetProcessHeap () returned 0xd20000 [0086.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.062] GetProcessHeap () returned 0xd20000 [0086.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.062] GetProcessHeap () returned 0xd20000 [0086.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0086.063] GetProcessHeap () returned 0xd20000 [0086.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0086.063] GetProcessHeap () returned 0xd20000 [0086.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0086.063] GetProcessHeap () returned 0xd20000 [0086.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0086.063] GetProcessHeap () returned 0xd20000 [0086.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.063] GetProcessHeap () returned 0xd20000 [0086.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.063] GetProcessHeap () returned 0xd20000 [0086.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0086.063] GetProcessHeap () returned 0xd20000 [0086.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0086.063] GetProcessHeap () returned 0xd20000 [0086.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.063] GetProcessHeap () returned 0xd20000 [0086.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.064] GetProcessHeap () returned 0xd20000 [0086.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0086.064] GetProcessHeap () returned 0xd20000 [0086.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0086.064] GetProcessHeap () returned 0xd20000 [0086.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.064] GetProcessHeap () returned 0xd20000 [0086.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.064] GetProcessHeap () returned 0xd20000 [0086.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.064] GetProcessHeap () returned 0xd20000 [0086.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.064] GetProcessHeap () returned 0xd20000 [0086.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.064] GetProcessHeap () returned 0xd20000 [0086.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.064] GetProcessHeap () returned 0xd20000 [0086.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.065] GetProcessHeap () returned 0xd20000 [0086.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.065] GetProcessHeap () returned 0xd20000 [0086.065] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.065] GetProcessHeap () returned 0xd20000 [0086.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.065] GetProcessHeap () returned 0xd20000 [0086.065] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.065] GetProcessHeap () returned 0xd20000 [0086.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.065] GetProcessHeap () returned 0xd20000 [0086.065] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.065] GetProcessHeap () returned 0xd20000 [0086.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.065] GetProcessHeap () returned 0xd20000 [0086.065] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0086.065] GetProcessHeap () returned 0xd20000 [0086.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0086.065] GetProcessHeap () returned 0xd20000 [0086.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.066] GetProcessHeap () returned 0xd20000 [0086.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.066] GetProcessHeap () returned 0xd20000 [0086.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.066] GetProcessHeap () returned 0xd20000 [0086.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.066] GetProcessHeap () returned 0xd20000 [0086.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.066] GetProcessHeap () returned 0xd20000 [0086.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.066] GetProcessHeap () returned 0xd20000 [0086.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0086.066] GetProcessHeap () returned 0xd20000 [0086.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0086.066] GetProcessHeap () returned 0xd20000 [0086.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.066] GetProcessHeap () returned 0xd20000 [0086.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.067] GetProcessHeap () returned 0xd20000 [0086.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0086.067] GetProcessHeap () returned 0xd20000 [0086.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0086.067] GetProcessHeap () returned 0xd20000 [0086.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.067] GetProcessHeap () returned 0xd20000 [0086.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.067] GetProcessHeap () returned 0xd20000 [0086.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.067] GetProcessHeap () returned 0xd20000 [0086.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.067] GetProcessHeap () returned 0xd20000 [0086.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.067] GetProcessHeap () returned 0xd20000 [0086.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.067] GetProcessHeap () returned 0xd20000 [0086.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.068] GetProcessHeap () returned 0xd20000 [0086.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.068] GetProcessHeap () returned 0xd20000 [0086.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0086.068] GetProcessHeap () returned 0xd20000 [0086.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0086.068] GetProcessHeap () returned 0xd20000 [0086.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0086.068] GetProcessHeap () returned 0xd20000 [0086.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0086.068] GetProcessHeap () returned 0xd20000 [0086.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.068] GetProcessHeap () returned 0xd20000 [0086.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.068] GetProcessHeap () returned 0xd20000 [0086.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.068] GetProcessHeap () returned 0xd20000 [0086.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.069] GetProcessHeap () returned 0xd20000 [0086.069] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.069] GetProcessHeap () returned 0xd20000 [0086.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.069] GetProcessHeap () returned 0xd20000 [0086.069] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.069] GetProcessHeap () returned 0xd20000 [0086.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.069] GetProcessHeap () returned 0xd20000 [0086.069] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.069] GetProcessHeap () returned 0xd20000 [0086.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.069] GetProcessHeap () returned 0xd20000 [0086.069] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.069] GetProcessHeap () returned 0xd20000 [0086.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.069] GetProcessHeap () returned 0xd20000 [0086.069] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0086.069] GetProcessHeap () returned 0xd20000 [0086.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0086.070] GetProcessHeap () returned 0xd20000 [0086.070] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.070] GetProcessHeap () returned 0xd20000 [0086.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.070] GetProcessHeap () returned 0xd20000 [0086.070] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0086.070] GetProcessHeap () returned 0xd20000 [0086.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0086.070] GetProcessHeap () returned 0xd20000 [0086.070] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.070] GetProcessHeap () returned 0xd20000 [0086.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.070] GetProcessHeap () returned 0xd20000 [0086.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0086.070] GetProcessHeap () returned 0xd20000 [0086.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0086.070] GetProcessHeap () returned 0xd20000 [0086.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0086.071] GetProcessHeap () returned 0xd20000 [0086.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0086.071] GetProcessHeap () returned 0xd20000 [0086.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44558 | out: hHeap=0xd20000) returned 1 [0086.071] GetProcessHeap () returned 0xd20000 [0086.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0086.071] GetProcessHeap () returned 0xd20000 [0086.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0086.071] GetProcessHeap () returned 0xd20000 [0086.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aa68 | out: hHeap=0xd20000) returned 1 [0086.071] GetProcessHeap () returned 0xd20000 [0086.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0086.071] GetProcessHeap () returned 0xd20000 [0086.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0086.071] GetProcessHeap () returned 0xd20000 [0086.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0086.071] WriteFile (in: hFile=0x230, lpBuffer=0xd4c558*, nNumberOfBytesToWrite=0x38d, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4c558*, lpNumberOfBytesWritten=0x299d864*=0x38d, lpOverlapped=0x0) returned 1 [0086.086] GetProcessHeap () returned 0xd20000 [0086.086] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4c558, Size=0x30) returned 0xd4c558 [0086.086] GetProcessHeap () returned 0xd20000 [0086.087] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0086.087] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0086.087] GetProcessHeap () returned 0xd20000 [0086.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4400) returned 0xd4c590 [0086.087] ReadFile (in: hFile=0x230, lpBuffer=0xd4c590, nNumberOfBytesToRead=0x4400, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4c590*, lpNumberOfBytesRead=0x299d7e8*=0x4400, lpOverlapped=0x0) returned 1 [0086.089] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0086.089] WriteFile (in: hFile=0x230, lpBuffer=0xd4c590*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4c590*, lpNumberOfBytesWritten=0x299d7e4*=0x4400, lpOverlapped=0x0) returned 1 [0086.094] GetProcessHeap () returned 0xd20000 [0086.094] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c590 | out: hHeap=0xd20000) returned 1 [0086.094] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0086.094] WriteFile (in: hFile=0x230, lpBuffer=0xd4c558*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4c558*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0086.096] CloseHandle (hObject=0x230) returned 1 [0086.099] GetProcessHeap () returned 0xd20000 [0086.099] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd426c0 | out: hHeap=0xd20000) returned 1 [0086.099] GetProcessHeap () returned 0xd20000 [0086.099] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bd28 | out: hHeap=0xd20000) returned 1 [0086.099] GetProcessHeap () returned 0xd20000 [0086.099] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0086.099] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\loading.gif") returned="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" [0086.099] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\loading.gif", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\loading.gif.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\loading.gif.[ponce.lorena@aol.com]" [0086.099] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\loading.gif.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\loading.gif.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0086.100] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\loading.gif" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0086.100] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0086.100] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" [0086.100] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_recover.html")) returned 0x20 [0086.100] GetProcessHeap () returned 0xd20000 [0086.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445a0 | out: hHeap=0xd20000) returned 1 [0086.101] FindNextFileW (in: hFindFile=0xd49060, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea600acc, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea600acc, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x749e0600, ftLastWriteTime.dwHighDateTime=0x1d2ea8c, nFileSizeHigh=0x0, nFileSizeLow=0xe5d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lock.png", cAlternateFileName="")) returned 1 [0086.101] lstrcmpiW (lpString1="lock.png", lpString2=".") returned 1 [0086.101] lstrcmpiW (lpString1="lock.png", lpString2="..") returned 1 [0086.101] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="lock.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\lock.png") returned="C:\\Windows10Upgrade\\resources\\ux\\lock.png" [0086.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lock.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0086.101] GetProcessHeap () returned 0xd20000 [0086.101] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x9) returned 0xd44630 [0086.101] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lock.png", cchWideChar=-1, lpMultiByteStr=0xd44630, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lock.png", lpUsedDefaultChar=0x0) returned 9 [0086.101] lstrlenA (lpString="lock.png") returned 8 [0086.101] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0086.101] lstrlenA (lpString="lock.png") returned 8 [0086.101] lstrlenA (lpString=".dll") returned 4 [0086.101] lstrlenA (lpString=".dll") returned 4 [0086.101] lstrlenA (lpString="lock.png") returned 8 [0086.101] lstrcmpiA (lpString1=".png", lpString2=".dll") returned 1 [0086.101] lstrlenA (lpString="lock.png") returned 8 [0086.101] lstrlenA (lpString=".ini") returned 4 [0086.101] lstrlenA (lpString=".ini") returned 4 [0086.102] lstrlenA (lpString="lock.png") returned 8 [0086.102] lstrcmpiA (lpString1=".png", lpString2=".ini") returned 1 [0086.102] lstrlenA (lpString="lock.png") returned 8 [0086.102] lstrlenA (lpString=".inc") returned 4 [0086.102] lstrlenA (lpString=".inc") returned 4 [0086.102] lstrlenA (lpString="lock.png") returned 8 [0086.102] lstrcmpiA (lpString1=".png", lpString2=".inc") returned 1 [0086.102] lstrcmpiW (lpString1="lock.png", lpString2="HOW_RECOVER.html") returned 1 [0086.102] lstrcmpiW (lpString1="lock.png", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0086.102] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0086.102] lstrcmpiW (lpString1="lock.png", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0086.102] GetProcessHeap () returned 0xd20000 [0086.102] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42530 [0086.102] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0086.105] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=3677) returned 1 [0086.106] GetProcessHeap () returned 0xd20000 [0086.106] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bf08 [0086.106] GetProcessHeap () returned 0xd20000 [0086.106] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0086.106] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\lock.png") returned 41 [0086.106] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0086.106] GetProcessHeap () returned 0xd20000 [0086.106] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0086.106] GetProcessHeap () returned 0xd20000 [0086.106] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x383) returned 0xd4c590 [0086.106] lstrlenA (lpString="rsa_encrypt") returned 11 [0086.106] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0086.109] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0086.109] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0086.109] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0086.109] GetProcessHeap () returned 0xd20000 [0086.109] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0086.109] lstrlenA (lpString="010001") returned 6 [0086.109] GetProcessHeap () returned 0xd20000 [0086.109] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd28 [0086.109] GetProcessHeap () returned 0xd20000 [0086.109] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0086.109] GetProcessHeap () returned 0xd20000 [0086.110] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b5a8 [0086.110] GetProcessHeap () returned 0xd20000 [0086.110] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0086.110] GetProcessHeap () returned 0xd20000 [0086.110] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ad38 [0086.110] GetProcessHeap () returned 0xd20000 [0086.110] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44808 [0086.110] GetProcessHeap () returned 0xd20000 [0086.110] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd98 [0086.110] GetProcessHeap () returned 0xd20000 [0086.110] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0086.110] GetProcessHeap () returned 0xd20000 [0086.110] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.110] GetProcessHeap () returned 0xd20000 [0086.110] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0086.110] GetProcessHeap () returned 0xd20000 [0086.110] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0086.110] GetProcessHeap () returned 0xd20000 [0086.110] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44920 [0086.111] GetProcessHeap () returned 0xd20000 [0086.111] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.111] GetProcessHeap () returned 0xd20000 [0086.111] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44528 [0086.111] GetProcessHeap () returned 0xd20000 [0086.111] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b6c8 [0086.111] GetProcessHeap () returned 0xd20000 [0086.111] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0086.111] GetProcessHeap () returned 0xd20000 [0086.111] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0086.111] GetProcessHeap () returned 0xd20000 [0086.111] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b6c8 | out: hHeap=0xd20000) returned 1 [0086.111] GetProcessHeap () returned 0xd20000 [0086.111] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.111] GetProcessHeap () returned 0xd20000 [0086.111] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44588 [0086.111] GetProcessHeap () returned 0xd20000 [0086.111] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.111] GetProcessHeap () returned 0xd20000 [0086.111] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.111] GetProcessHeap () returned 0xd20000 [0086.112] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.112] GetProcessHeap () returned 0xd20000 [0086.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.112] GetProcessHeap () returned 0xd20000 [0086.112] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0086.112] GetProcessHeap () returned 0xd20000 [0086.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0086.112] GetProcessHeap () returned 0xd20000 [0086.112] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b6c8 [0086.112] GetProcessHeap () returned 0xd20000 [0086.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44588 | out: hHeap=0xd20000) returned 1 [0086.112] GetProcessHeap () returned 0xd20000 [0086.112] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0086.112] GetProcessHeap () returned 0xd20000 [0086.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b6c8 | out: hHeap=0xd20000) returned 1 [0086.112] GetProcessHeap () returned 0xd20000 [0086.112] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0086.112] GetProcessHeap () returned 0xd20000 [0086.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0086.113] GetProcessHeap () returned 0xd20000 [0086.113] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0086.113] GetProcessHeap () returned 0xd20000 [0086.113] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0086.113] GetProcessHeap () returned 0xd20000 [0086.113] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0086.113] GetProcessHeap () returned 0xd20000 [0086.113] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0086.113] GetProcessHeap () returned 0xd20000 [0086.113] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.113] GetProcessHeap () returned 0xd20000 [0086.113] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.113] GetProcessHeap () returned 0xd20000 [0086.113] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0086.113] GetProcessHeap () returned 0xd20000 [0086.113] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0086.113] GetProcessHeap () returned 0xd20000 [0086.113] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.113] GetProcessHeap () returned 0xd20000 [0086.114] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.114] GetProcessHeap () returned 0xd20000 [0086.114] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.114] GetProcessHeap () returned 0xd20000 [0086.114] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.114] GetProcessHeap () returned 0xd20000 [0086.114] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.114] GetProcessHeap () returned 0xd20000 [0086.114] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.114] GetProcessHeap () returned 0xd20000 [0086.114] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0086.114] GetProcessHeap () returned 0xd20000 [0086.114] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0086.114] GetProcessHeap () returned 0xd20000 [0086.114] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0086.114] GetProcessHeap () returned 0xd20000 [0086.114] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0086.115] GetProcessHeap () returned 0xd20000 [0086.115] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0086.115] GetProcessHeap () returned 0xd20000 [0086.115] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0086.115] GetProcessHeap () returned 0xd20000 [0086.115] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.115] GetProcessHeap () returned 0xd20000 [0086.115] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.115] GetProcessHeap () returned 0xd20000 [0086.115] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0086.115] GetProcessHeap () returned 0xd20000 [0086.115] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0086.115] GetProcessHeap () returned 0xd20000 [0086.115] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.115] GetProcessHeap () returned 0xd20000 [0086.115] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.115] GetProcessHeap () returned 0xd20000 [0086.115] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0086.115] GetProcessHeap () returned 0xd20000 [0086.115] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0086.116] GetProcessHeap () returned 0xd20000 [0086.116] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.116] GetProcessHeap () returned 0xd20000 [0086.116] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.116] GetProcessHeap () returned 0xd20000 [0086.116] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.116] GetProcessHeap () returned 0xd20000 [0086.116] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.116] GetProcessHeap () returned 0xd20000 [0086.116] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.116] GetProcessHeap () returned 0xd20000 [0086.116] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.116] GetProcessHeap () returned 0xd20000 [0086.116] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.116] GetProcessHeap () returned 0xd20000 [0086.116] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.116] GetProcessHeap () returned 0xd20000 [0086.116] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.116] GetProcessHeap () returned 0xd20000 [0086.116] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.117] GetProcessHeap () returned 0xd20000 [0086.117] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0086.117] GetProcessHeap () returned 0xd20000 [0086.117] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0086.117] GetProcessHeap () returned 0xd20000 [0086.117] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.117] GetProcessHeap () returned 0xd20000 [0086.117] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.117] GetProcessHeap () returned 0xd20000 [0086.117] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0086.117] GetProcessHeap () returned 0xd20000 [0086.117] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0086.117] GetProcessHeap () returned 0xd20000 [0086.117] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.117] GetProcessHeap () returned 0xd20000 [0086.117] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.117] GetProcessHeap () returned 0xd20000 [0086.117] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.117] GetProcessHeap () returned 0xd20000 [0086.117] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.118] GetProcessHeap () returned 0xd20000 [0086.118] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.118] GetProcessHeap () returned 0xd20000 [0086.118] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.118] GetProcessHeap () returned 0xd20000 [0086.118] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.118] GetProcessHeap () returned 0xd20000 [0086.118] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.118] GetProcessHeap () returned 0xd20000 [0086.118] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0086.118] GetProcessHeap () returned 0xd20000 [0086.118] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0086.118] GetProcessHeap () returned 0xd20000 [0086.118] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0086.118] GetProcessHeap () returned 0xd20000 [0086.118] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0086.118] GetProcessHeap () returned 0xd20000 [0086.118] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0086.118] GetProcessHeap () returned 0xd20000 [0086.118] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0086.119] GetProcessHeap () returned 0xd20000 [0086.119] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0086.119] GetProcessHeap () returned 0xd20000 [0086.119] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0086.119] GetProcessHeap () returned 0xd20000 [0086.119] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.119] GetProcessHeap () returned 0xd20000 [0086.119] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.119] GetProcessHeap () returned 0xd20000 [0086.119] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0086.119] GetProcessHeap () returned 0xd20000 [0086.119] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0086.119] GetProcessHeap () returned 0xd20000 [0086.119] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.119] GetProcessHeap () returned 0xd20000 [0086.119] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.119] GetProcessHeap () returned 0xd20000 [0086.119] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0086.119] GetProcessHeap () returned 0xd20000 [0086.119] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0086.120] GetProcessHeap () returned 0xd20000 [0086.120] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0086.120] GetProcessHeap () returned 0xd20000 [0086.120] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0086.120] GetProcessHeap () returned 0xd20000 [0086.120] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0086.120] GetProcessHeap () returned 0xd20000 [0086.120] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0086.120] GetProcessHeap () returned 0xd20000 [0086.120] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.120] GetProcessHeap () returned 0xd20000 [0086.120] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.120] GetProcessHeap () returned 0xd20000 [0086.120] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0086.120] GetProcessHeap () returned 0xd20000 [0086.120] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0086.121] GetProcessHeap () returned 0xd20000 [0086.121] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.121] GetProcessHeap () returned 0xd20000 [0086.121] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.121] GetProcessHeap () returned 0xd20000 [0086.121] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.121] GetProcessHeap () returned 0xd20000 [0086.121] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.121] GetProcessHeap () returned 0xd20000 [0086.121] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.121] GetProcessHeap () returned 0xd20000 [0086.121] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.121] GetProcessHeap () returned 0xd20000 [0086.121] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.121] GetProcessHeap () returned 0xd20000 [0086.121] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.121] GetProcessHeap () returned 0xd20000 [0086.121] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.121] GetProcessHeap () returned 0xd20000 [0086.121] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.122] GetProcessHeap () returned 0xd20000 [0086.122] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.122] GetProcessHeap () returned 0xd20000 [0086.122] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.122] GetProcessHeap () returned 0xd20000 [0086.122] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0086.122] GetProcessHeap () returned 0xd20000 [0086.122] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0086.122] GetProcessHeap () returned 0xd20000 [0086.122] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.122] GetProcessHeap () returned 0xd20000 [0086.122] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.122] GetProcessHeap () returned 0xd20000 [0086.122] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0086.122] GetProcessHeap () returned 0xd20000 [0086.122] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0086.122] GetProcessHeap () returned 0xd20000 [0086.122] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0086.122] GetProcessHeap () returned 0xd20000 [0086.122] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0086.123] GetProcessHeap () returned 0xd20000 [0086.123] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0086.123] GetProcessHeap () returned 0xd20000 [0086.123] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0086.123] GetProcessHeap () returned 0xd20000 [0086.123] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.123] GetProcessHeap () returned 0xd20000 [0086.123] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.123] GetProcessHeap () returned 0xd20000 [0086.123] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.123] GetProcessHeap () returned 0xd20000 [0086.123] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.123] GetProcessHeap () returned 0xd20000 [0086.123] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0086.123] GetProcessHeap () returned 0xd20000 [0086.123] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0086.123] GetProcessHeap () returned 0xd20000 [0086.123] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.123] GetProcessHeap () returned 0xd20000 [0086.124] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.124] GetProcessHeap () returned 0xd20000 [0086.124] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0086.124] GetProcessHeap () returned 0xd20000 [0086.124] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0086.124] GetProcessHeap () returned 0xd20000 [0086.124] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0086.124] GetProcessHeap () returned 0xd20000 [0086.124] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0086.124] GetProcessHeap () returned 0xd20000 [0086.124] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.124] GetProcessHeap () returned 0xd20000 [0086.124] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.124] GetProcessHeap () returned 0xd20000 [0086.124] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0086.124] GetProcessHeap () returned 0xd20000 [0086.124] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0086.124] GetProcessHeap () returned 0xd20000 [0086.124] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.124] GetProcessHeap () returned 0xd20000 [0086.125] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.125] GetProcessHeap () returned 0xd20000 [0086.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.125] GetProcessHeap () returned 0xd20000 [0086.125] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.125] GetProcessHeap () returned 0xd20000 [0086.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.125] GetProcessHeap () returned 0xd20000 [0086.125] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.125] GetProcessHeap () returned 0xd20000 [0086.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.125] GetProcessHeap () returned 0xd20000 [0086.125] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.125] GetProcessHeap () returned 0xd20000 [0086.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.125] GetProcessHeap () returned 0xd20000 [0086.125] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.125] GetProcessHeap () returned 0xd20000 [0086.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0086.125] GetProcessHeap () returned 0xd20000 [0086.126] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0086.126] GetProcessHeap () returned 0xd20000 [0086.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.126] GetProcessHeap () returned 0xd20000 [0086.126] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.126] GetProcessHeap () returned 0xd20000 [0086.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0086.126] GetProcessHeap () returned 0xd20000 [0086.126] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0086.126] GetProcessHeap () returned 0xd20000 [0086.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0086.126] GetProcessHeap () returned 0xd20000 [0086.126] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0086.126] GetProcessHeap () returned 0xd20000 [0086.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.126] GetProcessHeap () returned 0xd20000 [0086.126] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.126] GetProcessHeap () returned 0xd20000 [0086.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.126] GetProcessHeap () returned 0xd20000 [0086.127] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.127] GetProcessHeap () returned 0xd20000 [0086.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0086.127] GetProcessHeap () returned 0xd20000 [0086.127] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0086.127] GetProcessHeap () returned 0xd20000 [0086.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0086.127] GetProcessHeap () returned 0xd20000 [0086.127] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0086.127] GetProcessHeap () returned 0xd20000 [0086.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.127] GetProcessHeap () returned 0xd20000 [0086.127] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.127] GetProcessHeap () returned 0xd20000 [0086.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.127] GetProcessHeap () returned 0xd20000 [0086.127] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.127] GetProcessHeap () returned 0xd20000 [0086.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.128] GetProcessHeap () returned 0xd20000 [0086.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.128] GetProcessHeap () returned 0xd20000 [0086.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.128] GetProcessHeap () returned 0xd20000 [0086.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.128] GetProcessHeap () returned 0xd20000 [0086.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.128] GetProcessHeap () returned 0xd20000 [0086.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.128] GetProcessHeap () returned 0xd20000 [0086.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.128] GetProcessHeap () returned 0xd20000 [0086.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.128] GetProcessHeap () returned 0xd20000 [0086.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0086.128] GetProcessHeap () returned 0xd20000 [0086.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0086.128] GetProcessHeap () returned 0xd20000 [0086.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.129] GetProcessHeap () returned 0xd20000 [0086.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.129] GetProcessHeap () returned 0xd20000 [0086.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0086.129] GetProcessHeap () returned 0xd20000 [0086.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0086.129] GetProcessHeap () returned 0xd20000 [0086.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.129] GetProcessHeap () returned 0xd20000 [0086.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.129] GetProcessHeap () returned 0xd20000 [0086.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0086.129] GetProcessHeap () returned 0xd20000 [0086.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0086.129] GetProcessHeap () returned 0xd20000 [0086.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0086.129] GetProcessHeap () returned 0xd20000 [0086.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0086.129] GetProcessHeap () returned 0xd20000 [0086.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0086.129] GetProcessHeap () returned 0xd20000 [0086.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0086.130] GetProcessHeap () returned 0xd20000 [0086.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0086.130] GetProcessHeap () returned 0xd20000 [0086.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0086.130] GetProcessHeap () returned 0xd20000 [0086.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0086.130] GetProcessHeap () returned 0xd20000 [0086.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0086.130] GetProcessHeap () returned 0xd20000 [0086.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0086.130] GetProcessHeap () returned 0xd20000 [0086.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0086.130] GetProcessHeap () returned 0xd20000 [0086.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44528 | out: hHeap=0xd20000) returned 1 [0086.130] GetProcessHeap () returned 0xd20000 [0086.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ad38 | out: hHeap=0xd20000) returned 1 [0086.130] GetProcessHeap () returned 0xd20000 [0086.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0086.130] GetProcessHeap () returned 0xd20000 [0086.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b5a8 | out: hHeap=0xd20000) returned 1 [0086.131] GetProcessHeap () returned 0xd20000 [0086.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0086.131] GetProcessHeap () returned 0xd20000 [0086.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.131] GetProcessHeap () returned 0xd20000 [0086.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0086.131] WriteFile (in: hFile=0x230, lpBuffer=0xd4c590*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4c590*, lpNumberOfBytesWritten=0x299d864*=0x383, lpOverlapped=0x0) returned 1 [0086.141] GetProcessHeap () returned 0xd20000 [0086.141] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4c590, Size=0x30) returned 0xd4c590 [0086.141] GetProcessHeap () returned 0xd20000 [0086.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0086.142] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0086.142] GetProcessHeap () returned 0xd20000 [0086.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xe60) returned 0xd4c5c8 [0086.142] ReadFile (in: hFile=0x230, lpBuffer=0xd4c5c8, nNumberOfBytesToRead=0xe60, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4c5c8*, lpNumberOfBytesRead=0x299d7e8*=0xe60, lpOverlapped=0x0) returned 1 [0086.142] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0086.142] WriteFile (in: hFile=0x230, lpBuffer=0xd4c5c8*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4c5c8*, lpNumberOfBytesWritten=0x299d7e4*=0xe60, lpOverlapped=0x0) returned 1 [0086.144] GetProcessHeap () returned 0xd20000 [0086.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c5c8 | out: hHeap=0xd20000) returned 1 [0086.144] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0086.144] WriteFile (in: hFile=0x230, lpBuffer=0xd4c590*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4c590*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0086.145] CloseHandle (hObject=0x230) returned 1 [0086.148] GetProcessHeap () returned 0xd20000 [0086.148] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42530 | out: hHeap=0xd20000) returned 1 [0086.148] GetProcessHeap () returned 0xd20000 [0086.148] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bf08 | out: hHeap=0xd20000) returned 1 [0086.148] GetProcessHeap () returned 0xd20000 [0086.148] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0086.148] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\lock.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\lock.png") returned="C:\\Windows10Upgrade\\resources\\ux\\lock.png" [0086.148] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\lock.png", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\lock.png.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\lock.png.[ponce.lorena@aol.com]" [0086.148] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\lock.png.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\lock.png.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0086.149] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\lock.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0086.149] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0086.149] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" [0086.149] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_recover.html")) returned 0x20 [0086.149] GetProcessHeap () returned 0xd20000 [0086.149] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44630 | out: hHeap=0xd20000) returned 1 [0086.149] FindNextFileW (in: hFindFile=0xd49060, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xa33, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0086.149] lstrcmpiW (lpString1="logo.png", lpString2=".") returned 1 [0086.149] lstrcmpiW (lpString1="logo.png", lpString2="..") returned 1 [0086.149] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="logo.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\logo.png") returned="C:\\Windows10Upgrade\\resources\\ux\\logo.png" [0086.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0086.150] GetProcessHeap () returned 0xd20000 [0086.150] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x9) returned 0xd44648 [0086.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="logo.png", cchWideChar=-1, lpMultiByteStr=0xd44648, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="logo.png", lpUsedDefaultChar=0x0) returned 9 [0086.150] lstrlenA (lpString="logo.png") returned 8 [0086.150] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0086.150] lstrlenA (lpString="logo.png") returned 8 [0086.150] lstrlenA (lpString=".dll") returned 4 [0086.150] lstrlenA (lpString=".dll") returned 4 [0086.150] lstrlenA (lpString="logo.png") returned 8 [0086.150] lstrcmpiA (lpString1=".png", lpString2=".dll") returned 1 [0086.150] lstrlenA (lpString="logo.png") returned 8 [0086.150] lstrlenA (lpString=".ini") returned 4 [0086.150] lstrlenA (lpString=".ini") returned 4 [0086.150] lstrlenA (lpString="logo.png") returned 8 [0086.150] lstrcmpiA (lpString1=".png", lpString2=".ini") returned 1 [0086.150] lstrlenA (lpString="logo.png") returned 8 [0086.150] lstrlenA (lpString=".inc") returned 4 [0086.150] lstrlenA (lpString=".inc") returned 4 [0086.151] lstrlenA (lpString="logo.png") returned 8 [0086.151] lstrcmpiA (lpString1=".png", lpString2=".inc") returned 1 [0086.151] lstrcmpiW (lpString1="logo.png", lpString2="HOW_RECOVER.html") returned 1 [0086.151] lstrcmpiW (lpString1="logo.png", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0086.151] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0086.151] lstrcmpiW (lpString1="logo.png", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0086.151] GetProcessHeap () returned 0xd20000 [0086.151] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42828 [0086.151] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0086.153] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=2611) returned 1 [0086.153] GetProcessHeap () returned 0xd20000 [0086.153] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bb48 [0086.153] GetProcessHeap () returned 0xd20000 [0086.153] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0086.153] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\logo.png") returned 41 [0086.153] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0086.153] GetProcessHeap () returned 0xd20000 [0086.153] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0086.154] GetProcessHeap () returned 0xd20000 [0086.154] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x38d) returned 0xd4c5c8 [0086.154] lstrlenA (lpString="rsa_encrypt") returned 11 [0086.154] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0086.156] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0086.156] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0086.156] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0086.156] GetProcessHeap () returned 0xd20000 [0086.156] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0086.156] lstrlenA (lpString="010001") returned 6 [0086.156] GetProcessHeap () returned 0xd20000 [0086.156] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cdb8 [0086.156] GetProcessHeap () returned 0xd20000 [0086.156] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0086.157] GetProcessHeap () returned 0xd20000 [0086.157] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b758 [0086.157] GetProcessHeap () returned 0xd20000 [0086.157] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0086.157] GetProcessHeap () returned 0xd20000 [0086.157] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b878 [0086.157] GetProcessHeap () returned 0xd20000 [0086.157] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd452f8 [0086.157] GetProcessHeap () returned 0xd20000 [0086.157] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd98 [0086.157] GetProcessHeap () returned 0xd20000 [0086.157] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44c68 [0086.157] GetProcessHeap () returned 0xd20000 [0086.157] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.157] GetProcessHeap () returned 0xd20000 [0086.157] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0086.157] GetProcessHeap () returned 0xd20000 [0086.157] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0086.157] GetProcessHeap () returned 0xd20000 [0086.157] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44b50 [0086.158] GetProcessHeap () returned 0xd20000 [0086.158] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.158] GetProcessHeap () returned 0xd20000 [0086.158] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44570 [0086.158] GetProcessHeap () returned 0xd20000 [0086.158] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b7e8 [0086.158] GetProcessHeap () returned 0xd20000 [0086.158] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0086.158] GetProcessHeap () returned 0xd20000 [0086.158] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0086.158] GetProcessHeap () returned 0xd20000 [0086.158] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0086.158] GetProcessHeap () returned 0xd20000 [0086.158] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.158] GetProcessHeap () returned 0xd20000 [0086.158] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446a8 [0086.158] GetProcessHeap () returned 0xd20000 [0086.158] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.158] GetProcessHeap () returned 0xd20000 [0086.158] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.159] GetProcessHeap () returned 0xd20000 [0086.159] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0086.159] GetProcessHeap () returned 0xd20000 [0086.159] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0086.159] GetProcessHeap () returned 0xd20000 [0086.159] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.159] GetProcessHeap () returned 0xd20000 [0086.159] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.159] GetProcessHeap () returned 0xd20000 [0086.159] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4aca8 [0086.159] GetProcessHeap () returned 0xd20000 [0086.159] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446a8 | out: hHeap=0xd20000) returned 1 [0086.159] GetProcessHeap () returned 0xd20000 [0086.159] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0086.159] GetProcessHeap () returned 0xd20000 [0086.159] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aca8 | out: hHeap=0xd20000) returned 1 [0086.159] GetProcessHeap () returned 0xd20000 [0086.159] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.159] GetProcessHeap () returned 0xd20000 [0086.160] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.160] GetProcessHeap () returned 0xd20000 [0086.160] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0086.160] GetProcessHeap () returned 0xd20000 [0086.160] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0086.160] GetProcessHeap () returned 0xd20000 [0086.160] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0086.160] GetProcessHeap () returned 0xd20000 [0086.160] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0086.160] GetProcessHeap () returned 0xd20000 [0086.160] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0086.160] GetProcessHeap () returned 0xd20000 [0086.160] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0086.160] GetProcessHeap () returned 0xd20000 [0086.160] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.160] GetProcessHeap () returned 0xd20000 [0086.160] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.160] GetProcessHeap () returned 0xd20000 [0086.160] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.160] GetProcessHeap () returned 0xd20000 [0086.161] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.161] GetProcessHeap () returned 0xd20000 [0086.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.161] GetProcessHeap () returned 0xd20000 [0086.161] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.161] GetProcessHeap () returned 0xd20000 [0086.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.161] GetProcessHeap () returned 0xd20000 [0086.161] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.161] GetProcessHeap () returned 0xd20000 [0086.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0086.161] GetProcessHeap () returned 0xd20000 [0086.161] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0086.161] GetProcessHeap () returned 0xd20000 [0086.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.161] GetProcessHeap () returned 0xd20000 [0086.161] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.161] GetProcessHeap () returned 0xd20000 [0086.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.162] GetProcessHeap () returned 0xd20000 [0086.162] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.162] GetProcessHeap () returned 0xd20000 [0086.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.162] GetProcessHeap () returned 0xd20000 [0086.162] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.162] GetProcessHeap () returned 0xd20000 [0086.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.162] GetProcessHeap () returned 0xd20000 [0086.162] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.162] GetProcessHeap () returned 0xd20000 [0086.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0086.162] GetProcessHeap () returned 0xd20000 [0086.162] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0086.162] GetProcessHeap () returned 0xd20000 [0086.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.162] GetProcessHeap () returned 0xd20000 [0086.162] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.162] GetProcessHeap () returned 0xd20000 [0086.163] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.163] GetProcessHeap () returned 0xd20000 [0086.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.163] GetProcessHeap () returned 0xd20000 [0086.163] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0086.163] GetProcessHeap () returned 0xd20000 [0086.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0086.163] GetProcessHeap () returned 0xd20000 [0086.163] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0086.163] GetProcessHeap () returned 0xd20000 [0086.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0086.163] GetProcessHeap () returned 0xd20000 [0086.163] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0086.163] GetProcessHeap () returned 0xd20000 [0086.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0086.163] GetProcessHeap () returned 0xd20000 [0086.163] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.163] GetProcessHeap () returned 0xd20000 [0086.164] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.164] GetProcessHeap () returned 0xd20000 [0086.164] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.164] GetProcessHeap () returned 0xd20000 [0086.164] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.164] GetProcessHeap () returned 0xd20000 [0086.164] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0086.164] GetProcessHeap () returned 0xd20000 [0086.164] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0086.164] GetProcessHeap () returned 0xd20000 [0086.164] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.164] GetProcessHeap () returned 0xd20000 [0086.164] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.164] GetProcessHeap () returned 0xd20000 [0086.164] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0086.164] GetProcessHeap () returned 0xd20000 [0086.164] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0086.164] GetProcessHeap () returned 0xd20000 [0086.164] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0086.165] GetProcessHeap () returned 0xd20000 [0086.165] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0086.165] GetProcessHeap () returned 0xd20000 [0086.165] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.165] GetProcessHeap () returned 0xd20000 [0086.165] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.165] GetProcessHeap () returned 0xd20000 [0086.165] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.165] GetProcessHeap () returned 0xd20000 [0086.165] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.165] GetProcessHeap () returned 0xd20000 [0086.165] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0086.165] GetProcessHeap () returned 0xd20000 [0086.165] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0086.165] GetProcessHeap () returned 0xd20000 [0086.165] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0086.165] GetProcessHeap () returned 0xd20000 [0086.165] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0086.165] GetProcessHeap () returned 0xd20000 [0086.165] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.165] GetProcessHeap () returned 0xd20000 [0086.166] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.166] GetProcessHeap () returned 0xd20000 [0086.166] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0086.166] GetProcessHeap () returned 0xd20000 [0086.166] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0086.166] GetProcessHeap () returned 0xd20000 [0086.166] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.166] GetProcessHeap () returned 0xd20000 [0086.166] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.166] GetProcessHeap () returned 0xd20000 [0086.166] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.166] GetProcessHeap () returned 0xd20000 [0086.166] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.166] GetProcessHeap () returned 0xd20000 [0086.166] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.166] GetProcessHeap () returned 0xd20000 [0086.166] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.166] GetProcessHeap () returned 0xd20000 [0086.166] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0086.166] GetProcessHeap () returned 0xd20000 [0086.167] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0086.167] GetProcessHeap () returned 0xd20000 [0086.167] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0086.167] GetProcessHeap () returned 0xd20000 [0086.167] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0086.167] GetProcessHeap () returned 0xd20000 [0086.167] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.167] GetProcessHeap () returned 0xd20000 [0086.167] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.181] GetProcessHeap () returned 0xd20000 [0086.181] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0086.181] GetProcessHeap () returned 0xd20000 [0086.181] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0086.181] GetProcessHeap () returned 0xd20000 [0086.181] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0086.181] GetProcessHeap () returned 0xd20000 [0086.182] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0086.182] GetProcessHeap () returned 0xd20000 [0086.182] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.182] GetProcessHeap () returned 0xd20000 [0086.182] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.182] GetProcessHeap () returned 0xd20000 [0086.182] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0086.182] GetProcessHeap () returned 0xd20000 [0086.182] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0086.182] GetProcessHeap () returned 0xd20000 [0086.182] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.182] GetProcessHeap () returned 0xd20000 [0086.182] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.182] GetProcessHeap () returned 0xd20000 [0086.182] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0086.182] GetProcessHeap () returned 0xd20000 [0086.182] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0086.182] GetProcessHeap () returned 0xd20000 [0086.182] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.182] GetProcessHeap () returned 0xd20000 [0086.183] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.183] GetProcessHeap () returned 0xd20000 [0086.183] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.183] GetProcessHeap () returned 0xd20000 [0086.183] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.183] GetProcessHeap () returned 0xd20000 [0086.183] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.183] GetProcessHeap () returned 0xd20000 [0086.183] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.183] GetProcessHeap () returned 0xd20000 [0086.183] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.184] GetProcessHeap () returned 0xd20000 [0086.184] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.184] GetProcessHeap () returned 0xd20000 [0086.184] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.184] GetProcessHeap () returned 0xd20000 [0086.184] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.184] GetProcessHeap () returned 0xd20000 [0086.184] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.184] GetProcessHeap () returned 0xd20000 [0086.184] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.184] GetProcessHeap () returned 0xd20000 [0086.184] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.184] GetProcessHeap () returned 0xd20000 [0086.184] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.184] GetProcessHeap () returned 0xd20000 [0086.184] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0086.184] GetProcessHeap () returned 0xd20000 [0086.184] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0086.184] GetProcessHeap () returned 0xd20000 [0086.184] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.185] GetProcessHeap () returned 0xd20000 [0086.185] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.185] GetProcessHeap () returned 0xd20000 [0086.185] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.185] GetProcessHeap () returned 0xd20000 [0086.185] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.185] GetProcessHeap () returned 0xd20000 [0086.185] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0086.185] GetProcessHeap () returned 0xd20000 [0086.185] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0086.185] GetProcessHeap () returned 0xd20000 [0086.185] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0086.185] GetProcessHeap () returned 0xd20000 [0086.185] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0086.185] GetProcessHeap () returned 0xd20000 [0086.185] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.185] GetProcessHeap () returned 0xd20000 [0086.185] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.185] GetProcessHeap () returned 0xd20000 [0086.185] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0086.186] GetProcessHeap () returned 0xd20000 [0086.186] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0086.186] GetProcessHeap () returned 0xd20000 [0086.186] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.186] GetProcessHeap () returned 0xd20000 [0086.186] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.186] GetProcessHeap () returned 0xd20000 [0086.186] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.186] GetProcessHeap () returned 0xd20000 [0086.186] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.186] GetProcessHeap () returned 0xd20000 [0086.186] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.186] GetProcessHeap () returned 0xd20000 [0086.186] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.186] GetProcessHeap () returned 0xd20000 [0086.186] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0086.186] GetProcessHeap () returned 0xd20000 [0086.186] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0086.186] GetProcessHeap () returned 0xd20000 [0086.186] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0086.186] GetProcessHeap () returned 0xd20000 [0086.187] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0086.187] GetProcessHeap () returned 0xd20000 [0086.187] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0086.187] GetProcessHeap () returned 0xd20000 [0086.187] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0086.187] GetProcessHeap () returned 0xd20000 [0086.187] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.187] GetProcessHeap () returned 0xd20000 [0086.187] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.187] GetProcessHeap () returned 0xd20000 [0086.187] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.187] GetProcessHeap () returned 0xd20000 [0086.187] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.187] GetProcessHeap () returned 0xd20000 [0086.187] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.187] GetProcessHeap () returned 0xd20000 [0086.187] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.187] GetProcessHeap () returned 0xd20000 [0086.187] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.187] GetProcessHeap () returned 0xd20000 [0086.187] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.188] GetProcessHeap () returned 0xd20000 [0086.188] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.188] GetProcessHeap () returned 0xd20000 [0086.188] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.188] GetProcessHeap () returned 0xd20000 [0086.188] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.188] GetProcessHeap () returned 0xd20000 [0086.188] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.188] GetProcessHeap () returned 0xd20000 [0086.188] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0086.188] GetProcessHeap () returned 0xd20000 [0086.188] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0086.188] GetProcessHeap () returned 0xd20000 [0086.188] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.188] GetProcessHeap () returned 0xd20000 [0086.188] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.188] GetProcessHeap () returned 0xd20000 [0086.188] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0086.188] GetProcessHeap () returned 0xd20000 [0086.188] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0086.188] GetProcessHeap () returned 0xd20000 [0086.189] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.189] GetProcessHeap () returned 0xd20000 [0086.189] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.189] GetProcessHeap () returned 0xd20000 [0086.189] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0086.189] GetProcessHeap () returned 0xd20000 [0086.189] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0086.189] GetProcessHeap () returned 0xd20000 [0086.189] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.189] GetProcessHeap () returned 0xd20000 [0086.189] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.189] GetProcessHeap () returned 0xd20000 [0086.189] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0086.189] GetProcessHeap () returned 0xd20000 [0086.189] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0086.189] GetProcessHeap () returned 0xd20000 [0086.189] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0086.189] GetProcessHeap () returned 0xd20000 [0086.189] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0086.189] GetProcessHeap () returned 0xd20000 [0086.190] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.190] GetProcessHeap () returned 0xd20000 [0086.190] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.190] GetProcessHeap () returned 0xd20000 [0086.190] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0086.190] GetProcessHeap () returned 0xd20000 [0086.190] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0086.190] GetProcessHeap () returned 0xd20000 [0086.190] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0086.190] GetProcessHeap () returned 0xd20000 [0086.190] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0086.190] GetProcessHeap () returned 0xd20000 [0086.190] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.190] GetProcessHeap () returned 0xd20000 [0086.190] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.190] GetProcessHeap () returned 0xd20000 [0086.190] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.190] GetProcessHeap () returned 0xd20000 [0086.190] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.190] GetProcessHeap () returned 0xd20000 [0086.190] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.191] GetProcessHeap () returned 0xd20000 [0086.191] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.191] GetProcessHeap () returned 0xd20000 [0086.191] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.191] GetProcessHeap () returned 0xd20000 [0086.191] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.191] GetProcessHeap () returned 0xd20000 [0086.191] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0086.191] GetProcessHeap () returned 0xd20000 [0086.191] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0086.191] GetProcessHeap () returned 0xd20000 [0086.191] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0086.191] GetProcessHeap () returned 0xd20000 [0086.191] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0086.191] GetProcessHeap () returned 0xd20000 [0086.191] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0086.191] GetProcessHeap () returned 0xd20000 [0086.191] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0086.191] GetProcessHeap () returned 0xd20000 [0086.191] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44570 | out: hHeap=0xd20000) returned 1 [0086.192] GetProcessHeap () returned 0xd20000 [0086.192] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b878 | out: hHeap=0xd20000) returned 1 [0086.192] GetProcessHeap () returned 0xd20000 [0086.192] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0086.192] GetProcessHeap () returned 0xd20000 [0086.192] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b758 | out: hHeap=0xd20000) returned 1 [0086.192] GetProcessHeap () returned 0xd20000 [0086.192] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0086.192] GetProcessHeap () returned 0xd20000 [0086.192] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.192] GetProcessHeap () returned 0xd20000 [0086.192] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0086.192] WriteFile (in: hFile=0x230, lpBuffer=0xd4c5c8*, nNumberOfBytesToWrite=0x38d, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4c5c8*, lpNumberOfBytesWritten=0x299d864*=0x38d, lpOverlapped=0x0) returned 1 [0086.199] GetProcessHeap () returned 0xd20000 [0086.199] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4c5c8, Size=0x30) returned 0xd4c5c8 [0086.199] GetProcessHeap () returned 0xd20000 [0086.199] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0086.199] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0086.199] GetProcessHeap () returned 0xd20000 [0086.200] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xa40) returned 0xd4c600 [0086.200] ReadFile (in: hFile=0x230, lpBuffer=0xd4c600, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4c600*, lpNumberOfBytesRead=0x299d7e8*=0xa40, lpOverlapped=0x0) returned 1 [0086.200] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0086.200] WriteFile (in: hFile=0x230, lpBuffer=0xd4c600*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4c600*, lpNumberOfBytesWritten=0x299d7e4*=0xa40, lpOverlapped=0x0) returned 1 [0086.201] GetProcessHeap () returned 0xd20000 [0086.201] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c600 | out: hHeap=0xd20000) returned 1 [0086.201] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0086.202] WriteFile (in: hFile=0x230, lpBuffer=0xd4c5c8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4c5c8*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0086.203] CloseHandle (hObject=0x230) returned 1 [0086.206] GetProcessHeap () returned 0xd20000 [0086.206] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42828 | out: hHeap=0xd20000) returned 1 [0086.206] GetProcessHeap () returned 0xd20000 [0086.206] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bb48 | out: hHeap=0xd20000) returned 1 [0086.206] GetProcessHeap () returned 0xd20000 [0086.206] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0086.206] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\logo.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\logo.png") returned="C:\\Windows10Upgrade\\resources\\ux\\logo.png" [0086.206] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\logo.png", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\logo.png.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\logo.png.[ponce.lorena@aol.com]" [0086.206] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\logo.png.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\logo.png.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0086.207] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\logo.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0086.207] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0086.207] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" [0086.207] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_recover.html")) returned 0x20 [0086.208] GetProcessHeap () returned 0xd20000 [0086.208] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44648 | out: hHeap=0xd20000) returned 1 [0086.208] FindNextFileW (in: hFindFile=0xd49060, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1ed, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="marketing.png", cAlternateFileName="MARKET~1.PNG")) returned 1 [0086.208] lstrcmpiW (lpString1="marketing.png", lpString2=".") returned 1 [0086.208] lstrcmpiW (lpString1="marketing.png", lpString2="..") returned 1 [0086.208] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="marketing.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\marketing.png") returned="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" [0086.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="marketing.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0086.208] GetProcessHeap () returned 0xd20000 [0086.208] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xe) returned 0xd44468 [0086.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="marketing.png", cchWideChar=-1, lpMultiByteStr=0xd44468, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="marketing.png", lpUsedDefaultChar=0x0) returned 14 [0086.208] lstrlenA (lpString="marketing.png") returned 13 [0086.208] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0086.208] lstrlenA (lpString="marketing.png") returned 13 [0086.208] lstrlenA (lpString=".dll") returned 4 [0086.208] lstrlenA (lpString=".dll") returned 4 [0086.208] lstrlenA (lpString="marketing.png") returned 13 [0086.208] lstrcmpiA (lpString1=".png", lpString2=".dll") returned 1 [0086.209] lstrlenA (lpString="marketing.png") returned 13 [0086.209] lstrlenA (lpString=".ini") returned 4 [0086.209] lstrlenA (lpString=".ini") returned 4 [0086.209] lstrlenA (lpString="marketing.png") returned 13 [0086.209] lstrcmpiA (lpString1=".png", lpString2=".ini") returned 1 [0086.209] lstrlenA (lpString="marketing.png") returned 13 [0086.209] lstrlenA (lpString=".inc") returned 4 [0086.209] lstrlenA (lpString=".inc") returned 4 [0086.209] lstrlenA (lpString="marketing.png") returned 13 [0086.209] lstrcmpiA (lpString1=".png", lpString2=".inc") returned 1 [0086.209] lstrcmpiW (lpString1="marketing.png", lpString2="HOW_RECOVER.html") returned 1 [0086.209] lstrcmpiW (lpString1="marketing.png", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0086.209] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0086.209] lstrcmpiW (lpString1="marketing.png", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0086.209] GetProcessHeap () returned 0xd20000 [0086.209] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd428a0 [0086.209] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0086.214] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=493) returned 1 [0086.214] GetProcessHeap () returned 0xd20000 [0086.214] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c160 [0086.215] GetProcessHeap () returned 0xd20000 [0086.215] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0086.215] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\marketing.png") returned 46 [0086.215] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0086.215] GetProcessHeap () returned 0xd20000 [0086.215] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0086.215] GetProcessHeap () returned 0xd20000 [0086.215] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x383) returned 0xd4c600 [0086.215] lstrlenA (lpString="rsa_encrypt") returned 11 [0086.215] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0086.217] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0086.217] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0086.217] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0086.217] GetProcessHeap () returned 0xd20000 [0086.217] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0086.217] lstrlenA (lpString="010001") returned 6 [0086.217] GetProcessHeap () returned 0xd20000 [0086.217] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cdb8 [0086.218] GetProcessHeap () returned 0xd20000 [0086.218] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0086.218] GetProcessHeap () returned 0xd20000 [0086.218] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b128 [0086.218] GetProcessHeap () returned 0xd20000 [0086.218] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0086.218] GetProcessHeap () returned 0xd20000 [0086.218] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0086.218] GetProcessHeap () returned 0xd20000 [0086.218] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44b50 [0086.218] GetProcessHeap () returned 0xd20000 [0086.218] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd98 [0086.218] GetProcessHeap () returned 0xd20000 [0086.218] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44c68 [0086.218] GetProcessHeap () returned 0xd20000 [0086.218] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.218] GetProcessHeap () returned 0xd20000 [0086.218] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0086.218] GetProcessHeap () returned 0xd20000 [0086.218] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0086.218] GetProcessHeap () returned 0xd20000 [0086.218] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44d80 [0086.219] GetProcessHeap () returned 0xd20000 [0086.219] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.219] GetProcessHeap () returned 0xd20000 [0086.219] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44678 [0086.219] GetProcessHeap () returned 0xd20000 [0086.219] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aaf8 [0086.219] GetProcessHeap () returned 0xd20000 [0086.219] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0086.219] GetProcessHeap () returned 0xd20000 [0086.219] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0086.219] GetProcessHeap () returned 0xd20000 [0086.219] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aaf8 | out: hHeap=0xd20000) returned 1 [0086.219] GetProcessHeap () returned 0xd20000 [0086.219] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.219] GetProcessHeap () returned 0xd20000 [0086.219] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44570 [0086.219] GetProcessHeap () returned 0xd20000 [0086.219] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.219] GetProcessHeap () returned 0xd20000 [0086.219] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.220] GetProcessHeap () returned 0xd20000 [0086.220] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.220] GetProcessHeap () returned 0xd20000 [0086.220] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.220] GetProcessHeap () returned 0xd20000 [0086.220] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0086.220] GetProcessHeap () returned 0xd20000 [0086.220] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0086.220] GetProcessHeap () returned 0xd20000 [0086.220] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4af78 [0086.220] GetProcessHeap () returned 0xd20000 [0086.220] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44570 | out: hHeap=0xd20000) returned 1 [0086.220] GetProcessHeap () returned 0xd20000 [0086.220] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0086.220] GetProcessHeap () returned 0xd20000 [0086.220] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4af78 | out: hHeap=0xd20000) returned 1 [0086.220] GetProcessHeap () returned 0xd20000 [0086.220] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.220] GetProcessHeap () returned 0xd20000 [0086.220] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.220] GetProcessHeap () returned 0xd20000 [0086.221] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.221] GetProcessHeap () returned 0xd20000 [0086.221] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.221] GetProcessHeap () returned 0xd20000 [0086.221] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.221] GetProcessHeap () returned 0xd20000 [0086.221] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.221] GetProcessHeap () returned 0xd20000 [0086.221] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.221] GetProcessHeap () returned 0xd20000 [0086.221] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.221] GetProcessHeap () returned 0xd20000 [0086.221] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.221] GetProcessHeap () returned 0xd20000 [0086.221] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.221] GetProcessHeap () returned 0xd20000 [0086.221] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.221] GetProcessHeap () returned 0xd20000 [0086.221] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.221] GetProcessHeap () returned 0xd20000 [0086.221] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.221] GetProcessHeap () returned 0xd20000 [0086.222] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.222] GetProcessHeap () returned 0xd20000 [0086.222] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.222] GetProcessHeap () returned 0xd20000 [0086.222] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.222] GetProcessHeap () returned 0xd20000 [0086.222] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.222] GetProcessHeap () returned 0xd20000 [0086.222] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.222] GetProcessHeap () returned 0xd20000 [0086.222] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.222] GetProcessHeap () returned 0xd20000 [0086.222] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.222] GetProcessHeap () returned 0xd20000 [0086.222] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0086.222] GetProcessHeap () returned 0xd20000 [0086.222] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0086.222] GetProcessHeap () returned 0xd20000 [0086.222] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.222] GetProcessHeap () returned 0xd20000 [0086.222] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.223] GetProcessHeap () returned 0xd20000 [0086.223] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.223] GetProcessHeap () returned 0xd20000 [0086.223] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.223] GetProcessHeap () returned 0xd20000 [0086.223] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.223] GetProcessHeap () returned 0xd20000 [0086.223] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.223] GetProcessHeap () returned 0xd20000 [0086.223] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.223] GetProcessHeap () returned 0xd20000 [0086.223] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.223] GetProcessHeap () returned 0xd20000 [0086.223] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0086.223] GetProcessHeap () returned 0xd20000 [0086.223] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0086.223] GetProcessHeap () returned 0xd20000 [0086.223] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0086.223] GetProcessHeap () returned 0xd20000 [0086.223] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0086.223] GetProcessHeap () returned 0xd20000 [0086.224] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0086.224] GetProcessHeap () returned 0xd20000 [0086.224] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0086.224] GetProcessHeap () returned 0xd20000 [0086.224] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0086.224] GetProcessHeap () returned 0xd20000 [0086.224] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0086.224] GetProcessHeap () returned 0xd20000 [0086.224] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.224] GetProcessHeap () returned 0xd20000 [0086.224] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.224] GetProcessHeap () returned 0xd20000 [0086.224] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0086.224] GetProcessHeap () returned 0xd20000 [0086.224] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0086.224] GetProcessHeap () returned 0xd20000 [0086.224] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.224] GetProcessHeap () returned 0xd20000 [0086.224] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.224] GetProcessHeap () returned 0xd20000 [0086.224] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0086.224] GetProcessHeap () returned 0xd20000 [0086.224] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0086.225] GetProcessHeap () returned 0xd20000 [0086.225] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0086.225] GetProcessHeap () returned 0xd20000 [0086.225] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0086.225] GetProcessHeap () returned 0xd20000 [0086.225] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0086.225] GetProcessHeap () returned 0xd20000 [0086.225] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0086.225] GetProcessHeap () returned 0xd20000 [0086.225] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.225] GetProcessHeap () returned 0xd20000 [0086.225] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.225] GetProcessHeap () returned 0xd20000 [0086.225] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0086.225] GetProcessHeap () returned 0xd20000 [0086.225] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0086.225] GetProcessHeap () returned 0xd20000 [0086.225] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.225] GetProcessHeap () returned 0xd20000 [0086.226] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.226] GetProcessHeap () returned 0xd20000 [0086.226] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.226] GetProcessHeap () returned 0xd20000 [0086.226] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.226] GetProcessHeap () returned 0xd20000 [0086.226] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.226] GetProcessHeap () returned 0xd20000 [0086.226] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.226] GetProcessHeap () returned 0xd20000 [0086.226] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.226] GetProcessHeap () returned 0xd20000 [0086.226] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.226] GetProcessHeap () returned 0xd20000 [0086.226] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.226] GetProcessHeap () returned 0xd20000 [0086.226] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.226] GetProcessHeap () returned 0xd20000 [0086.226] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.227] GetProcessHeap () returned 0xd20000 [0086.227] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.227] GetProcessHeap () returned 0xd20000 [0086.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0086.227] GetProcessHeap () returned 0xd20000 [0086.227] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0086.227] GetProcessHeap () returned 0xd20000 [0086.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.227] GetProcessHeap () returned 0xd20000 [0086.227] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.227] GetProcessHeap () returned 0xd20000 [0086.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0086.227] GetProcessHeap () returned 0xd20000 [0086.227] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0086.227] GetProcessHeap () returned 0xd20000 [0086.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0086.227] GetProcessHeap () returned 0xd20000 [0086.227] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0086.227] GetProcessHeap () returned 0xd20000 [0086.228] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0086.228] GetProcessHeap () returned 0xd20000 [0086.228] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0086.228] GetProcessHeap () returned 0xd20000 [0086.228] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.228] GetProcessHeap () returned 0xd20000 [0086.228] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.228] GetProcessHeap () returned 0xd20000 [0086.228] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.228] GetProcessHeap () returned 0xd20000 [0086.228] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.228] GetProcessHeap () returned 0xd20000 [0086.228] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0086.228] GetProcessHeap () returned 0xd20000 [0086.228] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0086.228] GetProcessHeap () returned 0xd20000 [0086.228] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.228] GetProcessHeap () returned 0xd20000 [0086.229] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.229] GetProcessHeap () returned 0xd20000 [0086.229] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0086.229] GetProcessHeap () returned 0xd20000 [0086.229] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0086.229] GetProcessHeap () returned 0xd20000 [0086.229] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0086.229] GetProcessHeap () returned 0xd20000 [0086.229] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0086.229] GetProcessHeap () returned 0xd20000 [0086.229] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.229] GetProcessHeap () returned 0xd20000 [0086.229] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.229] GetProcessHeap () returned 0xd20000 [0086.229] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0086.229] GetProcessHeap () returned 0xd20000 [0086.229] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0086.229] GetProcessHeap () returned 0xd20000 [0086.229] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.229] GetProcessHeap () returned 0xd20000 [0086.230] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.230] GetProcessHeap () returned 0xd20000 [0086.230] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.230] GetProcessHeap () returned 0xd20000 [0086.230] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.230] GetProcessHeap () returned 0xd20000 [0086.230] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.230] GetProcessHeap () returned 0xd20000 [0086.231] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.231] GetProcessHeap () returned 0xd20000 [0086.231] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.231] GetProcessHeap () returned 0xd20000 [0086.231] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.231] GetProcessHeap () returned 0xd20000 [0086.231] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.231] GetProcessHeap () returned 0xd20000 [0086.231] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.231] GetProcessHeap () returned 0xd20000 [0086.231] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0086.231] GetProcessHeap () returned 0xd20000 [0086.231] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0086.231] GetProcessHeap () returned 0xd20000 [0086.231] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.231] GetProcessHeap () returned 0xd20000 [0086.231] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.231] GetProcessHeap () returned 0xd20000 [0086.231] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0086.231] GetProcessHeap () returned 0xd20000 [0086.232] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0086.232] GetProcessHeap () returned 0xd20000 [0086.232] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0086.232] GetProcessHeap () returned 0xd20000 [0086.232] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0086.232] GetProcessHeap () returned 0xd20000 [0086.232] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.232] GetProcessHeap () returned 0xd20000 [0086.232] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.232] GetProcessHeap () returned 0xd20000 [0086.232] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.232] GetProcessHeap () returned 0xd20000 [0086.232] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.232] GetProcessHeap () returned 0xd20000 [0086.232] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0086.232] GetProcessHeap () returned 0xd20000 [0086.232] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0086.232] GetProcessHeap () returned 0xd20000 [0086.232] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0086.232] GetProcessHeap () returned 0xd20000 [0086.232] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0086.232] GetProcessHeap () returned 0xd20000 [0086.233] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.233] GetProcessHeap () returned 0xd20000 [0086.233] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.233] GetProcessHeap () returned 0xd20000 [0086.233] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.233] GetProcessHeap () returned 0xd20000 [0086.233] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.233] GetProcessHeap () returned 0xd20000 [0086.233] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.233] GetProcessHeap () returned 0xd20000 [0086.233] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.233] GetProcessHeap () returned 0xd20000 [0086.233] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.233] GetProcessHeap () returned 0xd20000 [0086.233] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.233] GetProcessHeap () returned 0xd20000 [0086.233] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.233] GetProcessHeap () returned 0xd20000 [0086.233] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.233] GetProcessHeap () returned 0xd20000 [0086.233] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.234] GetProcessHeap () returned 0xd20000 [0086.234] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.234] GetProcessHeap () returned 0xd20000 [0086.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0086.234] GetProcessHeap () returned 0xd20000 [0086.234] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0086.234] GetProcessHeap () returned 0xd20000 [0086.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.234] GetProcessHeap () returned 0xd20000 [0086.234] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.234] GetProcessHeap () returned 0xd20000 [0086.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0086.234] GetProcessHeap () returned 0xd20000 [0086.234] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0086.234] GetProcessHeap () returned 0xd20000 [0086.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.234] GetProcessHeap () returned 0xd20000 [0086.234] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.234] GetProcessHeap () returned 0xd20000 [0086.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.234] GetProcessHeap () returned 0xd20000 [0086.234] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.235] GetProcessHeap () returned 0xd20000 [0086.235] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0086.235] GetProcessHeap () returned 0xd20000 [0086.235] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0086.235] GetProcessHeap () returned 0xd20000 [0086.235] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.235] GetProcessHeap () returned 0xd20000 [0086.235] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.235] GetProcessHeap () returned 0xd20000 [0086.235] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0086.235] GetProcessHeap () returned 0xd20000 [0086.235] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0086.235] GetProcessHeap () returned 0xd20000 [0086.235] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0086.235] GetProcessHeap () returned 0xd20000 [0086.235] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0086.235] GetProcessHeap () returned 0xd20000 [0086.235] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0086.235] GetProcessHeap () returned 0xd20000 [0086.235] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0086.236] GetProcessHeap () returned 0xd20000 [0086.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.236] GetProcessHeap () returned 0xd20000 [0086.236] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.236] GetProcessHeap () returned 0xd20000 [0086.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.236] GetProcessHeap () returned 0xd20000 [0086.236] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.236] GetProcessHeap () returned 0xd20000 [0086.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0086.236] GetProcessHeap () returned 0xd20000 [0086.236] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0086.236] GetProcessHeap () returned 0xd20000 [0086.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.236] GetProcessHeap () returned 0xd20000 [0086.236] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.236] GetProcessHeap () returned 0xd20000 [0086.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.236] GetProcessHeap () returned 0xd20000 [0086.236] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.236] GetProcessHeap () returned 0xd20000 [0086.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0086.237] GetProcessHeap () returned 0xd20000 [0086.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0086.237] GetProcessHeap () returned 0xd20000 [0086.237] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.237] GetProcessHeap () returned 0xd20000 [0086.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.237] GetProcessHeap () returned 0xd20000 [0086.237] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0086.237] GetProcessHeap () returned 0xd20000 [0086.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0086.237] GetProcessHeap () returned 0xd20000 [0086.237] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0086.237] GetProcessHeap () returned 0xd20000 [0086.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0086.237] GetProcessHeap () returned 0xd20000 [0086.237] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0086.237] GetProcessHeap () returned 0xd20000 [0086.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0086.237] GetProcessHeap () returned 0xd20000 [0086.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0086.237] GetProcessHeap () returned 0xd20000 [0086.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0086.238] GetProcessHeap () returned 0xd20000 [0086.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0086.238] GetProcessHeap () returned 0xd20000 [0086.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0086.238] GetProcessHeap () returned 0xd20000 [0086.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44678 | out: hHeap=0xd20000) returned 1 [0086.238] GetProcessHeap () returned 0xd20000 [0086.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0086.238] GetProcessHeap () returned 0xd20000 [0086.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0086.238] GetProcessHeap () returned 0xd20000 [0086.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b128 | out: hHeap=0xd20000) returned 1 [0086.238] GetProcessHeap () returned 0xd20000 [0086.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0086.238] GetProcessHeap () returned 0xd20000 [0086.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.238] GetProcessHeap () returned 0xd20000 [0086.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0086.238] WriteFile (in: hFile=0x230, lpBuffer=0xd4c600*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4c600*, lpNumberOfBytesWritten=0x299d864*=0x383, lpOverlapped=0x0) returned 1 [0086.246] GetProcessHeap () returned 0xd20000 [0086.246] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4c600, Size=0x30) returned 0xd4c600 [0086.246] GetProcessHeap () returned 0xd20000 [0086.246] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0086.246] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0086.246] GetProcessHeap () returned 0xd20000 [0086.246] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1f0) returned 0xd479b8 [0086.246] ReadFile (in: hFile=0x230, lpBuffer=0xd479b8, nNumberOfBytesToRead=0x1f0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd479b8*, lpNumberOfBytesRead=0x299d7e8*=0x1f0, lpOverlapped=0x0) returned 1 [0086.246] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0086.246] WriteFile (in: hFile=0x230, lpBuffer=0xd479b8*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd479b8*, lpNumberOfBytesWritten=0x299d7e4*=0x1f0, lpOverlapped=0x0) returned 1 [0086.248] GetProcessHeap () returned 0xd20000 [0086.248] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0086.248] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0086.248] WriteFile (in: hFile=0x230, lpBuffer=0xd4c600*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4c600*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0086.250] CloseHandle (hObject=0x230) returned 1 [0086.253] GetProcessHeap () returned 0xd20000 [0086.253] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd428a0 | out: hHeap=0xd20000) returned 1 [0086.253] GetProcessHeap () returned 0xd20000 [0086.253] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c160 | out: hHeap=0xd20000) returned 1 [0086.253] GetProcessHeap () returned 0xd20000 [0086.253] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0086.253] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\marketing.png") returned="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" [0086.253] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\marketing.png", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\marketing.png.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\marketing.png.[ponce.lorena@aol.com]" [0086.253] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\marketing.png.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\marketing.png.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0086.254] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\marketing.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0086.254] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0086.254] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" [0086.254] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_recover.html")) returned 0x20 [0086.254] GetProcessHeap () returned 0xd20000 [0086.254] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44468 | out: hHeap=0xd20000) returned 1 [0086.254] FindNextFileW (in: hFindFile=0xd49060, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea60a72c, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft.WinJS", cAlternateFileName="MICROS~1.WIN")) returned 1 [0086.254] lstrcmpiW (lpString1="Microsoft.WinJS", lpString2=".") returned 1 [0086.254] lstrcmpiW (lpString1="Microsoft.WinJS", lpString2="..") returned 1 [0086.254] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="Microsoft.WinJS" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS" [0086.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Microsoft.WinJS", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0086.254] GetProcessHeap () returned 0xd20000 [0086.255] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd44648 [0086.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Microsoft.WinJS", cchWideChar=-1, lpMultiByteStr=0xd44648, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft.WinJS", lpUsedDefaultChar=0x0) returned 16 [0086.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0086.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0086.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0086.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0086.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0086.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0086.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0086.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0086.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0086.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0086.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0086.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0086.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0086.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0086.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0086.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0086.255] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0086.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0086.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0086.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0086.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0086.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0086.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0086.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0086.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0086.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0086.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0086.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0086.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0086.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0086.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0086.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0086.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0086.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0086.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0086.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0086.256] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0086.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0086.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0086.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0086.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0086.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0086.257] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Microsoft.WinJS", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0086.257] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\" [0086.257] GetProcessHeap () returned 0xd20000 [0086.257] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3ccf8 [0086.257] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\") returned 49 [0086.257] GetProcessHeap () returned 0xd20000 [0086.257] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x64) returned 0xd2f168 [0086.257] lstrcpyW (in: lpString1=0xd2f168, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\" [0086.257] GetProcessHeap () returned 0xd20000 [0086.257] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44648 | out: hHeap=0xd20000) returned 1 [0086.257] FindNextFileW (in: hFindFile=0xd49060, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea627c0d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea627c0d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x97e0d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetworkIssueFAQ.mht", cAlternateFileName="NETWOR~1.MHT")) returned 1 [0086.257] lstrcmpiW (lpString1="NetworkIssueFAQ.mht", lpString2=".") returned 1 [0086.257] lstrcmpiW (lpString1="NetworkIssueFAQ.mht", lpString2="..") returned 1 [0086.257] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="NetworkIssueFAQ.mht" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht") returned="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht" [0086.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetworkIssueFAQ.mht", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0086.258] GetProcessHeap () returned 0xd20000 [0086.258] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x14) returned 0xd366c8 [0086.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetworkIssueFAQ.mht", cchWideChar=-1, lpMultiByteStr=0xd366c8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetworkIssueFAQ.mht", lpUsedDefaultChar=0x0) returned 20 [0086.258] lstrlenA (lpString="NetworkIssueFAQ.mht") returned 19 [0086.258] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0086.258] lstrlenA (lpString="NetworkIssueFAQ.mht") returned 19 [0086.258] lstrlenA (lpString=".dll") returned 4 [0086.258] lstrlenA (lpString=".dll") returned 4 [0086.258] lstrlenA (lpString="NetworkIssueFAQ.mht") returned 19 [0086.258] lstrcmpiA (lpString1=".mht", lpString2=".dll") returned 1 [0086.258] lstrlenA (lpString="NetworkIssueFAQ.mht") returned 19 [0086.258] lstrlenA (lpString=".ini") returned 4 [0086.258] lstrlenA (lpString=".ini") returned 4 [0086.258] lstrlenA (lpString="NetworkIssueFAQ.mht") returned 19 [0086.258] lstrcmpiA (lpString1=".mht", lpString2=".ini") returned 1 [0086.258] lstrlenA (lpString="NetworkIssueFAQ.mht") returned 19 [0086.258] lstrlenA (lpString=".inc") returned 4 [0086.258] lstrlenA (lpString=".inc") returned 4 [0086.258] lstrlenA (lpString="NetworkIssueFAQ.mht") returned 19 [0086.259] lstrcmpiA (lpString1=".mht", lpString2=".inc") returned 1 [0086.259] lstrcmpiW (lpString1="NetworkIssueFAQ.mht", lpString2="HOW_RECOVER.html") returned 1 [0086.259] lstrcmpiW (lpString1="NetworkIssueFAQ.mht", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0086.259] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0086.259] lstrcmpiW (lpString1="NetworkIssueFAQ.mht", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0086.259] GetProcessHeap () returned 0xd20000 [0086.259] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42738 [0086.259] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht" (normalized: "c:\\windows10upgrade\\resources\\ux\\networkissuefaq.mht"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0086.260] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=622093) returned 1 [0086.260] GetProcessHeap () returned 0xd20000 [0086.260] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bb48 [0086.260] GetProcessHeap () returned 0xd20000 [0086.261] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0086.261] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht") returned 52 [0086.261] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0086.353] GetProcessHeap () returned 0xd20000 [0086.353] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0086.353] GetProcessHeap () returned 0xd20000 [0086.353] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4c638 [0086.353] lstrlenA (lpString="rsa_encrypt") returned 11 [0086.354] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0086.356] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0086.356] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0086.356] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0086.356] GetProcessHeap () returned 0xd20000 [0086.356] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0086.356] lstrlenA (lpString="010001") returned 6 [0086.357] GetProcessHeap () returned 0xd20000 [0086.357] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc98 [0086.357] GetProcessHeap () returned 0xd20000 [0086.357] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0086.357] GetProcessHeap () returned 0xd20000 [0086.357] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4a948 [0086.357] GetProcessHeap () returned 0xd20000 [0086.357] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0086.357] GetProcessHeap () returned 0xd20000 [0086.357] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ad38 [0086.357] GetProcessHeap () returned 0xd20000 [0086.357] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45640 [0086.357] GetProcessHeap () returned 0xd20000 [0086.357] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd28 [0086.357] GetProcessHeap () returned 0xd20000 [0086.357] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0086.357] GetProcessHeap () returned 0xd20000 [0086.357] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.357] GetProcessHeap () returned 0xd20000 [0086.357] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44c68 [0086.358] GetProcessHeap () returned 0xd20000 [0086.358] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0086.358] GetProcessHeap () returned 0xd20000 [0086.358] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44a38 [0086.358] GetProcessHeap () returned 0xd20000 [0086.358] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.358] GetProcessHeap () returned 0xd20000 [0086.358] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44408 [0086.358] GetProcessHeap () returned 0xd20000 [0086.358] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b6c8 [0086.358] GetProcessHeap () returned 0xd20000 [0086.358] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0086.358] GetProcessHeap () returned 0xd20000 [0086.358] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0086.358] GetProcessHeap () returned 0xd20000 [0086.358] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b6c8 | out: hHeap=0xd20000) returned 1 [0086.358] GetProcessHeap () returned 0xd20000 [0086.358] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0086.358] GetProcessHeap () returned 0xd20000 [0086.358] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445a0 [0086.358] GetProcessHeap () returned 0xd20000 [0086.358] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.358] GetProcessHeap () returned 0xd20000 [0086.358] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0086.359] GetProcessHeap () returned 0xd20000 [0086.359] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.359] GetProcessHeap () returned 0xd20000 [0086.359] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.359] GetProcessHeap () returned 0xd20000 [0086.359] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.359] GetProcessHeap () returned 0xd20000 [0086.359] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.359] GetProcessHeap () returned 0xd20000 [0086.359] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b878 [0086.359] GetProcessHeap () returned 0xd20000 [0086.359] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445a0 | out: hHeap=0xd20000) returned 1 [0086.359] GetProcessHeap () returned 0xd20000 [0086.359] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0086.359] GetProcessHeap () returned 0xd20000 [0086.359] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b878 | out: hHeap=0xd20000) returned 1 [0086.359] GetProcessHeap () returned 0xd20000 [0086.359] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.359] GetProcessHeap () returned 0xd20000 [0086.359] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.359] GetProcessHeap () returned 0xd20000 [0086.359] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.359] GetProcessHeap () returned 0xd20000 [0086.360] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.360] GetProcessHeap () returned 0xd20000 [0086.360] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0086.360] GetProcessHeap () returned 0xd20000 [0086.360] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0086.360] GetProcessHeap () returned 0xd20000 [0086.360] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0086.360] GetProcessHeap () returned 0xd20000 [0086.360] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0086.360] GetProcessHeap () returned 0xd20000 [0086.360] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0086.360] GetProcessHeap () returned 0xd20000 [0086.360] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0086.360] GetProcessHeap () returned 0xd20000 [0086.360] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.360] GetProcessHeap () returned 0xd20000 [0086.360] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.360] GetProcessHeap () returned 0xd20000 [0086.360] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.360] GetProcessHeap () returned 0xd20000 [0086.360] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.360] GetProcessHeap () returned 0xd20000 [0086.360] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0086.361] GetProcessHeap () returned 0xd20000 [0086.361] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0086.361] GetProcessHeap () returned 0xd20000 [0086.361] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.361] GetProcessHeap () returned 0xd20000 [0086.361] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.361] GetProcessHeap () returned 0xd20000 [0086.361] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0086.361] GetProcessHeap () returned 0xd20000 [0086.361] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0086.361] GetProcessHeap () returned 0xd20000 [0086.361] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0086.361] GetProcessHeap () returned 0xd20000 [0086.361] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0086.361] GetProcessHeap () returned 0xd20000 [0086.361] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.361] GetProcessHeap () returned 0xd20000 [0086.361] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.361] GetProcessHeap () returned 0xd20000 [0086.361] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.361] GetProcessHeap () returned 0xd20000 [0086.361] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.362] GetProcessHeap () returned 0xd20000 [0086.362] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0086.362] GetProcessHeap () returned 0xd20000 [0086.362] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0086.362] GetProcessHeap () returned 0xd20000 [0086.362] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0086.362] GetProcessHeap () returned 0xd20000 [0086.362] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0086.362] GetProcessHeap () returned 0xd20000 [0086.362] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.362] GetProcessHeap () returned 0xd20000 [0086.362] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.362] GetProcessHeap () returned 0xd20000 [0086.362] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0086.362] GetProcessHeap () returned 0xd20000 [0086.362] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0086.362] GetProcessHeap () returned 0xd20000 [0086.362] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.362] GetProcessHeap () returned 0xd20000 [0086.362] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.362] GetProcessHeap () returned 0xd20000 [0086.363] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.363] GetProcessHeap () returned 0xd20000 [0086.363] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.363] GetProcessHeap () returned 0xd20000 [0086.363] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.363] GetProcessHeap () returned 0xd20000 [0086.363] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.363] GetProcessHeap () returned 0xd20000 [0086.363] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0086.363] GetProcessHeap () returned 0xd20000 [0086.363] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0086.363] GetProcessHeap () returned 0xd20000 [0086.363] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0086.363] GetProcessHeap () returned 0xd20000 [0086.363] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0086.363] GetProcessHeap () returned 0xd20000 [0086.363] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.363] GetProcessHeap () returned 0xd20000 [0086.363] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.363] GetProcessHeap () returned 0xd20000 [0086.363] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0086.363] GetProcessHeap () returned 0xd20000 [0086.364] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0086.364] GetProcessHeap () returned 0xd20000 [0086.364] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0086.364] GetProcessHeap () returned 0xd20000 [0086.364] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0086.364] GetProcessHeap () returned 0xd20000 [0086.364] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.364] GetProcessHeap () returned 0xd20000 [0086.364] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.364] GetProcessHeap () returned 0xd20000 [0086.364] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0086.364] GetProcessHeap () returned 0xd20000 [0086.364] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0086.364] GetProcessHeap () returned 0xd20000 [0086.364] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.364] GetProcessHeap () returned 0xd20000 [0086.364] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.364] GetProcessHeap () returned 0xd20000 [0086.364] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0086.364] GetProcessHeap () returned 0xd20000 [0086.364] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0086.365] GetProcessHeap () returned 0xd20000 [0086.365] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.365] GetProcessHeap () returned 0xd20000 [0086.365] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.365] GetProcessHeap () returned 0xd20000 [0086.365] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.365] GetProcessHeap () returned 0xd20000 [0086.365] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.365] GetProcessHeap () returned 0xd20000 [0086.365] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.365] GetProcessHeap () returned 0xd20000 [0086.365] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.365] GetProcessHeap () returned 0xd20000 [0086.365] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.365] GetProcessHeap () returned 0xd20000 [0086.365] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.365] GetProcessHeap () returned 0xd20000 [0086.365] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.365] GetProcessHeap () returned 0xd20000 [0086.365] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.365] GetProcessHeap () returned 0xd20000 [0086.365] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.366] GetProcessHeap () returned 0xd20000 [0086.366] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.366] GetProcessHeap () returned 0xd20000 [0086.366] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.366] GetProcessHeap () returned 0xd20000 [0086.366] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.366] GetProcessHeap () returned 0xd20000 [0086.366] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0086.366] GetProcessHeap () returned 0xd20000 [0086.366] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0086.366] GetProcessHeap () returned 0xd20000 [0086.366] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.366] GetProcessHeap () returned 0xd20000 [0086.366] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.366] GetProcessHeap () returned 0xd20000 [0086.366] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.366] GetProcessHeap () returned 0xd20000 [0086.366] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.366] GetProcessHeap () returned 0xd20000 [0086.366] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.367] GetProcessHeap () returned 0xd20000 [0086.367] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.367] GetProcessHeap () returned 0xd20000 [0086.367] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0086.367] GetProcessHeap () returned 0xd20000 [0086.367] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0086.367] GetProcessHeap () returned 0xd20000 [0086.367] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.367] GetProcessHeap () returned 0xd20000 [0086.367] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.367] GetProcessHeap () returned 0xd20000 [0086.367] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0086.367] GetProcessHeap () returned 0xd20000 [0086.367] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0086.367] GetProcessHeap () returned 0xd20000 [0086.367] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.367] GetProcessHeap () returned 0xd20000 [0086.367] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.367] GetProcessHeap () returned 0xd20000 [0086.367] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.368] GetProcessHeap () returned 0xd20000 [0086.368] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.368] GetProcessHeap () returned 0xd20000 [0086.368] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.368] GetProcessHeap () returned 0xd20000 [0086.368] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.368] GetProcessHeap () returned 0xd20000 [0086.368] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.368] GetProcessHeap () returned 0xd20000 [0086.368] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.368] GetProcessHeap () returned 0xd20000 [0086.368] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0086.368] GetProcessHeap () returned 0xd20000 [0086.368] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0086.368] GetProcessHeap () returned 0xd20000 [0086.368] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0086.368] GetProcessHeap () returned 0xd20000 [0086.368] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0086.368] GetProcessHeap () returned 0xd20000 [0086.368] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.368] GetProcessHeap () returned 0xd20000 [0086.369] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.369] GetProcessHeap () returned 0xd20000 [0086.369] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.369] GetProcessHeap () returned 0xd20000 [0086.369] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.369] GetProcessHeap () returned 0xd20000 [0086.369] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.369] GetProcessHeap () returned 0xd20000 [0086.369] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.369] GetProcessHeap () returned 0xd20000 [0086.369] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.369] GetProcessHeap () returned 0xd20000 [0086.369] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.369] GetProcessHeap () returned 0xd20000 [0086.369] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.369] GetProcessHeap () returned 0xd20000 [0086.369] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.369] GetProcessHeap () returned 0xd20000 [0086.369] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.369] GetProcessHeap () returned 0xd20000 [0086.369] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.370] GetProcessHeap () returned 0xd20000 [0086.370] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0086.370] GetProcessHeap () returned 0xd20000 [0086.370] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0086.370] GetProcessHeap () returned 0xd20000 [0086.370] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.370] GetProcessHeap () returned 0xd20000 [0086.370] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.370] GetProcessHeap () returned 0xd20000 [0086.370] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0086.370] GetProcessHeap () returned 0xd20000 [0086.370] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0086.370] GetProcessHeap () returned 0xd20000 [0086.371] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.371] GetProcessHeap () returned 0xd20000 [0086.371] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.371] GetProcessHeap () returned 0xd20000 [0086.371] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0086.371] GetProcessHeap () returned 0xd20000 [0086.371] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0086.371] GetProcessHeap () returned 0xd20000 [0086.371] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0086.371] GetProcessHeap () returned 0xd20000 [0086.371] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0086.371] GetProcessHeap () returned 0xd20000 [0086.371] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0086.371] GetProcessHeap () returned 0xd20000 [0086.371] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0086.371] GetProcessHeap () returned 0xd20000 [0086.371] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0086.371] GetProcessHeap () returned 0xd20000 [0086.371] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0086.371] GetProcessHeap () returned 0xd20000 [0086.372] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.372] GetProcessHeap () returned 0xd20000 [0086.372] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.372] GetProcessHeap () returned 0xd20000 [0086.372] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0086.372] GetProcessHeap () returned 0xd20000 [0086.372] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0086.372] GetProcessHeap () returned 0xd20000 [0086.372] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0086.372] GetProcessHeap () returned 0xd20000 [0086.372] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0086.372] GetProcessHeap () returned 0xd20000 [0086.372] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.372] GetProcessHeap () returned 0xd20000 [0086.372] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.372] GetProcessHeap () returned 0xd20000 [0086.372] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.372] GetProcessHeap () returned 0xd20000 [0086.372] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.372] GetProcessHeap () returned 0xd20000 [0086.372] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.373] GetProcessHeap () returned 0xd20000 [0086.373] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.373] GetProcessHeap () returned 0xd20000 [0086.373] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0086.373] GetProcessHeap () returned 0xd20000 [0086.373] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0086.373] GetProcessHeap () returned 0xd20000 [0086.373] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.373] GetProcessHeap () returned 0xd20000 [0086.373] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.373] GetProcessHeap () returned 0xd20000 [0086.373] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.373] GetProcessHeap () returned 0xd20000 [0086.373] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.373] GetProcessHeap () returned 0xd20000 [0086.373] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.373] GetProcessHeap () returned 0xd20000 [0086.373] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.373] GetProcessHeap () returned 0xd20000 [0086.373] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0086.374] GetProcessHeap () returned 0xd20000 [0086.374] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0086.374] GetProcessHeap () returned 0xd20000 [0086.374] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.374] GetProcessHeap () returned 0xd20000 [0086.374] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.374] GetProcessHeap () returned 0xd20000 [0086.374] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.374] GetProcessHeap () returned 0xd20000 [0086.374] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.374] GetProcessHeap () returned 0xd20000 [0086.374] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0086.374] GetProcessHeap () returned 0xd20000 [0086.374] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0086.374] GetProcessHeap () returned 0xd20000 [0086.374] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.374] GetProcessHeap () returned 0xd20000 [0086.374] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.374] GetProcessHeap () returned 0xd20000 [0086.375] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.375] GetProcessHeap () returned 0xd20000 [0086.375] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.375] GetProcessHeap () returned 0xd20000 [0086.375] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0086.375] GetProcessHeap () returned 0xd20000 [0086.375] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0086.375] GetProcessHeap () returned 0xd20000 [0086.375] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.375] GetProcessHeap () returned 0xd20000 [0086.375] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.375] GetProcessHeap () returned 0xd20000 [0086.375] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.375] GetProcessHeap () returned 0xd20000 [0086.375] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.375] GetProcessHeap () returned 0xd20000 [0086.376] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.376] GetProcessHeap () returned 0xd20000 [0086.376] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.376] GetProcessHeap () returned 0xd20000 [0086.376] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0086.376] GetProcessHeap () returned 0xd20000 [0086.376] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0086.376] GetProcessHeap () returned 0xd20000 [0086.376] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0086.376] GetProcessHeap () returned 0xd20000 [0086.376] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0086.376] GetProcessHeap () returned 0xd20000 [0086.376] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0086.376] GetProcessHeap () returned 0xd20000 [0086.376] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0086.376] GetProcessHeap () returned 0xd20000 [0086.376] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0086.377] GetProcessHeap () returned 0xd20000 [0086.377] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0086.377] GetProcessHeap () returned 0xd20000 [0086.377] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44408 | out: hHeap=0xd20000) returned 1 [0086.377] GetProcessHeap () returned 0xd20000 [0086.377] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ad38 | out: hHeap=0xd20000) returned 1 [0086.377] GetProcessHeap () returned 0xd20000 [0086.377] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0086.377] GetProcessHeap () returned 0xd20000 [0086.377] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a948 | out: hHeap=0xd20000) returned 1 [0086.377] GetProcessHeap () returned 0xd20000 [0086.377] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0086.377] GetProcessHeap () returned 0xd20000 [0086.377] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0086.377] GetProcessHeap () returned 0xd20000 [0086.377] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0086.377] WriteFile (in: hFile=0x230, lpBuffer=0xd4c638*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4c638*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0086.750] GetProcessHeap () returned 0xd20000 [0086.750] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4c638, Size=0x30) returned 0xd4c638 [0086.750] GetProcessHeap () returned 0xd20000 [0086.750] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0086.750] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0086.750] GetProcessHeap () returned 0xd20000 [0086.750] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x97e0d) returned 0x2d53020 [0086.760] ReadFile (in: hFile=0x230, lpBuffer=0x2d53020, nNumberOfBytesToRead=0x97e0d, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x2d53020*, lpNumberOfBytesRead=0x299d7e8*=0x97e0d, lpOverlapped=0x0) returned 1 [0086.821] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0086.821] WriteFile (in: hFile=0x230, lpBuffer=0x2d53020*, nNumberOfBytesToWrite=0x97e0d, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0x2d53020*, lpNumberOfBytesWritten=0x299d7e4*=0x97e0d, lpOverlapped=0x0) returned 1 [0087.019] GetProcessHeap () returned 0xd20000 [0087.019] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0x2d53020 | out: hHeap=0xd20000) returned 1 [0087.019] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0087.019] WriteFile (in: hFile=0x230, lpBuffer=0xd4c638*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4c638*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0087.022] CloseHandle (hObject=0x230) returned 1 [0087.042] GetProcessHeap () returned 0xd20000 [0087.042] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42738 | out: hHeap=0xd20000) returned 1 [0087.042] GetProcessHeap () returned 0xd20000 [0087.042] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bb48 | out: hHeap=0xd20000) returned 1 [0087.042] GetProcessHeap () returned 0xd20000 [0087.042] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0087.042] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht") returned="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht" [0087.042] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht.[ponce.lorena@aol.com]" [0087.042] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht" (normalized: "c:\\windows10upgrade\\resources\\ux\\networkissuefaq.mht"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\networkissuefaq.mht.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0087.043] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\NetworkIssueFAQ.mht" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0087.043] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0087.043] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" [0087.043] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_recover.html")) returned 0x20 [0087.044] GetProcessHeap () returned 0xd20000 [0087.044] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd366c8 | out: hHeap=0xd20000) returned 1 [0087.044] FindNextFileW (in: hFindFile=0xd49060, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea631830, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea631830, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x875, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NoNetworkConnection.png", cAlternateFileName="NONETW~1.PNG")) returned 1 [0087.044] lstrcmpiW (lpString1="NoNetworkConnection.png", lpString2=".") returned 1 [0087.044] lstrcmpiW (lpString1="NoNetworkConnection.png", lpString2="..") returned 1 [0087.044] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="NoNetworkConnection.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png") returned="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" [0087.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NoNetworkConnection.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0087.044] GetProcessHeap () returned 0xd20000 [0087.044] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x18) returned 0xd36648 [0087.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NoNetworkConnection.png", cchWideChar=-1, lpMultiByteStr=0xd36648, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NoNetworkConnection.png", lpUsedDefaultChar=0x0) returned 24 [0087.044] lstrlenA (lpString="NoNetworkConnection.png") returned 23 [0087.044] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0087.044] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0087.044] lstrlenA (lpString="NoNetworkConnection.png") returned 23 [0087.044] lstrcmpiA (lpString1="NoNetworkConnection.png", lpString2=".[ponce.lorena@aol.com]") returned 1 [0087.044] lstrlenA (lpString="NoNetworkConnection.png") returned 23 [0087.044] lstrlenA (lpString=".dll") returned 4 [0087.045] lstrlenA (lpString=".dll") returned 4 [0087.045] lstrlenA (lpString="NoNetworkConnection.png") returned 23 [0087.045] lstrcmpiA (lpString1=".png", lpString2=".dll") returned 1 [0087.045] lstrlenA (lpString="NoNetworkConnection.png") returned 23 [0087.045] lstrlenA (lpString=".ini") returned 4 [0087.045] lstrlenA (lpString=".ini") returned 4 [0087.045] lstrlenA (lpString="NoNetworkConnection.png") returned 23 [0087.045] lstrcmpiA (lpString1=".png", lpString2=".ini") returned 1 [0087.045] lstrlenA (lpString="NoNetworkConnection.png") returned 23 [0087.045] lstrlenA (lpString=".inc") returned 4 [0087.045] lstrlenA (lpString=".inc") returned 4 [0087.045] lstrlenA (lpString="NoNetworkConnection.png") returned 23 [0087.045] lstrcmpiA (lpString1=".png", lpString2=".inc") returned 1 [0087.045] lstrcmpiW (lpString1="NoNetworkConnection.png", lpString2="HOW_RECOVER.html") returned 1 [0087.045] lstrcmpiW (lpString1="NoNetworkConnection.png", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0087.045] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0087.045] lstrcmpiW (lpString1="NoNetworkConnection.png", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0087.045] GetProcessHeap () returned 0xd20000 [0087.045] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42580 [0087.046] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0087.046] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=2165) returned 1 [0087.046] GetProcessHeap () returned 0xd20000 [0087.046] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bf08 [0087.046] GetProcessHeap () returned 0xd20000 [0087.046] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0087.046] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png") returned 56 [0087.046] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0087.047] GetProcessHeap () returned 0xd20000 [0087.047] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0087.047] GetProcessHeap () returned 0xd20000 [0087.047] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x38b) returned 0xd4d678 [0087.047] lstrlenA (lpString="rsa_encrypt") returned 11 [0087.047] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0087.049] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0087.049] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0087.049] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0087.049] GetProcessHeap () returned 0xd20000 [0087.049] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0087.049] lstrlenA (lpString="010001") returned 6 [0087.049] GetProcessHeap () returned 0xd20000 [0087.049] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc98 [0087.049] GetProcessHeap () returned 0xd20000 [0087.049] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0087.049] GetProcessHeap () returned 0xd20000 [0087.049] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b758 [0087.049] GetProcessHeap () returned 0xd20000 [0087.050] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0087.050] GetProcessHeap () returned 0xd20000 [0087.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b3f8 [0087.050] GetProcessHeap () returned 0xd20000 [0087.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45528 [0087.050] GetProcessHeap () returned 0xd20000 [0087.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd28 [0087.050] GetProcessHeap () returned 0xd20000 [0087.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0087.050] GetProcessHeap () returned 0xd20000 [0087.050] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.050] GetProcessHeap () returned 0xd20000 [0087.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0087.050] GetProcessHeap () returned 0xd20000 [0087.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0087.050] GetProcessHeap () returned 0xd20000 [0087.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44808 [0087.050] GetProcessHeap () returned 0xd20000 [0087.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.051] GetProcessHeap () returned 0xd20000 [0087.051] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44570 [0087.051] GetProcessHeap () returned 0xd20000 [0087.051] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b488 [0087.051] GetProcessHeap () returned 0xd20000 [0087.051] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0087.051] GetProcessHeap () returned 0xd20000 [0087.051] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0087.051] GetProcessHeap () returned 0xd20000 [0087.051] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b488 | out: hHeap=0xd20000) returned 1 [0087.051] GetProcessHeap () returned 0xd20000 [0087.051] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0087.051] GetProcessHeap () returned 0xd20000 [0087.051] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446f0 [0087.051] GetProcessHeap () returned 0xd20000 [0087.051] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.051] GetProcessHeap () returned 0xd20000 [0087.051] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0087.051] GetProcessHeap () returned 0xd20000 [0087.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0087.052] GetProcessHeap () returned 0xd20000 [0087.052] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0087.052] GetProcessHeap () returned 0xd20000 [0087.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.052] GetProcessHeap () returned 0xd20000 [0087.052] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.052] GetProcessHeap () returned 0xd20000 [0087.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b248 [0087.052] GetProcessHeap () returned 0xd20000 [0087.052] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446f0 | out: hHeap=0xd20000) returned 1 [0087.052] GetProcessHeap () returned 0xd20000 [0087.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0087.052] GetProcessHeap () returned 0xd20000 [0087.052] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b248 | out: hHeap=0xd20000) returned 1 [0087.052] GetProcessHeap () returned 0xd20000 [0087.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.052] GetProcessHeap () returned 0xd20000 [0087.052] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.052] GetProcessHeap () returned 0xd20000 [0087.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.053] GetProcessHeap () returned 0xd20000 [0087.053] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.053] GetProcessHeap () returned 0xd20000 [0087.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.053] GetProcessHeap () returned 0xd20000 [0087.053] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.053] GetProcessHeap () returned 0xd20000 [0087.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.053] GetProcessHeap () returned 0xd20000 [0087.053] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.053] GetProcessHeap () returned 0xd20000 [0087.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0087.053] GetProcessHeap () returned 0xd20000 [0087.053] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0087.053] GetProcessHeap () returned 0xd20000 [0087.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0087.053] GetProcessHeap () returned 0xd20000 [0087.053] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0087.054] GetProcessHeap () returned 0xd20000 [0087.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.054] GetProcessHeap () returned 0xd20000 [0087.054] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.054] GetProcessHeap () returned 0xd20000 [0087.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.054] GetProcessHeap () returned 0xd20000 [0087.054] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.054] GetProcessHeap () returned 0xd20000 [0087.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0087.054] GetProcessHeap () returned 0xd20000 [0087.054] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0087.054] GetProcessHeap () returned 0xd20000 [0087.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.054] GetProcessHeap () returned 0xd20000 [0087.054] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.054] GetProcessHeap () returned 0xd20000 [0087.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0087.054] GetProcessHeap () returned 0xd20000 [0087.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0087.055] GetProcessHeap () returned 0xd20000 [0087.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.055] GetProcessHeap () returned 0xd20000 [0087.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.055] GetProcessHeap () returned 0xd20000 [0087.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.055] GetProcessHeap () returned 0xd20000 [0087.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.055] GetProcessHeap () returned 0xd20000 [0087.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.055] GetProcessHeap () returned 0xd20000 [0087.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.055] GetProcessHeap () returned 0xd20000 [0087.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.055] GetProcessHeap () returned 0xd20000 [0087.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.055] GetProcessHeap () returned 0xd20000 [0087.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.056] GetProcessHeap () returned 0xd20000 [0087.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.056] GetProcessHeap () returned 0xd20000 [0087.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0087.056] GetProcessHeap () returned 0xd20000 [0087.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0087.056] GetProcessHeap () returned 0xd20000 [0087.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0087.056] GetProcessHeap () returned 0xd20000 [0087.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0087.056] GetProcessHeap () returned 0xd20000 [0087.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0087.056] GetProcessHeap () returned 0xd20000 [0087.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0087.056] GetProcessHeap () returned 0xd20000 [0087.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.056] GetProcessHeap () returned 0xd20000 [0087.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.056] GetProcessHeap () returned 0xd20000 [0087.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0087.057] GetProcessHeap () returned 0xd20000 [0087.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0087.057] GetProcessHeap () returned 0xd20000 [0087.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0087.057] GetProcessHeap () returned 0xd20000 [0087.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0087.057] GetProcessHeap () returned 0xd20000 [0087.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0087.057] GetProcessHeap () returned 0xd20000 [0087.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0087.057] GetProcessHeap () returned 0xd20000 [0087.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0087.057] GetProcessHeap () returned 0xd20000 [0087.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0087.057] GetProcessHeap () returned 0xd20000 [0087.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0087.057] GetProcessHeap () returned 0xd20000 [0087.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0087.058] GetProcessHeap () returned 0xd20000 [0087.058] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.058] GetProcessHeap () returned 0xd20000 [0087.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.059] GetProcessHeap () returned 0xd20000 [0087.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0087.059] GetProcessHeap () returned 0xd20000 [0087.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0087.059] GetProcessHeap () returned 0xd20000 [0087.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.059] GetProcessHeap () returned 0xd20000 [0087.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.059] GetProcessHeap () returned 0xd20000 [0087.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.059] GetProcessHeap () returned 0xd20000 [0087.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.059] GetProcessHeap () returned 0xd20000 [0087.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.059] GetProcessHeap () returned 0xd20000 [0087.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.060] GetProcessHeap () returned 0xd20000 [0087.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.060] GetProcessHeap () returned 0xd20000 [0087.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.060] GetProcessHeap () returned 0xd20000 [0087.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0087.060] GetProcessHeap () returned 0xd20000 [0087.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0087.060] GetProcessHeap () returned 0xd20000 [0087.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.060] GetProcessHeap () returned 0xd20000 [0087.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.060] GetProcessHeap () returned 0xd20000 [0087.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0087.060] GetProcessHeap () returned 0xd20000 [0087.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0087.060] GetProcessHeap () returned 0xd20000 [0087.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.060] GetProcessHeap () returned 0xd20000 [0087.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.061] GetProcessHeap () returned 0xd20000 [0087.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0087.061] GetProcessHeap () returned 0xd20000 [0087.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0087.061] GetProcessHeap () returned 0xd20000 [0087.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.061] GetProcessHeap () returned 0xd20000 [0087.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.061] GetProcessHeap () returned 0xd20000 [0087.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.061] GetProcessHeap () returned 0xd20000 [0087.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.061] GetProcessHeap () returned 0xd20000 [0087.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.061] GetProcessHeap () returned 0xd20000 [0087.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.061] GetProcessHeap () returned 0xd20000 [0087.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0087.062] GetProcessHeap () returned 0xd20000 [0087.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0087.062] GetProcessHeap () returned 0xd20000 [0087.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.062] GetProcessHeap () returned 0xd20000 [0087.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.062] GetProcessHeap () returned 0xd20000 [0087.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0087.062] GetProcessHeap () returned 0xd20000 [0087.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0087.062] GetProcessHeap () returned 0xd20000 [0087.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0087.062] GetProcessHeap () returned 0xd20000 [0087.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0087.062] GetProcessHeap () returned 0xd20000 [0087.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.062] GetProcessHeap () returned 0xd20000 [0087.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.062] GetProcessHeap () returned 0xd20000 [0087.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.063] GetProcessHeap () returned 0xd20000 [0087.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.063] GetProcessHeap () returned 0xd20000 [0087.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0087.063] GetProcessHeap () returned 0xd20000 [0087.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0087.063] GetProcessHeap () returned 0xd20000 [0087.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.063] GetProcessHeap () returned 0xd20000 [0087.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.063] GetProcessHeap () returned 0xd20000 [0087.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.063] GetProcessHeap () returned 0xd20000 [0087.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.063] GetProcessHeap () returned 0xd20000 [0087.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.063] GetProcessHeap () returned 0xd20000 [0087.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.064] GetProcessHeap () returned 0xd20000 [0087.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0087.064] GetProcessHeap () returned 0xd20000 [0087.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0087.064] GetProcessHeap () returned 0xd20000 [0087.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.064] GetProcessHeap () returned 0xd20000 [0087.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.064] GetProcessHeap () returned 0xd20000 [0087.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0087.064] GetProcessHeap () returned 0xd20000 [0087.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0087.064] GetProcessHeap () returned 0xd20000 [0087.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.064] GetProcessHeap () returned 0xd20000 [0087.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.064] GetProcessHeap () returned 0xd20000 [0087.065] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.065] GetProcessHeap () returned 0xd20000 [0087.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.065] GetProcessHeap () returned 0xd20000 [0087.065] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.065] GetProcessHeap () returned 0xd20000 [0087.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.065] GetProcessHeap () returned 0xd20000 [0087.065] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.065] GetProcessHeap () returned 0xd20000 [0087.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.065] GetProcessHeap () returned 0xd20000 [0087.065] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0087.065] GetProcessHeap () returned 0xd20000 [0087.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0087.065] GetProcessHeap () returned 0xd20000 [0087.065] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0087.065] GetProcessHeap () returned 0xd20000 [0087.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0087.066] GetProcessHeap () returned 0xd20000 [0087.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0087.066] GetProcessHeap () returned 0xd20000 [0087.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0087.066] GetProcessHeap () returned 0xd20000 [0087.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.066] GetProcessHeap () returned 0xd20000 [0087.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.066] GetProcessHeap () returned 0xd20000 [0087.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.066] GetProcessHeap () returned 0xd20000 [0087.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.066] GetProcessHeap () returned 0xd20000 [0087.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0087.066] GetProcessHeap () returned 0xd20000 [0087.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0087.066] GetProcessHeap () returned 0xd20000 [0087.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.066] GetProcessHeap () returned 0xd20000 [0087.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.067] GetProcessHeap () returned 0xd20000 [0087.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0087.067] GetProcessHeap () returned 0xd20000 [0087.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0087.067] GetProcessHeap () returned 0xd20000 [0087.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0087.067] GetProcessHeap () returned 0xd20000 [0087.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0087.067] GetProcessHeap () returned 0xd20000 [0087.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.067] GetProcessHeap () returned 0xd20000 [0087.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.067] GetProcessHeap () returned 0xd20000 [0087.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0087.067] GetProcessHeap () returned 0xd20000 [0087.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0087.067] GetProcessHeap () returned 0xd20000 [0087.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.067] GetProcessHeap () returned 0xd20000 [0087.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.068] GetProcessHeap () returned 0xd20000 [0087.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.068] GetProcessHeap () returned 0xd20000 [0087.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.068] GetProcessHeap () returned 0xd20000 [0087.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.068] GetProcessHeap () returned 0xd20000 [0087.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.068] GetProcessHeap () returned 0xd20000 [0087.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.068] GetProcessHeap () returned 0xd20000 [0087.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.068] GetProcessHeap () returned 0xd20000 [0087.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.068] GetProcessHeap () returned 0xd20000 [0087.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.068] GetProcessHeap () returned 0xd20000 [0087.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.069] GetProcessHeap () returned 0xd20000 [0087.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.069] GetProcessHeap () returned 0xd20000 [0087.069] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.069] GetProcessHeap () returned 0xd20000 [0087.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.069] GetProcessHeap () returned 0xd20000 [0087.069] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.069] GetProcessHeap () returned 0xd20000 [0087.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.069] GetProcessHeap () returned 0xd20000 [0087.069] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0087.069] GetProcessHeap () returned 0xd20000 [0087.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0087.069] GetProcessHeap () returned 0xd20000 [0087.069] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.069] GetProcessHeap () returned 0xd20000 [0087.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.069] GetProcessHeap () returned 0xd20000 [0087.070] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0087.070] GetProcessHeap () returned 0xd20000 [0087.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0087.070] GetProcessHeap () returned 0xd20000 [0087.070] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.070] GetProcessHeap () returned 0xd20000 [0087.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.070] GetProcessHeap () returned 0xd20000 [0087.070] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.070] GetProcessHeap () returned 0xd20000 [0087.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.070] GetProcessHeap () returned 0xd20000 [0087.070] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.070] GetProcessHeap () returned 0xd20000 [0087.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.070] GetProcessHeap () returned 0xd20000 [0087.070] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0087.070] GetProcessHeap () returned 0xd20000 [0087.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0087.071] GetProcessHeap () returned 0xd20000 [0087.071] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.071] GetProcessHeap () returned 0xd20000 [0087.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.071] GetProcessHeap () returned 0xd20000 [0087.071] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.071] GetProcessHeap () returned 0xd20000 [0087.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.071] GetProcessHeap () returned 0xd20000 [0087.071] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.071] GetProcessHeap () returned 0xd20000 [0087.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.071] GetProcessHeap () returned 0xd20000 [0087.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0087.071] GetProcessHeap () returned 0xd20000 [0087.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0087.071] GetProcessHeap () returned 0xd20000 [0087.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0087.071] GetProcessHeap () returned 0xd20000 [0087.072] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0087.072] GetProcessHeap () returned 0xd20000 [0087.072] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44570 | out: hHeap=0xd20000) returned 1 [0087.072] GetProcessHeap () returned 0xd20000 [0087.072] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b3f8 | out: hHeap=0xd20000) returned 1 [0087.072] GetProcessHeap () returned 0xd20000 [0087.072] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0087.072] GetProcessHeap () returned 0xd20000 [0087.072] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b758 | out: hHeap=0xd20000) returned 1 [0087.072] GetProcessHeap () returned 0xd20000 [0087.072] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0087.072] GetProcessHeap () returned 0xd20000 [0087.072] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.072] GetProcessHeap () returned 0xd20000 [0087.072] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0087.072] WriteFile (in: hFile=0x230, lpBuffer=0xd4d678*, nNumberOfBytesToWrite=0x38b, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d678*, lpNumberOfBytesWritten=0x299d864*=0x38b, lpOverlapped=0x0) returned 1 [0087.079] GetProcessHeap () returned 0xd20000 [0087.079] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4d678, Size=0x30) returned 0xd4d678 [0087.079] GetProcessHeap () returned 0xd20000 [0087.079] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0087.079] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0087.079] GetProcessHeap () returned 0xd20000 [0087.079] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x880) returned 0xd4d6b0 [0087.079] ReadFile (in: hFile=0x230, lpBuffer=0xd4d6b0, nNumberOfBytesToRead=0x880, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4d6b0*, lpNumberOfBytesRead=0x299d7e8*=0x880, lpOverlapped=0x0) returned 1 [0087.079] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0087.079] WriteFile (in: hFile=0x230, lpBuffer=0xd4d6b0*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4d6b0*, lpNumberOfBytesWritten=0x299d7e4*=0x880, lpOverlapped=0x0) returned 1 [0087.081] GetProcessHeap () returned 0xd20000 [0087.081] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4d6b0 | out: hHeap=0xd20000) returned 1 [0087.081] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0087.082] WriteFile (in: hFile=0x230, lpBuffer=0xd4d678*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d678*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0087.083] CloseHandle (hObject=0x230) returned 1 [0087.085] GetProcessHeap () returned 0xd20000 [0087.085] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42580 | out: hHeap=0xd20000) returned 1 [0087.085] GetProcessHeap () returned 0xd20000 [0087.085] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bf08 | out: hHeap=0xd20000) returned 1 [0087.085] GetProcessHeap () returned 0xd20000 [0087.085] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0087.085] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png") returned="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" [0087.085] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png.[ponce.lorena@aol.com]" [0087.085] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnection.png.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0087.086] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnection.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0087.086] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0087.086] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" [0087.086] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_recover.html")) returned 0x20 [0087.086] GetProcessHeap () returned 0xd20000 [0087.086] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36648 | out: hHeap=0xd20000) returned 1 [0087.087] FindNextFileW (in: hFindFile=0xd49060, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea631830, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea631830, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x8a4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NoNetworkConnectionHoverOver.png", cAlternateFileName="NONETW~2.PNG")) returned 1 [0087.087] lstrcmpiW (lpString1="NoNetworkConnectionHoverOver.png", lpString2=".") returned 1 [0087.087] lstrcmpiW (lpString1="NoNetworkConnectionHoverOver.png", lpString2="..") returned 1 [0087.087] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="NoNetworkConnectionHoverOver.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png") returned="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" [0087.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NoNetworkConnectionHoverOver.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 33 [0087.087] GetProcessHeap () returned 0xd20000 [0087.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x21) returned 0xd34d68 [0087.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NoNetworkConnectionHoverOver.png", cchWideChar=-1, lpMultiByteStr=0xd34d68, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NoNetworkConnectionHoverOver.png", lpUsedDefaultChar=0x0) returned 33 [0087.087] lstrlenA (lpString="NoNetworkConnectionHoverOver.png") returned 32 [0087.087] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0087.087] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0087.087] lstrlenA (lpString="NoNetworkConnectionHoverOver.png") returned 32 [0087.087] lstrcmpiA (lpString1="ConnectionHoverOver.png", lpString2=".[ponce.lorena@aol.com]") returned 1 [0087.087] lstrlenA (lpString="NoNetworkConnectionHoverOver.png") returned 32 [0087.087] lstrlenA (lpString=".dll") returned 4 [0087.087] lstrlenA (lpString=".dll") returned 4 [0087.087] lstrlenA (lpString="NoNetworkConnectionHoverOver.png") returned 32 [0087.088] lstrcmpiA (lpString1=".png", lpString2=".dll") returned 1 [0087.088] lstrlenA (lpString="NoNetworkConnectionHoverOver.png") returned 32 [0087.088] lstrlenA (lpString=".ini") returned 4 [0087.088] lstrlenA (lpString=".ini") returned 4 [0087.088] lstrlenA (lpString="NoNetworkConnectionHoverOver.png") returned 32 [0087.088] lstrcmpiA (lpString1=".png", lpString2=".ini") returned 1 [0087.088] lstrlenA (lpString="NoNetworkConnectionHoverOver.png") returned 32 [0087.088] lstrlenA (lpString=".inc") returned 4 [0087.088] lstrlenA (lpString=".inc") returned 4 [0087.088] lstrlenA (lpString="NoNetworkConnectionHoverOver.png") returned 32 [0087.088] lstrcmpiA (lpString1=".png", lpString2=".inc") returned 1 [0087.088] lstrcmpiW (lpString1="NoNetworkConnectionHoverOver.png", lpString2="HOW_RECOVER.html") returned 1 [0087.088] lstrcmpiW (lpString1="NoNetworkConnectionHoverOver.png", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0087.088] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0087.088] lstrcmpiW (lpString1="NoNetworkConnectionHoverOver.png", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0087.088] GetProcessHeap () returned 0xd20000 [0087.088] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd428a0 [0087.088] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0087.090] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=2212) returned 1 [0087.091] GetProcessHeap () returned 0xd20000 [0087.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c250 [0087.091] GetProcessHeap () returned 0xd20000 [0087.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0087.091] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png") returned 65 [0087.091] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0087.091] GetProcessHeap () returned 0xd20000 [0087.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0087.091] GetProcessHeap () returned 0xd20000 [0087.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x38c) returned 0xd4d6b0 [0087.091] lstrlenA (lpString="rsa_encrypt") returned 11 [0087.091] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0087.093] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0087.093] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0087.094] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0087.094] GetProcessHeap () returned 0xd20000 [0087.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0087.094] lstrlenA (lpString="010001") returned 6 [0087.094] GetProcessHeap () returned 0xd20000 [0087.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd28 [0087.094] GetProcessHeap () returned 0xd20000 [0087.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0087.094] GetProcessHeap () returned 0xd20000 [0087.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b7e8 [0087.094] GetProcessHeap () returned 0xd20000 [0087.094] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0087.094] GetProcessHeap () returned 0xd20000 [0087.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ae58 [0087.094] GetProcessHeap () returned 0xd20000 [0087.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45410 [0087.094] GetProcessHeap () returned 0xd20000 [0087.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd98 [0087.095] GetProcessHeap () returned 0xd20000 [0087.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0087.095] GetProcessHeap () returned 0xd20000 [0087.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.095] GetProcessHeap () returned 0xd20000 [0087.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0087.095] GetProcessHeap () returned 0xd20000 [0087.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0087.095] GetProcessHeap () returned 0xd20000 [0087.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44c68 [0087.095] GetProcessHeap () returned 0xd20000 [0087.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.095] GetProcessHeap () returned 0xd20000 [0087.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44408 [0087.095] GetProcessHeap () returned 0xd20000 [0087.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b488 [0087.095] GetProcessHeap () returned 0xd20000 [0087.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0087.095] GetProcessHeap () returned 0xd20000 [0087.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0087.096] GetProcessHeap () returned 0xd20000 [0087.096] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b488 | out: hHeap=0xd20000) returned 1 [0087.096] GetProcessHeap () returned 0xd20000 [0087.096] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0087.096] GetProcessHeap () returned 0xd20000 [0087.096] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444e0 [0087.096] GetProcessHeap () returned 0xd20000 [0087.096] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.096] GetProcessHeap () returned 0xd20000 [0087.096] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0087.096] GetProcessHeap () returned 0xd20000 [0087.096] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.096] GetProcessHeap () returned 0xd20000 [0087.096] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.096] GetProcessHeap () returned 0xd20000 [0087.096] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0087.096] GetProcessHeap () returned 0xd20000 [0087.096] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0087.096] GetProcessHeap () returned 0xd20000 [0087.097] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4aaf8 [0087.097] GetProcessHeap () returned 0xd20000 [0087.097] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444e0 | out: hHeap=0xd20000) returned 1 [0087.097] GetProcessHeap () returned 0xd20000 [0087.097] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0087.097] GetProcessHeap () returned 0xd20000 [0087.097] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aaf8 | out: hHeap=0xd20000) returned 1 [0087.097] GetProcessHeap () returned 0xd20000 [0087.097] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.097] GetProcessHeap () returned 0xd20000 [0087.097] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.097] GetProcessHeap () returned 0xd20000 [0087.097] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0087.097] GetProcessHeap () returned 0xd20000 [0087.097] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0087.097] GetProcessHeap () returned 0xd20000 [0087.097] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.097] GetProcessHeap () returned 0xd20000 [0087.097] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.098] GetProcessHeap () returned 0xd20000 [0087.098] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0087.098] GetProcessHeap () returned 0xd20000 [0087.098] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0087.098] GetProcessHeap () returned 0xd20000 [0087.098] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0087.098] GetProcessHeap () returned 0xd20000 [0087.098] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0087.098] GetProcessHeap () returned 0xd20000 [0087.098] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0087.098] GetProcessHeap () returned 0xd20000 [0087.098] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0087.098] GetProcessHeap () returned 0xd20000 [0087.098] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0087.098] GetProcessHeap () returned 0xd20000 [0087.098] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0087.098] GetProcessHeap () returned 0xd20000 [0087.098] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.098] GetProcessHeap () returned 0xd20000 [0087.099] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.099] GetProcessHeap () returned 0xd20000 [0087.099] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0087.099] GetProcessHeap () returned 0xd20000 [0087.099] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0087.099] GetProcessHeap () returned 0xd20000 [0087.099] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0087.099] GetProcessHeap () returned 0xd20000 [0087.099] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0087.099] GetProcessHeap () returned 0xd20000 [0087.099] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.099] GetProcessHeap () returned 0xd20000 [0087.099] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.099] GetProcessHeap () returned 0xd20000 [0087.099] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0087.099] GetProcessHeap () returned 0xd20000 [0087.099] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0087.099] GetProcessHeap () returned 0xd20000 [0087.100] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.100] GetProcessHeap () returned 0xd20000 [0087.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.100] GetProcessHeap () returned 0xd20000 [0087.100] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0087.100] GetProcessHeap () returned 0xd20000 [0087.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0087.100] GetProcessHeap () returned 0xd20000 [0087.100] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.100] GetProcessHeap () returned 0xd20000 [0087.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.100] GetProcessHeap () returned 0xd20000 [0087.100] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.100] GetProcessHeap () returned 0xd20000 [0087.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.100] GetProcessHeap () returned 0xd20000 [0087.100] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.100] GetProcessHeap () returned 0xd20000 [0087.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.101] GetProcessHeap () returned 0xd20000 [0087.101] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.101] GetProcessHeap () returned 0xd20000 [0087.101] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.101] GetProcessHeap () returned 0xd20000 [0087.101] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.101] GetProcessHeap () returned 0xd20000 [0087.101] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.101] GetProcessHeap () returned 0xd20000 [0087.101] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.101] GetProcessHeap () returned 0xd20000 [0087.101] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.101] GetProcessHeap () returned 0xd20000 [0087.101] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.101] GetProcessHeap () returned 0xd20000 [0087.101] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.101] GetProcessHeap () returned 0xd20000 [0087.101] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0087.101] GetProcessHeap () returned 0xd20000 [0087.102] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0087.102] GetProcessHeap () returned 0xd20000 [0087.102] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.102] GetProcessHeap () returned 0xd20000 [0087.102] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.102] GetProcessHeap () returned 0xd20000 [0087.102] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.102] GetProcessHeap () returned 0xd20000 [0087.102] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.102] GetProcessHeap () returned 0xd20000 [0087.102] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.102] GetProcessHeap () returned 0xd20000 [0087.102] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.102] GetProcessHeap () returned 0xd20000 [0087.102] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0087.102] GetProcessHeap () returned 0xd20000 [0087.102] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0087.102] GetProcessHeap () returned 0xd20000 [0087.102] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0087.103] GetProcessHeap () returned 0xd20000 [0087.103] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0087.103] GetProcessHeap () returned 0xd20000 [0087.103] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0087.103] GetProcessHeap () returned 0xd20000 [0087.103] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0087.103] GetProcessHeap () returned 0xd20000 [0087.103] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.103] GetProcessHeap () returned 0xd20000 [0087.103] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.103] GetProcessHeap () returned 0xd20000 [0087.103] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.103] GetProcessHeap () returned 0xd20000 [0087.103] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.103] GetProcessHeap () returned 0xd20000 [0087.103] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.103] GetProcessHeap () returned 0xd20000 [0087.104] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.104] GetProcessHeap () returned 0xd20000 [0087.104] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.104] GetProcessHeap () returned 0xd20000 [0087.104] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.104] GetProcessHeap () returned 0xd20000 [0087.104] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0087.104] GetProcessHeap () returned 0xd20000 [0087.104] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0087.104] GetProcessHeap () returned 0xd20000 [0087.104] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0087.104] GetProcessHeap () returned 0xd20000 [0087.104] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0087.104] GetProcessHeap () returned 0xd20000 [0087.104] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0087.104] GetProcessHeap () returned 0xd20000 [0087.104] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0087.104] GetProcessHeap () returned 0xd20000 [0087.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0087.105] GetProcessHeap () returned 0xd20000 [0087.105] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0087.105] GetProcessHeap () returned 0xd20000 [0087.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.105] GetProcessHeap () returned 0xd20000 [0087.105] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.105] GetProcessHeap () returned 0xd20000 [0087.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.105] GetProcessHeap () returned 0xd20000 [0087.105] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.105] GetProcessHeap () returned 0xd20000 [0087.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.105] GetProcessHeap () returned 0xd20000 [0087.105] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.105] GetProcessHeap () returned 0xd20000 [0087.106] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.106] GetProcessHeap () returned 0xd20000 [0087.106] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.106] GetProcessHeap () returned 0xd20000 [0087.106] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0087.106] GetProcessHeap () returned 0xd20000 [0087.106] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0087.106] GetProcessHeap () returned 0xd20000 [0087.106] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0087.106] GetProcessHeap () returned 0xd20000 [0087.106] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0087.106] GetProcessHeap () returned 0xd20000 [0087.106] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0087.106] GetProcessHeap () returned 0xd20000 [0087.106] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0087.106] GetProcessHeap () returned 0xd20000 [0087.106] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.106] GetProcessHeap () returned 0xd20000 [0087.106] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.107] GetProcessHeap () returned 0xd20000 [0087.107] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.107] GetProcessHeap () returned 0xd20000 [0087.107] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.107] GetProcessHeap () returned 0xd20000 [0087.107] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0087.107] GetProcessHeap () returned 0xd20000 [0087.107] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0087.107] GetProcessHeap () returned 0xd20000 [0087.107] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.107] GetProcessHeap () returned 0xd20000 [0087.107] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.107] GetProcessHeap () returned 0xd20000 [0087.107] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0087.107] GetProcessHeap () returned 0xd20000 [0087.107] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0087.107] GetProcessHeap () returned 0xd20000 [0087.107] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.108] GetProcessHeap () returned 0xd20000 [0087.108] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.108] GetProcessHeap () returned 0xd20000 [0087.108] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0087.108] GetProcessHeap () returned 0xd20000 [0087.108] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0087.108] GetProcessHeap () returned 0xd20000 [0087.108] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0087.108] GetProcessHeap () returned 0xd20000 [0087.108] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0087.108] GetProcessHeap () returned 0xd20000 [0087.108] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.108] GetProcessHeap () returned 0xd20000 [0087.108] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.108] GetProcessHeap () returned 0xd20000 [0087.108] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.108] GetProcessHeap () returned 0xd20000 [0087.108] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.108] GetProcessHeap () returned 0xd20000 [0087.109] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.109] GetProcessHeap () returned 0xd20000 [0087.109] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.109] GetProcessHeap () returned 0xd20000 [0087.109] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0087.109] GetProcessHeap () returned 0xd20000 [0087.109] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0087.109] GetProcessHeap () returned 0xd20000 [0087.109] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.109] GetProcessHeap () returned 0xd20000 [0087.109] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.109] GetProcessHeap () returned 0xd20000 [0087.109] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.109] GetProcessHeap () returned 0xd20000 [0087.109] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.109] GetProcessHeap () returned 0xd20000 [0087.109] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.109] GetProcessHeap () returned 0xd20000 [0087.109] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.110] GetProcessHeap () returned 0xd20000 [0087.110] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0087.110] GetProcessHeap () returned 0xd20000 [0087.110] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0087.110] GetProcessHeap () returned 0xd20000 [0087.110] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.110] GetProcessHeap () returned 0xd20000 [0087.110] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.110] GetProcessHeap () returned 0xd20000 [0087.110] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.110] GetProcessHeap () returned 0xd20000 [0087.110] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.110] GetProcessHeap () returned 0xd20000 [0087.110] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0087.110] GetProcessHeap () returned 0xd20000 [0087.110] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0087.110] GetProcessHeap () returned 0xd20000 [0087.110] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.110] GetProcessHeap () returned 0xd20000 [0087.111] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.111] GetProcessHeap () returned 0xd20000 [0087.111] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.111] GetProcessHeap () returned 0xd20000 [0087.111] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.111] GetProcessHeap () returned 0xd20000 [0087.111] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0087.111] GetProcessHeap () returned 0xd20000 [0087.111] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0087.111] GetProcessHeap () returned 0xd20000 [0087.111] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.111] GetProcessHeap () returned 0xd20000 [0087.111] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.111] GetProcessHeap () returned 0xd20000 [0087.111] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.111] GetProcessHeap () returned 0xd20000 [0087.111] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.111] GetProcessHeap () returned 0xd20000 [0087.111] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.112] GetProcessHeap () returned 0xd20000 [0087.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.112] GetProcessHeap () returned 0xd20000 [0087.112] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.112] GetProcessHeap () returned 0xd20000 [0087.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.112] GetProcessHeap () returned 0xd20000 [0087.112] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.112] GetProcessHeap () returned 0xd20000 [0087.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.112] GetProcessHeap () returned 0xd20000 [0087.112] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.112] GetProcessHeap () returned 0xd20000 [0087.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.112] GetProcessHeap () returned 0xd20000 [0087.112] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0087.112] GetProcessHeap () returned 0xd20000 [0087.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0087.113] GetProcessHeap () returned 0xd20000 [0087.113] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.113] GetProcessHeap () returned 0xd20000 [0087.113] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.113] GetProcessHeap () returned 0xd20000 [0087.113] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.113] GetProcessHeap () returned 0xd20000 [0087.113] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.113] GetProcessHeap () returned 0xd20000 [0087.113] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.113] GetProcessHeap () returned 0xd20000 [0087.113] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.113] GetProcessHeap () returned 0xd20000 [0087.113] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.113] GetProcessHeap () returned 0xd20000 [0087.113] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.113] GetProcessHeap () returned 0xd20000 [0087.113] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.114] GetProcessHeap () returned 0xd20000 [0087.114] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.114] GetProcessHeap () returned 0xd20000 [0087.114] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.114] GetProcessHeap () returned 0xd20000 [0087.114] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.114] GetProcessHeap () returned 0xd20000 [0087.114] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0087.114] GetProcessHeap () returned 0xd20000 [0087.114] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0087.114] GetProcessHeap () returned 0xd20000 [0087.114] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.114] GetProcessHeap () returned 0xd20000 [0087.114] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.114] GetProcessHeap () returned 0xd20000 [0087.114] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.114] GetProcessHeap () returned 0xd20000 [0087.114] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.114] GetProcessHeap () returned 0xd20000 [0087.115] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.115] GetProcessHeap () returned 0xd20000 [0087.115] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.115] GetProcessHeap () returned 0xd20000 [0087.115] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0087.115] GetProcessHeap () returned 0xd20000 [0087.115] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0087.115] GetProcessHeap () returned 0xd20000 [0087.115] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.115] GetProcessHeap () returned 0xd20000 [0087.115] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.115] GetProcessHeap () returned 0xd20000 [0087.115] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.115] GetProcessHeap () returned 0xd20000 [0087.115] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.115] GetProcessHeap () returned 0xd20000 [0087.115] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0087.115] GetProcessHeap () returned 0xd20000 [0087.115] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0087.116] GetProcessHeap () returned 0xd20000 [0087.116] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0087.116] GetProcessHeap () returned 0xd20000 [0087.116] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0087.116] GetProcessHeap () returned 0xd20000 [0087.116] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44408 | out: hHeap=0xd20000) returned 1 [0087.116] GetProcessHeap () returned 0xd20000 [0087.116] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ae58 | out: hHeap=0xd20000) returned 1 [0087.116] GetProcessHeap () returned 0xd20000 [0087.116] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0087.116] GetProcessHeap () returned 0xd20000 [0087.116] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0087.116] GetProcessHeap () returned 0xd20000 [0087.116] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0087.116] GetProcessHeap () returned 0xd20000 [0087.116] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.116] GetProcessHeap () returned 0xd20000 [0087.116] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0087.117] WriteFile (in: hFile=0x230, lpBuffer=0xd4d6b0*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d6b0*, lpNumberOfBytesWritten=0x299d864*=0x38c, lpOverlapped=0x0) returned 1 [0087.123] GetProcessHeap () returned 0xd20000 [0087.123] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4d6b0, Size=0x30) returned 0xd4d6b0 [0087.123] GetProcessHeap () returned 0xd20000 [0087.123] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0087.123] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0087.123] GetProcessHeap () returned 0xd20000 [0087.123] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8b0) returned 0xd4d6e8 [0087.123] ReadFile (in: hFile=0x230, lpBuffer=0xd4d6e8, nNumberOfBytesToRead=0x8b0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4d6e8*, lpNumberOfBytesRead=0x299d7e8*=0x8b0, lpOverlapped=0x0) returned 1 [0087.123] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0087.123] WriteFile (in: hFile=0x230, lpBuffer=0xd4d6e8*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4d6e8*, lpNumberOfBytesWritten=0x299d7e4*=0x8b0, lpOverlapped=0x0) returned 1 [0087.125] GetProcessHeap () returned 0xd20000 [0087.125] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4d6e8 | out: hHeap=0xd20000) returned 1 [0087.125] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0087.125] WriteFile (in: hFile=0x230, lpBuffer=0xd4d6b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d6b0*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0087.127] CloseHandle (hObject=0x230) returned 1 [0087.135] GetProcessHeap () returned 0xd20000 [0087.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd428a0 | out: hHeap=0xd20000) returned 1 [0087.135] GetProcessHeap () returned 0xd20000 [0087.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c250 | out: hHeap=0xd20000) returned 1 [0087.135] GetProcessHeap () returned 0xd20000 [0087.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0087.135] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png") returned="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" [0087.135] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png.[ponce.lorena@aol.com]" [0087.135] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\nonetworkconnectionhoverover.png.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0087.136] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\NoNetworkConnectionHoverOver.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0087.136] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0087.136] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" [0087.136] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_recover.html")) returned 0x20 [0087.136] GetProcessHeap () returned 0xd20000 [0087.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd34d68 | out: hHeap=0xd20000) returned 1 [0087.137] FindNextFileW (in: hFindFile=0xd49060, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea63c947, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x71e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pass.png", cAlternateFileName="")) returned 1 [0087.137] lstrcmpiW (lpString1="pass.png", lpString2=".") returned 1 [0087.137] lstrcmpiW (lpString1="pass.png", lpString2="..") returned 1 [0087.137] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="pass.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\pass.png") returned="C:\\Windows10Upgrade\\resources\\ux\\pass.png" [0087.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pass.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0087.137] GetProcessHeap () returned 0xd20000 [0087.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x9) returned 0xd446f0 [0087.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pass.png", cchWideChar=-1, lpMultiByteStr=0xd446f0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pass.png", lpUsedDefaultChar=0x0) returned 9 [0087.137] lstrlenA (lpString="pass.png") returned 8 [0087.137] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0087.137] lstrlenA (lpString="pass.png") returned 8 [0087.137] lstrlenA (lpString=".dll") returned 4 [0087.137] lstrlenA (lpString=".dll") returned 4 [0087.137] lstrlenA (lpString="pass.png") returned 8 [0087.137] lstrcmpiA (lpString1=".png", lpString2=".dll") returned 1 [0087.137] lstrlenA (lpString="pass.png") returned 8 [0087.137] lstrlenA (lpString=".ini") returned 4 [0087.137] lstrlenA (lpString=".ini") returned 4 [0087.138] lstrlenA (lpString="pass.png") returned 8 [0087.138] lstrcmpiA (lpString1=".png", lpString2=".ini") returned 1 [0087.138] lstrlenA (lpString="pass.png") returned 8 [0087.138] lstrlenA (lpString=".inc") returned 4 [0087.138] lstrlenA (lpString=".inc") returned 4 [0087.138] lstrlenA (lpString="pass.png") returned 8 [0087.138] lstrcmpiA (lpString1=".png", lpString2=".inc") returned 1 [0087.138] lstrcmpiW (lpString1="pass.png", lpString2="HOW_RECOVER.html") returned 1 [0087.138] lstrcmpiW (lpString1="pass.png", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0087.138] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0087.138] lstrcmpiW (lpString1="pass.png", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0087.138] GetProcessHeap () returned 0xd20000 [0087.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd426c0 [0087.138] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0087.139] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=1822) returned 1 [0087.139] GetProcessHeap () returned 0xd20000 [0087.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c0e8 [0087.139] GetProcessHeap () returned 0xd20000 [0087.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0087.139] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\pass.png") returned 41 [0087.139] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0087.139] GetProcessHeap () returned 0xd20000 [0087.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0087.139] GetProcessHeap () returned 0xd20000 [0087.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x382) returned 0xd4d6e8 [0087.139] lstrlenA (lpString="rsa_encrypt") returned 11 [0087.140] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0087.142] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0087.142] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0087.142] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0087.142] GetProcessHeap () returned 0xd20000 [0087.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0087.142] lstrlenA (lpString="010001") returned 6 [0087.142] GetProcessHeap () returned 0xd20000 [0087.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cdb8 [0087.142] GetProcessHeap () returned 0xd20000 [0087.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0087.142] GetProcessHeap () returned 0xd20000 [0087.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b7e8 [0087.143] GetProcessHeap () returned 0xd20000 [0087.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0087.143] GetProcessHeap () returned 0xd20000 [0087.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b128 [0087.143] GetProcessHeap () returned 0xd20000 [0087.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd450c8 [0087.143] GetProcessHeap () returned 0xd20000 [0087.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cbf8 [0087.143] GetProcessHeap () returned 0xd20000 [0087.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44c68 [0087.143] GetProcessHeap () returned 0xd20000 [0087.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0087.143] GetProcessHeap () returned 0xd20000 [0087.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0087.143] GetProcessHeap () returned 0xd20000 [0087.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0087.143] GetProcessHeap () returned 0xd20000 [0087.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44e98 [0087.144] GetProcessHeap () returned 0xd20000 [0087.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.144] GetProcessHeap () returned 0xd20000 [0087.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44498 [0087.144] GetProcessHeap () returned 0xd20000 [0087.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b878 [0087.144] GetProcessHeap () returned 0xd20000 [0087.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0087.144] GetProcessHeap () returned 0xd20000 [0087.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0087.144] GetProcessHeap () returned 0xd20000 [0087.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b878 | out: hHeap=0xd20000) returned 1 [0087.144] GetProcessHeap () returned 0xd20000 [0087.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.144] GetProcessHeap () returned 0xd20000 [0087.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444c8 [0087.144] GetProcessHeap () returned 0xd20000 [0087.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.144] GetProcessHeap () returned 0xd20000 [0087.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.145] GetProcessHeap () returned 0xd20000 [0087.145] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.145] GetProcessHeap () returned 0xd20000 [0087.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.145] GetProcessHeap () returned 0xd20000 [0087.145] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0087.145] GetProcessHeap () returned 0xd20000 [0087.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0087.145] GetProcessHeap () returned 0xd20000 [0087.145] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b758 [0087.145] GetProcessHeap () returned 0xd20000 [0087.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444c8 | out: hHeap=0xd20000) returned 1 [0087.145] GetProcessHeap () returned 0xd20000 [0087.145] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0087.145] GetProcessHeap () returned 0xd20000 [0087.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b758 | out: hHeap=0xd20000) returned 1 [0087.145] GetProcessHeap () returned 0xd20000 [0087.146] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.146] GetProcessHeap () returned 0xd20000 [0087.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.146] GetProcessHeap () returned 0xd20000 [0087.146] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.146] GetProcessHeap () returned 0xd20000 [0087.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.146] GetProcessHeap () returned 0xd20000 [0087.146] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.146] GetProcessHeap () returned 0xd20000 [0087.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.146] GetProcessHeap () returned 0xd20000 [0087.146] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0087.146] GetProcessHeap () returned 0xd20000 [0087.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0087.146] GetProcessHeap () returned 0xd20000 [0087.146] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0087.146] GetProcessHeap () returned 0xd20000 [0087.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0087.147] GetProcessHeap () returned 0xd20000 [0087.147] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0087.147] GetProcessHeap () returned 0xd20000 [0087.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0087.147] GetProcessHeap () returned 0xd20000 [0087.147] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.147] GetProcessHeap () returned 0xd20000 [0087.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.147] GetProcessHeap () returned 0xd20000 [0087.147] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0087.147] GetProcessHeap () returned 0xd20000 [0087.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0087.147] GetProcessHeap () returned 0xd20000 [0087.147] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0087.147] GetProcessHeap () returned 0xd20000 [0087.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0087.147] GetProcessHeap () returned 0xd20000 [0087.148] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0087.148] GetProcessHeap () returned 0xd20000 [0087.148] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0087.148] GetProcessHeap () returned 0xd20000 [0087.148] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0087.148] GetProcessHeap () returned 0xd20000 [0087.148] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0087.148] GetProcessHeap () returned 0xd20000 [0087.148] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0087.148] GetProcessHeap () returned 0xd20000 [0087.148] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0087.148] GetProcessHeap () returned 0xd20000 [0087.148] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.148] GetProcessHeap () returned 0xd20000 [0087.148] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.148] GetProcessHeap () returned 0xd20000 [0087.148] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0087.148] GetProcessHeap () returned 0xd20000 [0087.149] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0087.149] GetProcessHeap () returned 0xd20000 [0087.149] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.149] GetProcessHeap () returned 0xd20000 [0087.149] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.149] GetProcessHeap () returned 0xd20000 [0087.149] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.149] GetProcessHeap () returned 0xd20000 [0087.149] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.149] GetProcessHeap () returned 0xd20000 [0087.149] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.149] GetProcessHeap () returned 0xd20000 [0087.149] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.149] GetProcessHeap () returned 0xd20000 [0087.149] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.149] GetProcessHeap () returned 0xd20000 [0087.149] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.149] GetProcessHeap () returned 0xd20000 [0087.150] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0087.150] GetProcessHeap () returned 0xd20000 [0087.150] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0087.150] GetProcessHeap () returned 0xd20000 [0087.150] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.150] GetProcessHeap () returned 0xd20000 [0087.150] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.150] GetProcessHeap () returned 0xd20000 [0087.150] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0087.150] GetProcessHeap () returned 0xd20000 [0087.150] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0087.150] GetProcessHeap () returned 0xd20000 [0087.150] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.150] GetProcessHeap () returned 0xd20000 [0087.150] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.150] GetProcessHeap () returned 0xd20000 [0087.150] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0087.150] GetProcessHeap () returned 0xd20000 [0087.151] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0087.151] GetProcessHeap () returned 0xd20000 [0087.151] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.151] GetProcessHeap () returned 0xd20000 [0087.151] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.151] GetProcessHeap () returned 0xd20000 [0087.151] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.151] GetProcessHeap () returned 0xd20000 [0087.151] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.151] GetProcessHeap () returned 0xd20000 [0087.151] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.151] GetProcessHeap () returned 0xd20000 [0087.151] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.151] GetProcessHeap () returned 0xd20000 [0087.151] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0087.152] GetProcessHeap () returned 0xd20000 [0087.152] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0087.152] GetProcessHeap () returned 0xd20000 [0087.152] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.152] GetProcessHeap () returned 0xd20000 [0087.152] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.153] GetProcessHeap () returned 0xd20000 [0087.153] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0087.153] GetProcessHeap () returned 0xd20000 [0087.153] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0087.153] GetProcessHeap () returned 0xd20000 [0087.153] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0087.153] GetProcessHeap () returned 0xd20000 [0087.153] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0087.153] GetProcessHeap () returned 0xd20000 [0087.153] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.153] GetProcessHeap () returned 0xd20000 [0087.153] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.153] GetProcessHeap () returned 0xd20000 [0087.153] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.153] GetProcessHeap () returned 0xd20000 [0087.153] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.153] GetProcessHeap () returned 0xd20000 [0087.153] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0087.153] GetProcessHeap () returned 0xd20000 [0087.154] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0087.154] GetProcessHeap () returned 0xd20000 [0087.154] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.154] GetProcessHeap () returned 0xd20000 [0087.154] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.154] GetProcessHeap () returned 0xd20000 [0087.154] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.154] GetProcessHeap () returned 0xd20000 [0087.154] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.154] GetProcessHeap () returned 0xd20000 [0087.154] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.154] GetProcessHeap () returned 0xd20000 [0087.154] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.154] GetProcessHeap () returned 0xd20000 [0087.154] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0087.154] GetProcessHeap () returned 0xd20000 [0087.154] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0087.154] GetProcessHeap () returned 0xd20000 [0087.155] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.155] GetProcessHeap () returned 0xd20000 [0087.155] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.155] GetProcessHeap () returned 0xd20000 [0087.155] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0087.155] GetProcessHeap () returned 0xd20000 [0087.155] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0087.155] GetProcessHeap () returned 0xd20000 [0087.155] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.155] GetProcessHeap () returned 0xd20000 [0087.155] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.155] GetProcessHeap () returned 0xd20000 [0087.155] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.155] GetProcessHeap () returned 0xd20000 [0087.155] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.155] GetProcessHeap () returned 0xd20000 [0087.155] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.155] GetProcessHeap () returned 0xd20000 [0087.156] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.156] GetProcessHeap () returned 0xd20000 [0087.156] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.156] GetProcessHeap () returned 0xd20000 [0087.156] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.156] GetProcessHeap () returned 0xd20000 [0087.156] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0087.156] GetProcessHeap () returned 0xd20000 [0087.156] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0087.156] GetProcessHeap () returned 0xd20000 [0087.156] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0087.156] GetProcessHeap () returned 0xd20000 [0087.156] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0087.156] GetProcessHeap () returned 0xd20000 [0087.156] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0087.156] GetProcessHeap () returned 0xd20000 [0087.156] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0087.156] GetProcessHeap () returned 0xd20000 [0087.157] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.157] GetProcessHeap () returned 0xd20000 [0087.157] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.157] GetProcessHeap () returned 0xd20000 [0087.157] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.157] GetProcessHeap () returned 0xd20000 [0087.157] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.157] GetProcessHeap () returned 0xd20000 [0087.157] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0087.157] GetProcessHeap () returned 0xd20000 [0087.157] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0087.157] GetProcessHeap () returned 0xd20000 [0087.157] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.157] GetProcessHeap () returned 0xd20000 [0087.157] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.157] GetProcessHeap () returned 0xd20000 [0087.157] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0087.157] GetProcessHeap () returned 0xd20000 [0087.157] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0087.158] GetProcessHeap () returned 0xd20000 [0087.158] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0087.158] GetProcessHeap () returned 0xd20000 [0087.158] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0087.158] GetProcessHeap () returned 0xd20000 [0087.158] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.158] GetProcessHeap () returned 0xd20000 [0087.158] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.158] GetProcessHeap () returned 0xd20000 [0087.158] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0087.158] GetProcessHeap () returned 0xd20000 [0087.158] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0087.158] GetProcessHeap () returned 0xd20000 [0087.158] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.158] GetProcessHeap () returned 0xd20000 [0087.158] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.158] GetProcessHeap () returned 0xd20000 [0087.159] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.159] GetProcessHeap () returned 0xd20000 [0087.159] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.159] GetProcessHeap () returned 0xd20000 [0087.159] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.159] GetProcessHeap () returned 0xd20000 [0087.159] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.159] GetProcessHeap () returned 0xd20000 [0087.159] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.159] GetProcessHeap () returned 0xd20000 [0087.159] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.159] GetProcessHeap () returned 0xd20000 [0087.159] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.159] GetProcessHeap () returned 0xd20000 [0087.159] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.159] GetProcessHeap () returned 0xd20000 [0087.159] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.159] GetProcessHeap () returned 0xd20000 [0087.160] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.160] GetProcessHeap () returned 0xd20000 [0087.160] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.160] GetProcessHeap () returned 0xd20000 [0087.160] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.160] GetProcessHeap () returned 0xd20000 [0087.160] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.160] GetProcessHeap () returned 0xd20000 [0087.160] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.160] GetProcessHeap () returned 0xd20000 [0087.160] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0087.160] GetProcessHeap () returned 0xd20000 [0087.160] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0087.160] GetProcessHeap () returned 0xd20000 [0087.160] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.160] GetProcessHeap () returned 0xd20000 [0087.160] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.161] GetProcessHeap () returned 0xd20000 [0087.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0087.161] GetProcessHeap () returned 0xd20000 [0087.161] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0087.161] GetProcessHeap () returned 0xd20000 [0087.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.161] GetProcessHeap () returned 0xd20000 [0087.161] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.161] GetProcessHeap () returned 0xd20000 [0087.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.161] GetProcessHeap () returned 0xd20000 [0087.161] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.161] GetProcessHeap () returned 0xd20000 [0087.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.161] GetProcessHeap () returned 0xd20000 [0087.161] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.161] GetProcessHeap () returned 0xd20000 [0087.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0087.161] GetProcessHeap () returned 0xd20000 [0087.162] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0087.162] GetProcessHeap () returned 0xd20000 [0087.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.162] GetProcessHeap () returned 0xd20000 [0087.162] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.162] GetProcessHeap () returned 0xd20000 [0087.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.162] GetProcessHeap () returned 0xd20000 [0087.162] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.162] GetProcessHeap () returned 0xd20000 [0087.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.162] GetProcessHeap () returned 0xd20000 [0087.162] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.162] GetProcessHeap () returned 0xd20000 [0087.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.162] GetProcessHeap () returned 0xd20000 [0087.162] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.163] GetProcessHeap () returned 0xd20000 [0087.163] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.163] GetProcessHeap () returned 0xd20000 [0087.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.163] GetProcessHeap () returned 0xd20000 [0087.163] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.163] GetProcessHeap () returned 0xd20000 [0087.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.163] GetProcessHeap () returned 0xd20000 [0087.163] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0087.163] GetProcessHeap () returned 0xd20000 [0087.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0087.163] GetProcessHeap () returned 0xd20000 [0087.163] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.163] GetProcessHeap () returned 0xd20000 [0087.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.163] GetProcessHeap () returned 0xd20000 [0087.163] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0087.164] GetProcessHeap () returned 0xd20000 [0087.164] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0087.164] GetProcessHeap () returned 0xd20000 [0087.164] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.164] GetProcessHeap () returned 0xd20000 [0087.164] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.164] GetProcessHeap () returned 0xd20000 [0087.164] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.164] GetProcessHeap () returned 0xd20000 [0087.164] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.164] GetProcessHeap () returned 0xd20000 [0087.164] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.164] GetProcessHeap () returned 0xd20000 [0087.164] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.164] GetProcessHeap () returned 0xd20000 [0087.164] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.164] GetProcessHeap () returned 0xd20000 [0087.164] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.165] GetProcessHeap () returned 0xd20000 [0087.165] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0087.165] GetProcessHeap () returned 0xd20000 [0087.165] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0087.165] GetProcessHeap () returned 0xd20000 [0087.165] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.165] GetProcessHeap () returned 0xd20000 [0087.165] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.165] GetProcessHeap () returned 0xd20000 [0087.165] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.165] GetProcessHeap () returned 0xd20000 [0087.165] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.165] GetProcessHeap () returned 0xd20000 [0087.165] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0087.165] GetProcessHeap () returned 0xd20000 [0087.165] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0087.165] GetProcessHeap () returned 0xd20000 [0087.165] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0087.166] GetProcessHeap () returned 0xd20000 [0087.166] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0087.166] GetProcessHeap () returned 0xd20000 [0087.166] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44498 | out: hHeap=0xd20000) returned 1 [0087.166] GetProcessHeap () returned 0xd20000 [0087.166] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b128 | out: hHeap=0xd20000) returned 1 [0087.166] GetProcessHeap () returned 0xd20000 [0087.166] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0087.166] GetProcessHeap () returned 0xd20000 [0087.166] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0087.166] GetProcessHeap () returned 0xd20000 [0087.166] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0087.166] GetProcessHeap () returned 0xd20000 [0087.166] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0087.166] GetProcessHeap () returned 0xd20000 [0087.166] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0087.166] WriteFile (in: hFile=0x230, lpBuffer=0xd4d6e8*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d6e8*, lpNumberOfBytesWritten=0x299d864*=0x382, lpOverlapped=0x0) returned 1 [0087.185] GetProcessHeap () returned 0xd20000 [0087.185] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4d6e8, Size=0x30) returned 0xd4d6e8 [0087.185] GetProcessHeap () returned 0xd20000 [0087.185] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0087.186] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0087.186] GetProcessHeap () returned 0xd20000 [0087.186] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x720) returned 0xd4d720 [0087.186] ReadFile (in: hFile=0x230, lpBuffer=0xd4d720, nNumberOfBytesToRead=0x720, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4d720*, lpNumberOfBytesRead=0x299d7e8*=0x720, lpOverlapped=0x0) returned 1 [0087.186] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0087.186] WriteFile (in: hFile=0x230, lpBuffer=0xd4d720*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4d720*, lpNumberOfBytesWritten=0x299d7e4*=0x720, lpOverlapped=0x0) returned 1 [0087.188] GetProcessHeap () returned 0xd20000 [0087.188] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4d720 | out: hHeap=0xd20000) returned 1 [0087.188] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0087.188] WriteFile (in: hFile=0x230, lpBuffer=0xd4d6e8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d6e8*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0087.190] CloseHandle (hObject=0x230) returned 1 [0087.192] GetProcessHeap () returned 0xd20000 [0087.192] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd426c0 | out: hHeap=0xd20000) returned 1 [0087.192] GetProcessHeap () returned 0xd20000 [0087.192] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c0e8 | out: hHeap=0xd20000) returned 1 [0087.192] GetProcessHeap () returned 0xd20000 [0087.192] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0087.192] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\pass.png" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\pass.png") returned="C:\\Windows10Upgrade\\resources\\ux\\pass.png" [0087.192] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\pass.png", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\pass.png.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\pass.png.[ponce.lorena@aol.com]" [0087.192] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\pass.png.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\pass.png.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0087.610] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\pass.png" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux") returned 1 [0087.610] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\") returned="" [0087.610] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" [0087.610] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\how_recover.html")) returned 0x20 [0087.611] GetProcessHeap () returned 0xd20000 [0087.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446f0 | out: hHeap=0xd20000) returned 1 [0087.611] FindNextFileW (in: hFindFile=0xd49060, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea63c947, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea63c947, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x71e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pass.png", cAlternateFileName="")) returned 0 [0087.611] FindClose (in: hFindFile=0xd49060 | out: hFindFile=0xd49060) returned 1 [0087.611] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\" [0087.611] GetProcessHeap () returned 0xd20000 [0087.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f168 | out: hHeap=0xd20000) returned 1 [0087.611] GetProcessHeap () returned 0xd20000 [0087.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0087.611] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\") returned 49 [0087.611] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\*") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\*" [0087.611] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd49360 [0087.612] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0087.612] FindNextFileW (in: hFindFile=0xd49360, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.612] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0087.612] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0087.612] FindNextFileW (in: hFindFile=0xd49360, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0087.612] lstrcmpiW (lpString1="css", lpString2=".") returned 1 [0087.612] lstrcmpiW (lpString1="css", lpString2="..") returned 1 [0087.612] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\", lpString2="css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css" [0087.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="css", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0087.612] GetProcessHeap () returned 0xd20000 [0087.612] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4) returned 0xd3cc98 [0087.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="css", cchWideChar=-1, lpMultiByteStr=0xd3cc98, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="css", lpUsedDefaultChar=0x0) returned 4 [0087.612] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0087.612] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0087.612] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0087.612] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0087.612] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0087.612] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0087.612] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0087.612] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0087.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0087.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0087.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0087.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0087.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0087.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0087.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0087.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0087.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0087.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0087.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0087.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0087.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0087.613] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0087.614] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0087.614] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0087.614] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0087.614] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0087.614] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0087.614] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0087.614] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0087.614] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0087.614] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0087.614] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0087.614] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0087.614] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0087.614] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0087.614] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0087.614] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0087.615] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0087.615] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0087.615] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0087.615] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0087.615] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0087.615] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="css", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0087.615] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\" [0087.615] GetProcessHeap () returned 0xd20000 [0087.615] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cbc8 [0087.615] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\") returned 53 [0087.615] GetProcessHeap () returned 0xd20000 [0087.615] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x6c) returned 0xd4bcb0 [0087.615] lstrcpyW (in: lpString1=0xd4bcb0, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\" [0087.615] GetProcessHeap () returned 0xd20000 [0087.615] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.615] FindNextFileW (in: hFindFile=0xd49360, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea61ff59, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0087.615] lstrcmpiW (lpString1="js", lpString2=".") returned 1 [0087.615] lstrcmpiW (lpString1="js", lpString2="..") returned 1 [0087.615] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\", lpString2="js" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js" [0087.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="js", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0087.615] GetProcessHeap () returned 0xd20000 [0087.616] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x3) returned 0xd3cdb8 [0087.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="js", cchWideChar=-1, lpMultiByteStr=0xd3cdb8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="js", lpUsedDefaultChar=0x0) returned 3 [0087.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0087.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0087.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0087.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0087.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0087.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0087.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0087.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0087.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0087.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0087.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0087.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0087.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0087.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0087.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0087.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0087.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0087.616] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0087.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0087.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0087.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0087.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0087.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0087.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0087.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0087.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0087.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0087.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0087.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0087.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0087.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0087.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0087.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0087.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0087.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0087.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0087.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0087.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0087.617] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0087.618] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0087.618] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0087.618] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0087.618] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="js", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0087.618] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js", lpString2="\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\" [0087.618] GetProcessHeap () returned 0xd20000 [0087.618] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3ccf8 [0087.618] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\") returned 52 [0087.618] GetProcessHeap () returned 0xd20000 [0087.618] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x6a) returned 0xd4c070 [0087.618] lstrcpyW (in: lpString1=0xd4c070, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\" [0087.618] GetProcessHeap () returned 0xd20000 [0087.618] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0087.618] FindNextFileW (in: hFindFile=0xd49360, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea61ff59, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0087.618] FindClose (in: hFindFile=0xd49360 | out: hFindFile=0xd49360) returned 1 [0087.619] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\" [0087.619] GetProcessHeap () returned 0xd20000 [0087.619] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c070 | out: hHeap=0xd20000) returned 1 [0087.619] GetProcessHeap () returned 0xd20000 [0087.619] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0087.619] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\") returned 52 [0087.619] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\*") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\*" [0087.619] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea61ff59, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd48e20 [0087.620] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0087.620] FindNextFileW (in: hFindFile=0xd48e20, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea61ff59, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.620] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0087.620] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0087.620] FindNextFileW (in: hFindFile=0xd48e20, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61ff59, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1395c6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="base.js", cAlternateFileName="")) returned 1 [0087.620] lstrcmpiW (lpString1="base.js", lpString2=".") returned 1 [0087.620] lstrcmpiW (lpString1="base.js", lpString2="..") returned 1 [0087.621] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\", lpString2="base.js" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" [0087.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="base.js", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0087.621] GetProcessHeap () returned 0xd20000 [0087.621] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3ccf8 [0087.621] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="base.js", cchWideChar=-1, lpMultiByteStr=0xd3ccf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="base.js", lpUsedDefaultChar=0x0) returned 8 [0087.621] lstrlenA (lpString="base.js") returned 7 [0087.621] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0087.621] lstrlenA (lpString="base.js") returned 7 [0087.621] lstrlenA (lpString=".dll") returned 4 [0087.621] lstrlenA (lpString=".dll") returned 4 [0087.621] lstrlenA (lpString="base.js") returned 7 [0087.621] lstrcmpiA (lpString1="e.js", lpString2=".dll") returned 1 [0087.621] lstrlenA (lpString="base.js") returned 7 [0087.621] lstrlenA (lpString=".ini") returned 4 [0087.621] lstrlenA (lpString=".ini") returned 4 [0087.621] lstrlenA (lpString="base.js") returned 7 [0087.622] lstrcmpiA (lpString1="e.js", lpString2=".ini") returned 1 [0087.622] lstrlenA (lpString="base.js") returned 7 [0087.622] lstrlenA (lpString=".inc") returned 4 [0087.622] lstrlenA (lpString=".inc") returned 4 [0087.622] lstrlenA (lpString="base.js") returned 7 [0087.622] lstrcmpiA (lpString1="e.js", lpString2=".inc") returned 1 [0087.622] lstrcmpiW (lpString1="base.js", lpString2="HOW_RECOVER.html") returned -1 [0087.622] lstrcmpiW (lpString1="base.js", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0087.622] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0087.622] lstrcmpiW (lpString1="base.js", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0087.622] GetProcessHeap () returned 0xd20000 [0087.622] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42418 [0087.622] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0087.623] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=1283526) returned 1 [0087.623] GetProcessHeap () returned 0xd20000 [0087.623] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c160 [0087.623] GetProcessHeap () returned 0xd20000 [0087.623] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0087.623] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js") returned 59 [0087.624] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0087.624] GetProcessHeap () returned 0xd20000 [0087.624] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0087.624] GetProcessHeap () returned 0xd20000 [0087.624] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x38a) returned 0xd4d720 [0087.624] lstrlenA (lpString="rsa_encrypt") returned 11 [0087.624] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0087.627] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0087.627] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0087.627] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0087.627] GetProcessHeap () returned 0xd20000 [0087.627] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0087.627] lstrlenA (lpString="010001") returned 6 [0087.627] GetProcessHeap () returned 0xd20000 [0087.627] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cdb8 [0087.627] GetProcessHeap () returned 0xd20000 [0087.627] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0087.627] GetProcessHeap () returned 0xd20000 [0087.627] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ac18 [0087.628] GetProcessHeap () returned 0xd20000 [0087.628] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0087.628] GetProcessHeap () returned 0xd20000 [0087.628] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aca8 [0087.628] GetProcessHeap () returned 0xd20000 [0087.628] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd452f8 [0087.628] GetProcessHeap () returned 0xd20000 [0087.628] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc08 [0087.628] GetProcessHeap () returned 0xd20000 [0087.628] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0087.628] GetProcessHeap () returned 0xd20000 [0087.628] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0087.628] GetProcessHeap () returned 0xd20000 [0087.628] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0087.628] GetProcessHeap () returned 0xd20000 [0087.628] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0087.628] GetProcessHeap () returned 0xd20000 [0087.628] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44920 [0087.629] GetProcessHeap () returned 0xd20000 [0087.629] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.629] GetProcessHeap () returned 0xd20000 [0087.629] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44468 [0087.629] GetProcessHeap () returned 0xd20000 [0087.629] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b008 [0087.629] GetProcessHeap () returned 0xd20000 [0087.629] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0087.629] GetProcessHeap () returned 0xd20000 [0087.629] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0087.629] GetProcessHeap () returned 0xd20000 [0087.629] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b008 | out: hHeap=0xd20000) returned 1 [0087.629] GetProcessHeap () returned 0xd20000 [0087.630] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.630] GetProcessHeap () returned 0xd20000 [0087.630] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44648 [0087.630] GetProcessHeap () returned 0xd20000 [0087.630] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.630] GetProcessHeap () returned 0xd20000 [0087.630] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.630] GetProcessHeap () returned 0xd20000 [0087.630] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.630] GetProcessHeap () returned 0xd20000 [0087.630] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.630] GetProcessHeap () returned 0xd20000 [0087.630] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.630] GetProcessHeap () returned 0xd20000 [0087.630] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.630] GetProcessHeap () returned 0xd20000 [0087.630] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b248 [0087.631] GetProcessHeap () returned 0xd20000 [0087.631] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44648 | out: hHeap=0xd20000) returned 1 [0087.631] GetProcessHeap () returned 0xd20000 [0087.631] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0087.631] GetProcessHeap () returned 0xd20000 [0087.631] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b248 | out: hHeap=0xd20000) returned 1 [0087.631] GetProcessHeap () returned 0xd20000 [0087.631] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.631] GetProcessHeap () returned 0xd20000 [0087.631] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.631] GetProcessHeap () returned 0xd20000 [0087.631] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.631] GetProcessHeap () returned 0xd20000 [0087.631] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.631] GetProcessHeap () returned 0xd20000 [0087.631] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.631] GetProcessHeap () returned 0xd20000 [0087.631] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.632] GetProcessHeap () returned 0xd20000 [0087.632] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0087.632] GetProcessHeap () returned 0xd20000 [0087.632] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0087.632] GetProcessHeap () returned 0xd20000 [0087.632] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0087.632] GetProcessHeap () returned 0xd20000 [0087.632] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0087.632] GetProcessHeap () returned 0xd20000 [0087.632] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0087.632] GetProcessHeap () returned 0xd20000 [0087.632] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0087.632] GetProcessHeap () returned 0xd20000 [0087.632] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.632] GetProcessHeap () returned 0xd20000 [0087.632] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.632] GetProcessHeap () returned 0xd20000 [0087.632] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.633] GetProcessHeap () returned 0xd20000 [0087.633] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.633] GetProcessHeap () returned 0xd20000 [0087.633] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.633] GetProcessHeap () returned 0xd20000 [0087.633] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.633] GetProcessHeap () returned 0xd20000 [0087.633] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.633] GetProcessHeap () returned 0xd20000 [0087.633] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.633] GetProcessHeap () returned 0xd20000 [0087.633] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0087.633] GetProcessHeap () returned 0xd20000 [0087.633] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0087.633] GetProcessHeap () returned 0xd20000 [0087.633] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0087.633] GetProcessHeap () returned 0xd20000 [0087.633] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0087.634] GetProcessHeap () returned 0xd20000 [0087.634] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0087.634] GetProcessHeap () returned 0xd20000 [0087.634] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0087.634] GetProcessHeap () returned 0xd20000 [0087.634] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0087.634] GetProcessHeap () returned 0xd20000 [0087.634] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0087.634] GetProcessHeap () returned 0xd20000 [0087.634] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.634] GetProcessHeap () returned 0xd20000 [0087.634] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.634] GetProcessHeap () returned 0xd20000 [0087.634] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.634] GetProcessHeap () returned 0xd20000 [0087.634] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.634] GetProcessHeap () returned 0xd20000 [0087.634] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.634] GetProcessHeap () returned 0xd20000 [0087.635] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.635] GetProcessHeap () returned 0xd20000 [0087.635] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.635] GetProcessHeap () returned 0xd20000 [0087.635] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.635] GetProcessHeap () returned 0xd20000 [0087.635] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0087.635] GetProcessHeap () returned 0xd20000 [0087.635] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0087.635] GetProcessHeap () returned 0xd20000 [0087.635] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0087.635] GetProcessHeap () returned 0xd20000 [0087.635] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0087.635] GetProcessHeap () returned 0xd20000 [0087.635] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0087.635] GetProcessHeap () returned 0xd20000 [0087.635] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0087.636] GetProcessHeap () returned 0xd20000 [0087.636] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.636] GetProcessHeap () returned 0xd20000 [0087.636] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.636] GetProcessHeap () returned 0xd20000 [0087.636] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.636] GetProcessHeap () returned 0xd20000 [0087.636] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.636] GetProcessHeap () returned 0xd20000 [0087.636] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0087.636] GetProcessHeap () returned 0xd20000 [0087.636] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0087.636] GetProcessHeap () returned 0xd20000 [0087.636] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.636] GetProcessHeap () returned 0xd20000 [0087.637] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.637] GetProcessHeap () returned 0xd20000 [0087.637] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0087.637] GetProcessHeap () returned 0xd20000 [0087.637] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0087.637] GetProcessHeap () returned 0xd20000 [0087.637] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.637] GetProcessHeap () returned 0xd20000 [0087.638] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.638] GetProcessHeap () returned 0xd20000 [0087.638] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0087.638] GetProcessHeap () returned 0xd20000 [0087.638] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0087.638] GetProcessHeap () returned 0xd20000 [0087.638] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0087.638] GetProcessHeap () returned 0xd20000 [0087.638] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0087.638] GetProcessHeap () returned 0xd20000 [0087.638] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.638] GetProcessHeap () returned 0xd20000 [0087.638] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.638] GetProcessHeap () returned 0xd20000 [0087.638] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.638] GetProcessHeap () returned 0xd20000 [0087.638] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.638] GetProcessHeap () returned 0xd20000 [0087.638] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.639] GetProcessHeap () returned 0xd20000 [0087.639] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.639] GetProcessHeap () returned 0xd20000 [0087.639] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0087.639] GetProcessHeap () returned 0xd20000 [0087.639] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0087.639] GetProcessHeap () returned 0xd20000 [0087.639] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.639] GetProcessHeap () returned 0xd20000 [0087.639] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.639] GetProcessHeap () returned 0xd20000 [0087.639] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.639] GetProcessHeap () returned 0xd20000 [0087.639] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.639] GetProcessHeap () returned 0xd20000 [0087.639] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.639] GetProcessHeap () returned 0xd20000 [0087.640] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.640] GetProcessHeap () returned 0xd20000 [0087.640] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0087.640] GetProcessHeap () returned 0xd20000 [0087.640] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0087.640] GetProcessHeap () returned 0xd20000 [0087.640] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.640] GetProcessHeap () returned 0xd20000 [0087.640] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.640] GetProcessHeap () returned 0xd20000 [0087.640] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.640] GetProcessHeap () returned 0xd20000 [0087.640] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.640] GetProcessHeap () returned 0xd20000 [0087.640] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0087.640] GetProcessHeap () returned 0xd20000 [0087.640] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0087.640] GetProcessHeap () returned 0xd20000 [0087.640] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.640] GetProcessHeap () returned 0xd20000 [0087.641] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.641] GetProcessHeap () returned 0xd20000 [0087.641] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.641] GetProcessHeap () returned 0xd20000 [0087.641] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.641] GetProcessHeap () returned 0xd20000 [0087.641] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0087.641] GetProcessHeap () returned 0xd20000 [0087.641] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0087.641] GetProcessHeap () returned 0xd20000 [0087.641] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.641] GetProcessHeap () returned 0xd20000 [0087.641] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.641] GetProcessHeap () returned 0xd20000 [0087.641] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.641] GetProcessHeap () returned 0xd20000 [0087.641] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.641] GetProcessHeap () returned 0xd20000 [0087.641] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.641] GetProcessHeap () returned 0xd20000 [0087.641] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.641] GetProcessHeap () returned 0xd20000 [0087.641] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.642] GetProcessHeap () returned 0xd20000 [0087.642] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.642] GetProcessHeap () returned 0xd20000 [0087.642] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.642] GetProcessHeap () returned 0xd20000 [0087.642] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.642] GetProcessHeap () returned 0xd20000 [0087.642] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.642] GetProcessHeap () returned 0xd20000 [0087.642] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.642] GetProcessHeap () returned 0xd20000 [0087.642] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0087.642] GetProcessHeap () returned 0xd20000 [0087.642] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0087.642] GetProcessHeap () returned 0xd20000 [0087.642] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.642] GetProcessHeap () returned 0xd20000 [0087.642] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.642] GetProcessHeap () returned 0xd20000 [0087.642] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.642] GetProcessHeap () returned 0xd20000 [0087.643] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.643] GetProcessHeap () returned 0xd20000 [0087.643] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.643] GetProcessHeap () returned 0xd20000 [0087.643] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.643] GetProcessHeap () returned 0xd20000 [0087.643] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.643] GetProcessHeap () returned 0xd20000 [0087.643] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.643] GetProcessHeap () returned 0xd20000 [0087.643] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.643] GetProcessHeap () returned 0xd20000 [0087.643] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.643] GetProcessHeap () returned 0xd20000 [0087.643] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.643] GetProcessHeap () returned 0xd20000 [0087.643] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.643] GetProcessHeap () returned 0xd20000 [0087.643] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0087.643] GetProcessHeap () returned 0xd20000 [0087.643] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0087.644] GetProcessHeap () returned 0xd20000 [0087.644] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.644] GetProcessHeap () returned 0xd20000 [0087.644] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.644] GetProcessHeap () returned 0xd20000 [0087.644] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.644] GetProcessHeap () returned 0xd20000 [0087.644] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.644] GetProcessHeap () returned 0xd20000 [0087.644] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.644] GetProcessHeap () returned 0xd20000 [0087.644] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.644] GetProcessHeap () returned 0xd20000 [0087.644] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0087.644] GetProcessHeap () returned 0xd20000 [0087.644] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0087.644] GetProcessHeap () returned 0xd20000 [0087.644] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.644] GetProcessHeap () returned 0xd20000 [0087.644] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.644] GetProcessHeap () returned 0xd20000 [0087.734] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.734] GetProcessHeap () returned 0xd20000 [0087.734] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.734] GetProcessHeap () returned 0xd20000 [0087.734] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.734] GetProcessHeap () returned 0xd20000 [0087.734] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.734] GetProcessHeap () returned 0xd20000 [0087.734] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0087.734] GetProcessHeap () returned 0xd20000 [0087.734] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0087.734] GetProcessHeap () returned 0xd20000 [0087.734] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0087.734] GetProcessHeap () returned 0xd20000 [0087.735] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0087.735] GetProcessHeap () returned 0xd20000 [0087.735] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.735] GetProcessHeap () returned 0xd20000 [0087.735] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.735] GetProcessHeap () returned 0xd20000 [0087.735] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.735] GetProcessHeap () returned 0xd20000 [0087.735] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.735] GetProcessHeap () returned 0xd20000 [0087.735] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0087.735] GetProcessHeap () returned 0xd20000 [0087.735] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0087.735] GetProcessHeap () returned 0xd20000 [0087.735] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.735] GetProcessHeap () returned 0xd20000 [0087.735] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.735] GetProcessHeap () returned 0xd20000 [0087.735] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0087.736] GetProcessHeap () returned 0xd20000 [0087.736] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0087.736] GetProcessHeap () returned 0xd20000 [0087.736] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.736] GetProcessHeap () returned 0xd20000 [0087.736] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.736] GetProcessHeap () returned 0xd20000 [0087.736] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.736] GetProcessHeap () returned 0xd20000 [0087.736] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.736] GetProcessHeap () returned 0xd20000 [0087.736] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.736] GetProcessHeap () returned 0xd20000 [0087.736] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.736] GetProcessHeap () returned 0xd20000 [0087.736] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.736] GetProcessHeap () returned 0xd20000 [0087.736] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.736] GetProcessHeap () returned 0xd20000 [0087.737] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0087.737] GetProcessHeap () returned 0xd20000 [0087.737] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0087.737] GetProcessHeap () returned 0xd20000 [0087.737] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.737] GetProcessHeap () returned 0xd20000 [0087.737] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.737] GetProcessHeap () returned 0xd20000 [0087.737] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.737] GetProcessHeap () returned 0xd20000 [0087.737] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.737] GetProcessHeap () returned 0xd20000 [0087.737] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.737] GetProcessHeap () returned 0xd20000 [0087.737] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.737] GetProcessHeap () returned 0xd20000 [0087.737] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.737] GetProcessHeap () returned 0xd20000 [0087.737] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.738] GetProcessHeap () returned 0xd20000 [0087.738] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0087.738] GetProcessHeap () returned 0xd20000 [0087.738] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0087.738] GetProcessHeap () returned 0xd20000 [0087.738] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0087.738] GetProcessHeap () returned 0xd20000 [0087.738] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0087.738] GetProcessHeap () returned 0xd20000 [0087.738] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.738] GetProcessHeap () returned 0xd20000 [0087.738] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.738] GetProcessHeap () returned 0xd20000 [0087.738] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0087.738] GetProcessHeap () returned 0xd20000 [0087.738] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0087.738] GetProcessHeap () returned 0xd20000 [0087.739] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0087.739] GetProcessHeap () returned 0xd20000 [0087.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0087.739] GetProcessHeap () returned 0xd20000 [0087.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0087.739] GetProcessHeap () returned 0xd20000 [0087.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0087.739] GetProcessHeap () returned 0xd20000 [0087.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0087.739] GetProcessHeap () returned 0xd20000 [0087.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0087.739] GetProcessHeap () returned 0xd20000 [0087.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44468 | out: hHeap=0xd20000) returned 1 [0087.739] GetProcessHeap () returned 0xd20000 [0087.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aca8 | out: hHeap=0xd20000) returned 1 [0087.739] GetProcessHeap () returned 0xd20000 [0087.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0087.739] GetProcessHeap () returned 0xd20000 [0087.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ac18 | out: hHeap=0xd20000) returned 1 [0087.740] GetProcessHeap () returned 0xd20000 [0087.740] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0087.740] GetProcessHeap () returned 0xd20000 [0087.740] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0087.740] GetProcessHeap () returned 0xd20000 [0087.740] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0087.740] WriteFile (in: hFile=0x230, lpBuffer=0xd4d720*, nNumberOfBytesToWrite=0x38a, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d720*, lpNumberOfBytesWritten=0x299d864*=0x38a, lpOverlapped=0x0) returned 1 [0087.844] GetProcessHeap () returned 0xd20000 [0087.844] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4d720, Size=0x30) returned 0xd4d720 [0087.844] GetProcessHeap () returned 0xd20000 [0087.844] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0087.844] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0087.845] GetProcessHeap () returned 0xd20000 [0087.845] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1395d0) returned 0x2d52020 [0087.870] ReadFile (in: hFile=0x230, lpBuffer=0x2d52020, nNumberOfBytesToRead=0x1395d0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x2d52020*, lpNumberOfBytesRead=0x299d7e8*=0x1395d0, lpOverlapped=0x0) returned 1 [0088.043] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0088.044] WriteFile (in: hFile=0x230, lpBuffer=0x2d52020*, nNumberOfBytesToWrite=0x1395d0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0x2d52020*, lpNumberOfBytesWritten=0x299d7e4*=0x1395d0, lpOverlapped=0x0) returned 1 [0088.725] GetProcessHeap () returned 0xd20000 [0088.725] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0x2d52020 | out: hHeap=0xd20000) returned 1 [0088.726] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0088.726] WriteFile (in: hFile=0x230, lpBuffer=0xd4d720*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d720*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0088.728] CloseHandle (hObject=0x230) returned 1 [0088.842] GetProcessHeap () returned 0xd20000 [0088.842] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42418 | out: hHeap=0xd20000) returned 1 [0088.842] GetProcessHeap () returned 0xd20000 [0088.842] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c160 | out: hHeap=0xd20000) returned 1 [0088.842] GetProcessHeap () returned 0xd20000 [0088.843] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0088.843] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" [0088.843] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js.[ponce.lorena@aol.com]" [0088.843] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\base.js.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0088.846] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\base.js" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js") returned 1 [0088.846] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\") returned="" [0088.846] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\HOW_RECOVER.html" [0088.846] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\how_recover.html")) returned 0xffffffff [0088.846] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\how_recover.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0088.847] GetProcessHeap () returned 0xd20000 [0088.847] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bff8 [0088.847] GetProcessHeap () returned 0xd20000 [0088.847] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0088.867] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.869] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.869] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.870] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.870] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.870] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.870] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.870] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.870] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.870] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.871] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.871] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.871] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.871] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.871] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.872] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.872] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.872] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.872] GetProcessHeap () returned 0xd20000 [0088.872] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bff8 | out: hHeap=0xd20000) returned 1 [0088.872] GetProcessHeap () returned 0xd20000 [0088.872] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0088.872] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x299d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x299d9d0*=0x300, lpOverlapped=0x0) returned 1 [0088.873] GetProcessHeap () returned 0xd20000 [0088.873] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bf08 [0088.874] GetProcessHeap () returned 0xd20000 [0088.874] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0088.884] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.884] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.884] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.884] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.884] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.885] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.885] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.885] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.885] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.885] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.885] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.885] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.885] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.886] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.886] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.886] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.886] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.886] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.886] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.886] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.886] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.887] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.887] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.887] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.887] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.887] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.964] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.965] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.965] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.965] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.966] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.966] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.966] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.966] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.966] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.966] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.966] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.966] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.967] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.967] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.967] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.967] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.967] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.967] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.967] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.968] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.968] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.968] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.968] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.968] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.968] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.968] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.968] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.969] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.969] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.969] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.969] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.970] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.970] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.970] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.970] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.970] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.970] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.970] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.970] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.971] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.971] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.971] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.971] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.971] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.971] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.971] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.971] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.972] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.972] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.972] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.972] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.972] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.972] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.972] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.973] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.973] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.974] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.974] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.974] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.975] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.975] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.975] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.975] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.975] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.975] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.975] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.976] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.976] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.976] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.976] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.976] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.976] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.976] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.976] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.977] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.977] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.977] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.977] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.977] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.977] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.977] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.977] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.978] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.978] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0088.978] GetProcessHeap () returned 0xd20000 [0088.978] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bf08 | out: hHeap=0xd20000) returned 1 [0088.978] GetProcessHeap () returned 0xd20000 [0088.978] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0088.979] CloseHandle (hObject=0x230) returned 1 [0088.982] GetProcessHeap () returned 0xd20000 [0088.982] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0088.985] FindNextFileW (in: hFindFile=0xd48e20, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61ff59, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x2e7dba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ui.js", cAlternateFileName="")) returned 1 [0088.985] lstrcmpiW (lpString1="ui.js", lpString2=".") returned 1 [0088.985] lstrcmpiW (lpString1="ui.js", lpString2="..") returned 1 [0088.985] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\", lpString2="ui.js" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" [0088.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ui.js", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0088.985] GetProcessHeap () returned 0xd20000 [0088.986] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x6) returned 0xd3cd98 [0088.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ui.js", cchWideChar=-1, lpMultiByteStr=0xd3cd98, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ui.js", lpUsedDefaultChar=0x0) returned 6 [0088.986] lstrlenA (lpString="ui.js") returned 5 [0088.986] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0088.986] lstrlenA (lpString="ui.js") returned 5 [0088.986] lstrlenA (lpString=".dll") returned 4 [0088.986] lstrlenA (lpString=".dll") returned 4 [0088.987] lstrlenA (lpString="ui.js") returned 5 [0088.987] lstrcmpiA (lpString1="i.js", lpString2=".dll") returned 1 [0088.987] lstrlenA (lpString="ui.js") returned 5 [0088.987] lstrlenA (lpString=".ini") returned 4 [0088.987] lstrlenA (lpString=".ini") returned 4 [0088.987] lstrlenA (lpString="ui.js") returned 5 [0088.987] lstrcmpiA (lpString1="i.js", lpString2=".ini") returned 1 [0088.987] lstrlenA (lpString="ui.js") returned 5 [0088.987] lstrlenA (lpString=".inc") returned 4 [0088.987] lstrlenA (lpString=".inc") returned 4 [0088.987] lstrlenA (lpString="ui.js") returned 5 [0088.987] lstrcmpiA (lpString1="i.js", lpString2=".inc") returned 1 [0088.988] lstrcmpiW (lpString1="ui.js", lpString2="HOW_RECOVER.html") returned 1 [0088.988] lstrcmpiW (lpString1="ui.js", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0088.988] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0088.988] lstrcmpiW (lpString1="ui.js", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0088.988] GetProcessHeap () returned 0xd20000 [0088.988] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd428a0 [0088.989] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\ui.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0088.992] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=3046842) returned 1 [0088.992] GetProcessHeap () returned 0xd20000 [0088.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bf08 [0088.992] GetProcessHeap () returned 0xd20000 [0088.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0088.993] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js") returned 57 [0088.993] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0088.993] GetProcessHeap () returned 0xd20000 [0088.993] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0088.994] GetProcessHeap () returned 0xd20000 [0088.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4d758 [0088.994] lstrlenA (lpString="rsa_encrypt") returned 11 [0088.994] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0088.999] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0088.999] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0088.999] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0088.999] GetProcessHeap () returned 0xd20000 [0088.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0088.999] lstrlenA (lpString="010001") returned 6 [0088.999] GetProcessHeap () returned 0xd20000 [0088.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc18 [0088.999] GetProcessHeap () returned 0xd20000 [0089.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0089.000] GetProcessHeap () returned 0xd20000 [0089.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4a948 [0089.000] GetProcessHeap () returned 0xd20000 [0089.000] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0089.000] GetProcessHeap () returned 0xd20000 [0089.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4af78 [0089.000] GetProcessHeap () returned 0xd20000 [0089.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44a38 [0089.000] GetProcessHeap () returned 0xd20000 [0089.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc38 [0089.000] GetProcessHeap () returned 0xd20000 [0089.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0089.000] GetProcessHeap () returned 0xd20000 [0089.000] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0089.000] GetProcessHeap () returned 0xd20000 [0089.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0089.000] GetProcessHeap () returned 0xd20000 [0089.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0089.001] GetProcessHeap () returned 0xd20000 [0089.001] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44d80 [0089.001] GetProcessHeap () returned 0xd20000 [0089.001] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0089.001] GetProcessHeap () returned 0xd20000 [0089.001] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44438 [0089.001] GetProcessHeap () returned 0xd20000 [0089.001] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aee8 [0089.001] GetProcessHeap () returned 0xd20000 [0089.001] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0089.001] GetProcessHeap () returned 0xd20000 [0089.001] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0089.001] GetProcessHeap () returned 0xd20000 [0089.001] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aee8 | out: hHeap=0xd20000) returned 1 [0089.001] GetProcessHeap () returned 0xd20000 [0089.001] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0089.002] GetProcessHeap () returned 0xd20000 [0089.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44588 [0089.002] GetProcessHeap () returned 0xd20000 [0089.002] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0089.002] GetProcessHeap () returned 0xd20000 [0089.002] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0089.002] GetProcessHeap () returned 0xd20000 [0089.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0089.002] GetProcessHeap () returned 0xd20000 [0089.002] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0089.002] GetProcessHeap () returned 0xd20000 [0089.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0089.002] GetProcessHeap () returned 0xd20000 [0089.002] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0089.002] GetProcessHeap () returned 0xd20000 [0089.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b878 [0089.002] GetProcessHeap () returned 0xd20000 [0089.002] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44588 | out: hHeap=0xd20000) returned 1 [0089.002] GetProcessHeap () returned 0xd20000 [0089.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0089.002] GetProcessHeap () returned 0xd20000 [0089.003] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b878 | out: hHeap=0xd20000) returned 1 [0089.003] GetProcessHeap () returned 0xd20000 [0089.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0089.003] GetProcessHeap () returned 0xd20000 [0089.003] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0089.003] GetProcessHeap () returned 0xd20000 [0089.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0089.003] GetProcessHeap () returned 0xd20000 [0089.003] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0089.003] GetProcessHeap () returned 0xd20000 [0089.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0089.003] GetProcessHeap () returned 0xd20000 [0089.003] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0089.003] GetProcessHeap () returned 0xd20000 [0089.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0089.003] GetProcessHeap () returned 0xd20000 [0089.003] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0089.003] GetProcessHeap () returned 0xd20000 [0089.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0089.004] GetProcessHeap () returned 0xd20000 [0089.004] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0089.004] GetProcessHeap () returned 0xd20000 [0089.004] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0089.004] GetProcessHeap () returned 0xd20000 [0089.004] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0089.004] GetProcessHeap () returned 0xd20000 [0089.004] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0089.004] GetProcessHeap () returned 0xd20000 [0089.094] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0089.094] GetProcessHeap () returned 0xd20000 [0089.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0089.094] GetProcessHeap () returned 0xd20000 [0089.094] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0089.094] GetProcessHeap () returned 0xd20000 [0089.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0089.094] GetProcessHeap () returned 0xd20000 [0089.094] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0089.094] GetProcessHeap () returned 0xd20000 [0089.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0089.095] GetProcessHeap () returned 0xd20000 [0089.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0089.095] GetProcessHeap () returned 0xd20000 [0089.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0089.095] GetProcessHeap () returned 0xd20000 [0089.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0089.095] GetProcessHeap () returned 0xd20000 [0089.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0089.095] GetProcessHeap () returned 0xd20000 [0089.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0089.095] GetProcessHeap () returned 0xd20000 [0089.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0089.095] GetProcessHeap () returned 0xd20000 [0089.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0089.095] GetProcessHeap () returned 0xd20000 [0089.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0089.095] GetProcessHeap () returned 0xd20000 [0089.096] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0089.096] GetProcessHeap () returned 0xd20000 [0089.096] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0089.096] GetProcessHeap () returned 0xd20000 [0089.096] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0089.096] GetProcessHeap () returned 0xd20000 [0089.096] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0089.096] GetProcessHeap () returned 0xd20000 [0089.096] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0089.096] GetProcessHeap () returned 0xd20000 [0089.096] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0089.096] GetProcessHeap () returned 0xd20000 [0089.096] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0089.096] GetProcessHeap () returned 0xd20000 [0089.096] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0089.096] GetProcessHeap () returned 0xd20000 [0089.096] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0089.096] GetProcessHeap () returned 0xd20000 [0089.096] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0089.097] GetProcessHeap () returned 0xd20000 [0089.097] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0089.097] GetProcessHeap () returned 0xd20000 [0089.097] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0089.097] GetProcessHeap () returned 0xd20000 [0089.097] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0089.097] GetProcessHeap () returned 0xd20000 [0089.097] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0089.097] GetProcessHeap () returned 0xd20000 [0089.097] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0089.097] GetProcessHeap () returned 0xd20000 [0089.097] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0089.097] GetProcessHeap () returned 0xd20000 [0089.097] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0089.097] GetProcessHeap () returned 0xd20000 [0089.097] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0089.097] GetProcessHeap () returned 0xd20000 [0089.097] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0089.098] GetProcessHeap () returned 0xd20000 [0089.098] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0089.098] GetProcessHeap () returned 0xd20000 [0089.098] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0089.098] GetProcessHeap () returned 0xd20000 [0089.098] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0089.098] GetProcessHeap () returned 0xd20000 [0089.098] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0089.098] GetProcessHeap () returned 0xd20000 [0089.098] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0089.098] GetProcessHeap () returned 0xd20000 [0089.098] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0089.098] GetProcessHeap () returned 0xd20000 [0089.098] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0089.098] GetProcessHeap () returned 0xd20000 [0089.098] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0089.098] GetProcessHeap () returned 0xd20000 [0089.098] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0089.099] GetProcessHeap () returned 0xd20000 [0089.099] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0089.099] GetProcessHeap () returned 0xd20000 [0089.099] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0089.099] GetProcessHeap () returned 0xd20000 [0089.099] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0089.099] GetProcessHeap () returned 0xd20000 [0089.099] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0089.099] GetProcessHeap () returned 0xd20000 [0089.099] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0089.099] GetProcessHeap () returned 0xd20000 [0089.099] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0089.099] GetProcessHeap () returned 0xd20000 [0089.099] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0089.099] GetProcessHeap () returned 0xd20000 [0089.099] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0089.100] GetProcessHeap () returned 0xd20000 [0089.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0089.100] GetProcessHeap () returned 0xd20000 [0089.100] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0089.100] GetProcessHeap () returned 0xd20000 [0089.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0089.100] GetProcessHeap () returned 0xd20000 [0089.100] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0089.100] GetProcessHeap () returned 0xd20000 [0089.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0089.100] GetProcessHeap () returned 0xd20000 [0089.100] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0089.100] GetProcessHeap () returned 0xd20000 [0089.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0089.101] GetProcessHeap () returned 0xd20000 [0089.101] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0089.101] GetProcessHeap () returned 0xd20000 [0089.101] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0089.101] GetProcessHeap () returned 0xd20000 [0089.101] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0089.101] GetProcessHeap () returned 0xd20000 [0089.101] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0089.101] GetProcessHeap () returned 0xd20000 [0089.101] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0089.101] GetProcessHeap () returned 0xd20000 [0089.101] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0089.101] GetProcessHeap () returned 0xd20000 [0089.101] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0089.101] GetProcessHeap () returned 0xd20000 [0089.101] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0089.101] GetProcessHeap () returned 0xd20000 [0089.101] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0089.102] GetProcessHeap () returned 0xd20000 [0089.102] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0089.102] GetProcessHeap () returned 0xd20000 [0089.102] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0089.102] GetProcessHeap () returned 0xd20000 [0089.102] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0089.102] GetProcessHeap () returned 0xd20000 [0089.102] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0089.102] GetProcessHeap () returned 0xd20000 [0089.102] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0089.102] GetProcessHeap () returned 0xd20000 [0089.102] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0089.102] GetProcessHeap () returned 0xd20000 [0089.102] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0089.102] GetProcessHeap () returned 0xd20000 [0089.102] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0089.102] GetProcessHeap () returned 0xd20000 [0089.102] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0089.103] GetProcessHeap () returned 0xd20000 [0089.103] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0089.103] GetProcessHeap () returned 0xd20000 [0089.103] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0089.103] GetProcessHeap () returned 0xd20000 [0089.103] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0089.103] GetProcessHeap () returned 0xd20000 [0089.103] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0089.103] GetProcessHeap () returned 0xd20000 [0089.103] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0089.103] GetProcessHeap () returned 0xd20000 [0089.103] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0089.103] GetProcessHeap () returned 0xd20000 [0089.103] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0089.103] GetProcessHeap () returned 0xd20000 [0089.103] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0089.104] GetProcessHeap () returned 0xd20000 [0089.104] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0089.104] GetProcessHeap () returned 0xd20000 [0089.104] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0089.104] GetProcessHeap () returned 0xd20000 [0089.104] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0089.104] GetProcessHeap () returned 0xd20000 [0089.104] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0089.104] GetProcessHeap () returned 0xd20000 [0089.104] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0089.104] GetProcessHeap () returned 0xd20000 [0089.104] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0089.104] GetProcessHeap () returned 0xd20000 [0089.104] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0089.104] GetProcessHeap () returned 0xd20000 [0089.104] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0089.105] GetProcessHeap () returned 0xd20000 [0089.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0089.105] GetProcessHeap () returned 0xd20000 [0089.105] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0089.105] GetProcessHeap () returned 0xd20000 [0089.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0089.105] GetProcessHeap () returned 0xd20000 [0089.105] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0089.105] GetProcessHeap () returned 0xd20000 [0089.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0089.105] GetProcessHeap () returned 0xd20000 [0089.105] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0089.105] GetProcessHeap () returned 0xd20000 [0089.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0089.105] GetProcessHeap () returned 0xd20000 [0089.105] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0089.105] GetProcessHeap () returned 0xd20000 [0089.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0089.106] GetProcessHeap () returned 0xd20000 [0089.106] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0089.106] GetProcessHeap () returned 0xd20000 [0089.106] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0089.106] GetProcessHeap () returned 0xd20000 [0089.106] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0089.106] GetProcessHeap () returned 0xd20000 [0089.106] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0089.106] GetProcessHeap () returned 0xd20000 [0089.106] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0089.106] GetProcessHeap () returned 0xd20000 [0089.106] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0089.106] GetProcessHeap () returned 0xd20000 [0089.106] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0089.106] GetProcessHeap () returned 0xd20000 [0089.106] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0089.106] GetProcessHeap () returned 0xd20000 [0089.106] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0089.106] GetProcessHeap () returned 0xd20000 [0089.107] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0089.107] GetProcessHeap () returned 0xd20000 [0089.107] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0089.107] GetProcessHeap () returned 0xd20000 [0089.107] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0089.107] GetProcessHeap () returned 0xd20000 [0089.107] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0089.107] GetProcessHeap () returned 0xd20000 [0089.107] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0089.107] GetProcessHeap () returned 0xd20000 [0089.107] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0089.107] GetProcessHeap () returned 0xd20000 [0089.107] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0089.107] GetProcessHeap () returned 0xd20000 [0089.109] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0089.109] GetProcessHeap () returned 0xd20000 [0089.109] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0089.109] GetProcessHeap () returned 0xd20000 [0089.109] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0089.109] GetProcessHeap () returned 0xd20000 [0089.109] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0089.109] GetProcessHeap () returned 0xd20000 [0089.109] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0089.109] GetProcessHeap () returned 0xd20000 [0089.109] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0089.109] GetProcessHeap () returned 0xd20000 [0089.109] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0089.110] GetProcessHeap () returned 0xd20000 [0089.110] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0089.110] GetProcessHeap () returned 0xd20000 [0089.110] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0089.110] GetProcessHeap () returned 0xd20000 [0089.110] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0089.110] GetProcessHeap () returned 0xd20000 [0089.110] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0089.110] GetProcessHeap () returned 0xd20000 [0089.110] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0089.110] GetProcessHeap () returned 0xd20000 [0089.110] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0089.110] GetProcessHeap () returned 0xd20000 [0089.110] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0089.110] GetProcessHeap () returned 0xd20000 [0089.110] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0089.110] GetProcessHeap () returned 0xd20000 [0089.111] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0089.111] GetProcessHeap () returned 0xd20000 [0089.111] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0089.111] GetProcessHeap () returned 0xd20000 [0089.111] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0089.111] GetProcessHeap () returned 0xd20000 [0089.111] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0089.111] GetProcessHeap () returned 0xd20000 [0089.111] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0089.111] GetProcessHeap () returned 0xd20000 [0089.111] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0089.111] GetProcessHeap () returned 0xd20000 [0089.111] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0089.111] GetProcessHeap () returned 0xd20000 [0089.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0089.112] GetProcessHeap () returned 0xd20000 [0089.112] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0089.112] GetProcessHeap () returned 0xd20000 [0089.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0089.112] GetProcessHeap () returned 0xd20000 [0089.112] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0089.112] GetProcessHeap () returned 0xd20000 [0089.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0089.112] GetProcessHeap () returned 0xd20000 [0089.112] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0089.112] GetProcessHeap () returned 0xd20000 [0089.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0089.112] GetProcessHeap () returned 0xd20000 [0089.112] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0089.112] GetProcessHeap () returned 0xd20000 [0089.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0089.112] GetProcessHeap () returned 0xd20000 [0089.112] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0089.113] GetProcessHeap () returned 0xd20000 [0089.113] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0089.113] GetProcessHeap () returned 0xd20000 [0089.113] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0089.113] GetProcessHeap () returned 0xd20000 [0089.113] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0089.113] GetProcessHeap () returned 0xd20000 [0089.113] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0089.113] GetProcessHeap () returned 0xd20000 [0089.113] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0089.113] GetProcessHeap () returned 0xd20000 [0089.113] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0089.113] GetProcessHeap () returned 0xd20000 [0089.113] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0089.113] GetProcessHeap () returned 0xd20000 [0089.113] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0089.113] GetProcessHeap () returned 0xd20000 [0089.113] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0089.113] GetProcessHeap () returned 0xd20000 [0089.114] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0089.114] GetProcessHeap () returned 0xd20000 [0089.114] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0089.114] GetProcessHeap () returned 0xd20000 [0089.114] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0089.114] GetProcessHeap () returned 0xd20000 [0089.114] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0089.114] GetProcessHeap () returned 0xd20000 [0089.114] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44438 | out: hHeap=0xd20000) returned 1 [0089.114] GetProcessHeap () returned 0xd20000 [0089.114] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4af78 | out: hHeap=0xd20000) returned 1 [0089.114] GetProcessHeap () returned 0xd20000 [0089.114] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0089.114] GetProcessHeap () returned 0xd20000 [0089.114] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a948 | out: hHeap=0xd20000) returned 1 [0089.114] GetProcessHeap () returned 0xd20000 [0089.114] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0089.115] GetProcessHeap () returned 0xd20000 [0089.115] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0089.115] GetProcessHeap () returned 0xd20000 [0089.115] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0089.115] WriteFile (in: hFile=0x230, lpBuffer=0xd4d758*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d758*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0089.126] GetProcessHeap () returned 0xd20000 [0089.126] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4d758, Size=0x30) returned 0xd4d758 [0089.126] GetProcessHeap () returned 0xd20000 [0089.126] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0089.126] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0089.126] GetProcessHeap () returned 0xd20000 [0089.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x2e7dba) returned 0x2d5c020 [0089.170] ReadFile (in: hFile=0x230, lpBuffer=0x2d5c020, nNumberOfBytesToRead=0x2e7dba, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x2d5c020*, lpNumberOfBytesRead=0x299d7e8*=0x2e7dba, lpOverlapped=0x0) returned 1 [0089.674] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0089.674] WriteFile (in: hFile=0x230, lpBuffer=0x2d5c020*, nNumberOfBytesToWrite=0x2e7dba, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0x2d5c020*, lpNumberOfBytesWritten=0x299d7e4*=0x2e7dba, lpOverlapped=0x0) returned 1 [0090.519] GetProcessHeap () returned 0xd20000 [0090.519] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0x2d5c020 | out: hHeap=0xd20000) returned 1 [0090.520] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0090.520] WriteFile (in: hFile=0x230, lpBuffer=0xd4d758*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d758*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0090.522] CloseHandle (hObject=0x230) returned 1 [0090.937] GetProcessHeap () returned 0xd20000 [0090.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd428a0 | out: hHeap=0xd20000) returned 1 [0090.937] GetProcessHeap () returned 0xd20000 [0090.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bf08 | out: hHeap=0xd20000) returned 1 [0090.937] GetProcessHeap () returned 0xd20000 [0090.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0090.938] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" [0090.938] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js.[ponce.lorena@aol.com]" [0090.938] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\ui.js"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\ui.js.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0090.942] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\ui.js" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js") returned 1 [0090.942] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\") returned="" [0090.942] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\HOW_RECOVER.html" [0090.942] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\js\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\js\\how_recover.html")) returned 0x20 [0090.942] GetProcessHeap () returned 0xd20000 [0090.942] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0090.942] FindNextFileW (in: hFindFile=0xd48e20, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61ff59, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea61ff59, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x2e7dba, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ui.js", cAlternateFileName="")) returned 0 [0090.943] FindClose (in: hFindFile=0xd48e20 | out: hFindFile=0xd48e20) returned 1 [0090.943] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\" [0090.943] GetProcessHeap () returned 0xd20000 [0090.943] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bcb0 | out: hHeap=0xd20000) returned 1 [0090.943] GetProcessHeap () returned 0xd20000 [0090.943] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0090.943] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\") returned 53 [0090.944] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\*") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\*" [0090.944] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd49360 [0090.944] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0090.944] FindNextFileW (in: hFindFile=0xd49360, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea6143a6, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.944] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0090.944] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0090.944] FindNextFileW (in: hFindFile=0xd49360, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea60a72c, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea60a72c, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x9ff9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="oobe-desktop.css", cAlternateFileName="OOBE-D~1.CSS")) returned 1 [0090.944] lstrcmpiW (lpString1="oobe-desktop.css", lpString2=".") returned 1 [0090.944] lstrcmpiW (lpString1="oobe-desktop.css", lpString2="..") returned 1 [0090.944] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\", lpString2="oobe-desktop.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" [0090.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe-desktop.css", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0090.945] GetProcessHeap () returned 0xd20000 [0090.945] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x11) returned 0xd36408 [0090.945] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="oobe-desktop.css", cchWideChar=-1, lpMultiByteStr=0xd36408, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="oobe-desktop.css", lpUsedDefaultChar=0x0) returned 17 [0090.945] lstrlenA (lpString="oobe-desktop.css") returned 16 [0090.945] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0090.945] lstrlenA (lpString="oobe-desktop.css") returned 16 [0090.945] lstrlenA (lpString=".dll") returned 4 [0090.945] lstrlenA (lpString=".dll") returned 4 [0090.945] lstrlenA (lpString="oobe-desktop.css") returned 16 [0090.945] lstrcmpiA (lpString1=".css", lpString2=".dll") returned -1 [0090.945] lstrlenA (lpString="oobe-desktop.css") returned 16 [0090.945] lstrlenA (lpString=".ini") returned 4 [0090.945] lstrlenA (lpString=".ini") returned 4 [0090.945] lstrlenA (lpString="oobe-desktop.css") returned 16 [0090.945] lstrcmpiA (lpString1=".css", lpString2=".ini") returned -1 [0090.945] lstrlenA (lpString="oobe-desktop.css") returned 16 [0090.946] lstrlenA (lpString=".inc") returned 4 [0090.946] lstrlenA (lpString=".inc") returned 4 [0090.946] lstrlenA (lpString="oobe-desktop.css") returned 16 [0090.946] lstrcmpiA (lpString1=".css", lpString2=".inc") returned -1 [0090.946] lstrcmpiW (lpString1="oobe-desktop.css", lpString2="HOW_RECOVER.html") returned 1 [0090.946] lstrcmpiW (lpString1="oobe-desktop.css", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0090.946] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0090.946] lstrcmpiW (lpString1="oobe-desktop.css", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0090.946] GetProcessHeap () returned 0xd20000 [0090.946] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42530 [0090.946] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\oobe-desktop.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0090.947] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=40953) returned 1 [0090.947] GetProcessHeap () returned 0xd20000 [0090.947] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bd28 [0090.947] GetProcessHeap () returned 0xd20000 [0090.947] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0090.947] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css") returned 69 [0090.947] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0090.947] GetProcessHeap () returned 0xd20000 [0090.947] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0090.947] GetProcessHeap () returned 0xd20000 [0090.947] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x387) returned 0xd4d790 [0090.948] lstrlenA (lpString="rsa_encrypt") returned 11 [0090.948] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0090.950] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0090.950] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0090.950] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0090.950] GetProcessHeap () returned 0xd20000 [0090.950] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0090.950] lstrlenA (lpString="010001") returned 6 [0090.950] GetProcessHeap () returned 0xd20000 [0090.951] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0090.951] GetProcessHeap () returned 0xd20000 [0090.951] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0090.951] GetProcessHeap () returned 0xd20000 [0090.951] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0090.951] GetProcessHeap () returned 0xd20000 [0090.951] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0090.951] GetProcessHeap () returned 0xd20000 [0090.951] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b6c8 [0090.951] GetProcessHeap () returned 0xd20000 [0090.952] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45528 [0090.952] GetProcessHeap () returned 0xd20000 [0090.952] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd28 [0090.952] GetProcessHeap () returned 0xd20000 [0090.952] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0090.952] GetProcessHeap () returned 0xd20000 [0090.952] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0090.952] GetProcessHeap () returned 0xd20000 [0090.952] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0090.952] GetProcessHeap () returned 0xd20000 [0090.952] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0090.952] GetProcessHeap () returned 0xd20000 [0090.952] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44fb0 [0090.952] GetProcessHeap () returned 0xd20000 [0090.953] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0090.953] GetProcessHeap () returned 0xd20000 [0090.953] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44468 [0090.953] GetProcessHeap () returned 0xd20000 [0090.953] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b7e8 [0090.953] GetProcessHeap () returned 0xd20000 [0090.953] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0090.953] GetProcessHeap () returned 0xd20000 [0090.953] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44c68 [0090.953] GetProcessHeap () returned 0xd20000 [0090.953] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0090.953] GetProcessHeap () returned 0xd20000 [0090.953] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0090.953] GetProcessHeap () returned 0xd20000 [0090.953] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44558 [0090.953] GetProcessHeap () returned 0xd20000 [0090.953] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0090.953] GetProcessHeap () returned 0xd20000 [0090.953] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0090.954] GetProcessHeap () returned 0xd20000 [0090.954] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0090.954] GetProcessHeap () returned 0xd20000 [0090.954] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0090.954] GetProcessHeap () returned 0xd20000 [0090.954] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0090.954] GetProcessHeap () returned 0xd20000 [0090.954] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0090.954] GetProcessHeap () returned 0xd20000 [0090.954] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4ad38 [0090.954] GetProcessHeap () returned 0xd20000 [0090.954] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44558 | out: hHeap=0xd20000) returned 1 [0090.954] GetProcessHeap () returned 0xd20000 [0090.954] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0090.954] GetProcessHeap () returned 0xd20000 [0090.954] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ad38 | out: hHeap=0xd20000) returned 1 [0090.954] GetProcessHeap () returned 0xd20000 [0090.954] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0090.954] GetProcessHeap () returned 0xd20000 [0090.955] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0090.955] GetProcessHeap () returned 0xd20000 [0090.955] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0090.955] GetProcessHeap () returned 0xd20000 [0090.955] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0090.955] GetProcessHeap () returned 0xd20000 [0090.955] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0090.955] GetProcessHeap () returned 0xd20000 [0090.955] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0090.955] GetProcessHeap () returned 0xd20000 [0090.955] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0090.955] GetProcessHeap () returned 0xd20000 [0090.955] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0090.955] GetProcessHeap () returned 0xd20000 [0090.955] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0090.955] GetProcessHeap () returned 0xd20000 [0090.955] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0090.955] GetProcessHeap () returned 0xd20000 [0090.955] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0090.955] GetProcessHeap () returned 0xd20000 [0090.956] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0090.956] GetProcessHeap () returned 0xd20000 [0090.956] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0090.956] GetProcessHeap () returned 0xd20000 [0090.956] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0090.956] GetProcessHeap () returned 0xd20000 [0090.956] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0090.956] GetProcessHeap () returned 0xd20000 [0090.956] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0090.956] GetProcessHeap () returned 0xd20000 [0090.956] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0090.956] GetProcessHeap () returned 0xd20000 [0090.956] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0090.956] GetProcessHeap () returned 0xd20000 [0090.956] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0090.956] GetProcessHeap () returned 0xd20000 [0090.956] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0090.956] GetProcessHeap () returned 0xd20000 [0090.956] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0090.957] GetProcessHeap () returned 0xd20000 [0090.957] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0090.957] GetProcessHeap () returned 0xd20000 [0090.957] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0090.957] GetProcessHeap () returned 0xd20000 [0090.957] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0090.957] GetProcessHeap () returned 0xd20000 [0090.957] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0090.957] GetProcessHeap () returned 0xd20000 [0090.957] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0090.957] GetProcessHeap () returned 0xd20000 [0090.957] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0090.957] GetProcessHeap () returned 0xd20000 [0090.957] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0090.957] GetProcessHeap () returned 0xd20000 [0090.957] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0090.957] GetProcessHeap () returned 0xd20000 [0090.957] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0090.957] GetProcessHeap () returned 0xd20000 [0090.958] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0090.958] GetProcessHeap () returned 0xd20000 [0090.958] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0090.958] GetProcessHeap () returned 0xd20000 [0090.958] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0090.958] GetProcessHeap () returned 0xd20000 [0090.958] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0090.958] GetProcessHeap () returned 0xd20000 [0090.958] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0090.958] GetProcessHeap () returned 0xd20000 [0090.958] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0090.958] GetProcessHeap () returned 0xd20000 [0090.958] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0090.958] GetProcessHeap () returned 0xd20000 [0090.958] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0090.958] GetProcessHeap () returned 0xd20000 [0090.958] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0090.958] GetProcessHeap () returned 0xd20000 [0090.958] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0090.959] GetProcessHeap () returned 0xd20000 [0090.959] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0090.959] GetProcessHeap () returned 0xd20000 [0090.959] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0090.959] GetProcessHeap () returned 0xd20000 [0090.959] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0090.959] GetProcessHeap () returned 0xd20000 [0090.959] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0090.959] GetProcessHeap () returned 0xd20000 [0090.959] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0090.959] GetProcessHeap () returned 0xd20000 [0090.959] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0090.959] GetProcessHeap () returned 0xd20000 [0090.959] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0090.959] GetProcessHeap () returned 0xd20000 [0090.959] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0090.959] GetProcessHeap () returned 0xd20000 [0090.959] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0090.960] GetProcessHeap () returned 0xd20000 [0090.960] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0090.960] GetProcessHeap () returned 0xd20000 [0090.960] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0090.960] GetProcessHeap () returned 0xd20000 [0090.960] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0090.960] GetProcessHeap () returned 0xd20000 [0090.960] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0090.960] GetProcessHeap () returned 0xd20000 [0090.960] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0090.960] GetProcessHeap () returned 0xd20000 [0090.960] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0090.960] GetProcessHeap () returned 0xd20000 [0090.960] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0090.960] GetProcessHeap () returned 0xd20000 [0090.960] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0090.960] GetProcessHeap () returned 0xd20000 [0090.960] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0090.960] GetProcessHeap () returned 0xd20000 [0090.961] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0090.961] GetProcessHeap () returned 0xd20000 [0090.961] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0090.961] GetProcessHeap () returned 0xd20000 [0090.961] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0090.961] GetProcessHeap () returned 0xd20000 [0090.961] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0090.961] GetProcessHeap () returned 0xd20000 [0090.961] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0090.961] GetProcessHeap () returned 0xd20000 [0090.961] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0090.961] GetProcessHeap () returned 0xd20000 [0090.961] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0090.961] GetProcessHeap () returned 0xd20000 [0090.961] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0090.961] GetProcessHeap () returned 0xd20000 [0090.961] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0090.961] GetProcessHeap () returned 0xd20000 [0090.961] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0090.962] GetProcessHeap () returned 0xd20000 [0090.962] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0090.962] GetProcessHeap () returned 0xd20000 [0090.962] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0090.962] GetProcessHeap () returned 0xd20000 [0090.962] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0090.962] GetProcessHeap () returned 0xd20000 [0090.962] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0090.962] GetProcessHeap () returned 0xd20000 [0090.962] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0090.962] GetProcessHeap () returned 0xd20000 [0090.962] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0090.962] GetProcessHeap () returned 0xd20000 [0090.962] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0090.962] GetProcessHeap () returned 0xd20000 [0090.962] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0090.962] GetProcessHeap () returned 0xd20000 [0090.962] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0090.962] GetProcessHeap () returned 0xd20000 [0090.963] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0090.963] GetProcessHeap () returned 0xd20000 [0090.963] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0090.963] GetProcessHeap () returned 0xd20000 [0090.963] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0090.963] GetProcessHeap () returned 0xd20000 [0090.963] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0090.963] GetProcessHeap () returned 0xd20000 [0090.963] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0090.963] GetProcessHeap () returned 0xd20000 [0090.963] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0090.963] GetProcessHeap () returned 0xd20000 [0090.963] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0090.963] GetProcessHeap () returned 0xd20000 [0090.963] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0090.963] GetProcessHeap () returned 0xd20000 [0090.963] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0090.963] GetProcessHeap () returned 0xd20000 [0090.963] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0090.963] GetProcessHeap () returned 0xd20000 [0090.964] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0090.964] GetProcessHeap () returned 0xd20000 [0090.964] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0090.964] GetProcessHeap () returned 0xd20000 [0090.964] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0090.964] GetProcessHeap () returned 0xd20000 [0090.964] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0090.964] GetProcessHeap () returned 0xd20000 [0090.964] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0090.964] GetProcessHeap () returned 0xd20000 [0090.964] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0090.964] GetProcessHeap () returned 0xd20000 [0090.964] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0090.964] GetProcessHeap () returned 0xd20000 [0090.964] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0090.964] GetProcessHeap () returned 0xd20000 [0090.964] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0090.964] GetProcessHeap () returned 0xd20000 [0090.964] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0090.965] GetProcessHeap () returned 0xd20000 [0090.965] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0090.965] GetProcessHeap () returned 0xd20000 [0090.965] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0090.965] GetProcessHeap () returned 0xd20000 [0090.965] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0090.965] GetProcessHeap () returned 0xd20000 [0090.965] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0090.965] GetProcessHeap () returned 0xd20000 [0090.965] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0090.965] GetProcessHeap () returned 0xd20000 [0090.965] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0090.965] GetProcessHeap () returned 0xd20000 [0090.965] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0090.965] GetProcessHeap () returned 0xd20000 [0090.965] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0090.965] GetProcessHeap () returned 0xd20000 [0090.966] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0090.966] GetProcessHeap () returned 0xd20000 [0090.966] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0090.966] GetProcessHeap () returned 0xd20000 [0090.966] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0090.966] GetProcessHeap () returned 0xd20000 [0090.966] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0090.966] GetProcessHeap () returned 0xd20000 [0090.966] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0090.966] GetProcessHeap () returned 0xd20000 [0090.966] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0090.966] GetProcessHeap () returned 0xd20000 [0090.966] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0090.966] GetProcessHeap () returned 0xd20000 [0090.966] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0090.966] GetProcessHeap () returned 0xd20000 [0090.966] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0090.966] GetProcessHeap () returned 0xd20000 [0090.966] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0090.966] GetProcessHeap () returned 0xd20000 [0090.967] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0090.967] GetProcessHeap () returned 0xd20000 [0090.967] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0090.967] GetProcessHeap () returned 0xd20000 [0090.967] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0090.967] GetProcessHeap () returned 0xd20000 [0090.967] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0090.967] GetProcessHeap () returned 0xd20000 [0090.967] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0090.967] GetProcessHeap () returned 0xd20000 [0090.967] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0090.967] GetProcessHeap () returned 0xd20000 [0090.967] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0090.967] GetProcessHeap () returned 0xd20000 [0090.967] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0090.967] GetProcessHeap () returned 0xd20000 [0090.967] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0090.967] GetProcessHeap () returned 0xd20000 [0090.968] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0090.968] GetProcessHeap () returned 0xd20000 [0090.968] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0090.968] GetProcessHeap () returned 0xd20000 [0090.968] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0090.968] GetProcessHeap () returned 0xd20000 [0090.968] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0090.968] GetProcessHeap () returned 0xd20000 [0090.968] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0090.968] GetProcessHeap () returned 0xd20000 [0090.968] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0090.968] GetProcessHeap () returned 0xd20000 [0090.968] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0090.968] GetProcessHeap () returned 0xd20000 [0090.968] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0090.968] GetProcessHeap () returned 0xd20000 [0090.968] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0090.968] GetProcessHeap () returned 0xd20000 [0090.968] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0090.968] GetProcessHeap () returned 0xd20000 [0090.969] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0090.969] GetProcessHeap () returned 0xd20000 [0090.969] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0090.969] GetProcessHeap () returned 0xd20000 [0090.969] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0090.969] GetProcessHeap () returned 0xd20000 [0090.969] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0090.969] GetProcessHeap () returned 0xd20000 [0090.969] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0090.969] GetProcessHeap () returned 0xd20000 [0090.969] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0090.969] GetProcessHeap () returned 0xd20000 [0090.969] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0090.969] GetProcessHeap () returned 0xd20000 [0090.969] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0090.969] GetProcessHeap () returned 0xd20000 [0090.969] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0090.969] GetProcessHeap () returned 0xd20000 [0090.969] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0090.969] GetProcessHeap () returned 0xd20000 [0090.970] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0090.970] GetProcessHeap () returned 0xd20000 [0090.970] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0090.970] GetProcessHeap () returned 0xd20000 [0090.970] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0090.970] GetProcessHeap () returned 0xd20000 [0090.970] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0090.970] GetProcessHeap () returned 0xd20000 [0090.970] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0090.970] GetProcessHeap () returned 0xd20000 [0090.970] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0090.970] GetProcessHeap () returned 0xd20000 [0090.970] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0090.970] GetProcessHeap () returned 0xd20000 [0090.970] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0090.970] GetProcessHeap () returned 0xd20000 [0090.970] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0090.970] GetProcessHeap () returned 0xd20000 [0090.970] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0090.970] GetProcessHeap () returned 0xd20000 [0090.970] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0090.971] GetProcessHeap () returned 0xd20000 [0090.971] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0090.971] GetProcessHeap () returned 0xd20000 [0090.971] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0090.971] GetProcessHeap () returned 0xd20000 [0090.971] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0090.971] GetProcessHeap () returned 0xd20000 [0090.971] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0090.971] GetProcessHeap () returned 0xd20000 [0090.971] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0090.971] GetProcessHeap () returned 0xd20000 [0090.971] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0090.971] GetProcessHeap () returned 0xd20000 [0090.971] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0090.971] GetProcessHeap () returned 0xd20000 [0090.971] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0090.971] GetProcessHeap () returned 0xd20000 [0090.971] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0090.971] GetProcessHeap () returned 0xd20000 [0090.972] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0090.972] GetProcessHeap () returned 0xd20000 [0090.972] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0090.972] GetProcessHeap () returned 0xd20000 [0090.972] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0090.972] GetProcessHeap () returned 0xd20000 [0090.972] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0090.972] GetProcessHeap () returned 0xd20000 [0090.972] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0090.972] GetProcessHeap () returned 0xd20000 [0090.972] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0090.972] GetProcessHeap () returned 0xd20000 [0090.972] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0090.972] GetProcessHeap () returned 0xd20000 [0090.972] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0090.972] GetProcessHeap () returned 0xd20000 [0090.972] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0090.972] GetProcessHeap () returned 0xd20000 [0090.972] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0090.972] GetProcessHeap () returned 0xd20000 [0090.972] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44468 | out: hHeap=0xd20000) returned 1 [0090.973] GetProcessHeap () returned 0xd20000 [0090.973] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b6c8 | out: hHeap=0xd20000) returned 1 [0090.973] GetProcessHeap () returned 0xd20000 [0090.973] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0090.973] GetProcessHeap () returned 0xd20000 [0090.973] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0090.973] GetProcessHeap () returned 0xd20000 [0090.973] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0090.973] GetProcessHeap () returned 0xd20000 [0090.973] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0090.973] GetProcessHeap () returned 0xd20000 [0090.973] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0090.973] WriteFile (in: hFile=0x230, lpBuffer=0xd4d790*, nNumberOfBytesToWrite=0x387, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d790*, lpNumberOfBytesWritten=0x299d864*=0x387, lpOverlapped=0x0) returned 1 [0090.979] GetProcessHeap () returned 0xd20000 [0090.979] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4d790, Size=0x30) returned 0xd4d790 [0090.979] GetProcessHeap () returned 0xd20000 [0090.979] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0090.979] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0090.980] GetProcessHeap () returned 0xd20000 [0090.980] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xa000) returned 0xd4d7c8 [0090.980] ReadFile (in: hFile=0x230, lpBuffer=0xd4d7c8, nNumberOfBytesToRead=0xa000, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4d7c8*, lpNumberOfBytesRead=0x299d7e8*=0xa000, lpOverlapped=0x0) returned 1 [0090.983] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0090.984] WriteFile (in: hFile=0x230, lpBuffer=0xd4d7c8*, nNumberOfBytesToWrite=0xa000, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4d7c8*, lpNumberOfBytesWritten=0x299d7e4*=0xa000, lpOverlapped=0x0) returned 1 [0090.989] GetProcessHeap () returned 0xd20000 [0090.989] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4d7c8 | out: hHeap=0xd20000) returned 1 [0090.989] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0090.989] WriteFile (in: hFile=0x230, lpBuffer=0xd4d790*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d790*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0090.991] CloseHandle (hObject=0x230) returned 1 [0090.994] GetProcessHeap () returned 0xd20000 [0090.994] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42530 | out: hHeap=0xd20000) returned 1 [0090.994] GetProcessHeap () returned 0xd20000 [0090.994] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bd28 | out: hHeap=0xd20000) returned 1 [0090.994] GetProcessHeap () returned 0xd20000 [0090.994] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0090.994] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" [0090.994] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css.[ponce.lorena@aol.com]" [0090.994] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\oobe-desktop.css"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\oobe-desktop.css.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0090.995] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\oobe-desktop.css" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css") returned 1 [0090.995] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\") returned="" [0090.995] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\HOW_RECOVER.html" [0090.995] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\how_recover.html")) returned 0xffffffff [0090.995] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\how_recover.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0090.996] GetProcessHeap () returned 0xd20000 [0090.996] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bbc0 [0090.996] GetProcessHeap () returned 0xd20000 [0090.996] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0091.004] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.006] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.006] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.006] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.007] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.007] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.007] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.007] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.007] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.007] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.007] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.008] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.008] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.008] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.008] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.008] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.008] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.008] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.009] GetProcessHeap () returned 0xd20000 [0091.009] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bbc0 | out: hHeap=0xd20000) returned 1 [0091.009] GetProcessHeap () returned 0xd20000 [0091.009] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0091.009] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x299d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x299d9d0*=0x300, lpOverlapped=0x0) returned 1 [0091.010] GetProcessHeap () returned 0xd20000 [0091.010] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bda0 [0091.010] GetProcessHeap () returned 0xd20000 [0091.010] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0091.019] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.019] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.020] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.020] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.020] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.020] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.020] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.020] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.020] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.021] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.021] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.021] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.021] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.022] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.022] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.022] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.022] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.022] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.022] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.022] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.022] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.023] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.023] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.023] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.023] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.023] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.023] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.023] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.023] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.023] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.024] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.024] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.024] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.024] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.024] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.024] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.024] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.024] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.025] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.025] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.025] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.025] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.025] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.025] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.025] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.026] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.026] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.026] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.026] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.026] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.026] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.026] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.026] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.026] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.027] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.027] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.027] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.027] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.027] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.027] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.027] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.027] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.028] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.028] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.028] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.028] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.028] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.028] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.028] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.028] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.028] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.029] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.029] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.029] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.029] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.113] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.113] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.113] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.113] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.113] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.113] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.113] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.114] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.114] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.114] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.114] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.114] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.114] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.114] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.115] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.115] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.115] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.115] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.115] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.115] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.115] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.115] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.116] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.116] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.116] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.116] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.116] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.116] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.116] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.116] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.117] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.117] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.117] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.117] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.117] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.118] GetProcessHeap () returned 0xd20000 [0091.118] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bda0 | out: hHeap=0xd20000) returned 1 [0091.118] GetProcessHeap () returned 0xd20000 [0091.118] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0091.118] CloseHandle (hObject=0x230) returned 1 [0091.118] GetProcessHeap () returned 0xd20000 [0091.118] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36408 | out: hHeap=0xd20000) returned 1 [0091.118] FindNextFileW (in: hFindFile=0xd49360, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x41b67, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ui-dark.css", cAlternateFileName="")) returned 1 [0091.118] lstrcmpiW (lpString1="ui-dark.css", lpString2=".") returned 1 [0091.118] lstrcmpiW (lpString1="ui-dark.css", lpString2="..") returned 1 [0091.119] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\", lpString2="ui-dark.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" [0091.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ui-dark.css", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0091.119] GetProcessHeap () returned 0xd20000 [0091.119] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd44510 [0091.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ui-dark.css", cchWideChar=-1, lpMultiByteStr=0xd44510, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ui-dark.css", lpUsedDefaultChar=0x0) returned 12 [0091.119] lstrlenA (lpString="ui-dark.css") returned 11 [0091.119] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0091.119] lstrlenA (lpString="ui-dark.css") returned 11 [0091.119] lstrlenA (lpString=".dll") returned 4 [0091.119] lstrlenA (lpString=".dll") returned 4 [0091.119] lstrlenA (lpString="ui-dark.css") returned 11 [0091.119] lstrcmpiA (lpString1=".css", lpString2=".dll") returned -1 [0091.119] lstrlenA (lpString="ui-dark.css") returned 11 [0091.119] lstrlenA (lpString=".ini") returned 4 [0091.119] lstrlenA (lpString=".ini") returned 4 [0091.119] lstrlenA (lpString="ui-dark.css") returned 11 [0091.119] lstrcmpiA (lpString1=".css", lpString2=".ini") returned -1 [0091.119] lstrlenA (lpString="ui-dark.css") returned 11 [0091.119] lstrlenA (lpString=".inc") returned 4 [0091.120] lstrlenA (lpString=".inc") returned 4 [0091.120] lstrlenA (lpString="ui-dark.css") returned 11 [0091.120] lstrcmpiA (lpString1=".css", lpString2=".inc") returned -1 [0091.120] lstrcmpiW (lpString1="ui-dark.css", lpString2="HOW_RECOVER.html") returned 1 [0091.120] lstrcmpiW (lpString1="ui-dark.css", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0091.120] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0091.120] lstrcmpiW (lpString1="ui-dark.css", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0091.120] GetProcessHeap () returned 0xd20000 [0091.120] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd425a8 [0091.120] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\ui-dark.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0091.121] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=269159) returned 1 [0091.121] GetProcessHeap () returned 0xd20000 [0091.121] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bcb0 [0091.121] GetProcessHeap () returned 0xd20000 [0091.121] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0091.121] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css") returned 64 [0091.121] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0091.121] GetProcessHeap () returned 0xd20000 [0091.121] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0091.121] GetProcessHeap () returned 0xd20000 [0091.121] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x389) returned 0xd4d7c8 [0091.121] lstrlenA (lpString="rsa_encrypt") returned 11 [0091.121] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0091.125] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0091.125] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0091.125] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0091.125] GetProcessHeap () returned 0xd20000 [0091.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0091.125] lstrlenA (lpString="010001") returned 6 [0091.125] GetProcessHeap () returned 0xd20000 [0091.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cdb8 [0091.125] GetProcessHeap () returned 0xd20000 [0091.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0091.125] GetProcessHeap () returned 0xd20000 [0091.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0091.126] GetProcessHeap () returned 0xd20000 [0091.126] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0091.126] GetProcessHeap () returned 0xd20000 [0091.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b7e8 [0091.126] GetProcessHeap () returned 0xd20000 [0091.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44fb0 [0091.126] GetProcessHeap () returned 0xd20000 [0091.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc08 [0091.126] GetProcessHeap () returned 0xd20000 [0091.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0091.126] GetProcessHeap () returned 0xd20000 [0091.126] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0091.126] GetProcessHeap () returned 0xd20000 [0091.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0091.126] GetProcessHeap () returned 0xd20000 [0091.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0091.126] GetProcessHeap () returned 0xd20000 [0091.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44c68 [0091.126] GetProcessHeap () returned 0xd20000 [0091.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.127] GetProcessHeap () returned 0xd20000 [0091.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44588 [0091.127] GetProcessHeap () returned 0xd20000 [0091.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ad38 [0091.127] GetProcessHeap () returned 0xd20000 [0091.127] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0091.127] GetProcessHeap () returned 0xd20000 [0091.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0091.127] GetProcessHeap () returned 0xd20000 [0091.127] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ad38 | out: hHeap=0xd20000) returned 1 [0091.127] GetProcessHeap () returned 0xd20000 [0091.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.127] GetProcessHeap () returned 0xd20000 [0091.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44678 [0091.127] GetProcessHeap () returned 0xd20000 [0091.127] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.127] GetProcessHeap () returned 0xd20000 [0091.127] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.127] GetProcessHeap () returned 0xd20000 [0091.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.128] GetProcessHeap () returned 0xd20000 [0091.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.128] GetProcessHeap () returned 0xd20000 [0091.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.128] GetProcessHeap () returned 0xd20000 [0091.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.128] GetProcessHeap () returned 0xd20000 [0091.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b128 [0091.128] GetProcessHeap () returned 0xd20000 [0091.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44678 | out: hHeap=0xd20000) returned 1 [0091.128] GetProcessHeap () returned 0xd20000 [0091.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0091.128] GetProcessHeap () returned 0xd20000 [0091.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b128 | out: hHeap=0xd20000) returned 1 [0091.128] GetProcessHeap () returned 0xd20000 [0091.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0091.128] GetProcessHeap () returned 0xd20000 [0091.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0091.128] GetProcessHeap () returned 0xd20000 [0091.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.129] GetProcessHeap () returned 0xd20000 [0091.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.129] GetProcessHeap () returned 0xd20000 [0091.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0091.129] GetProcessHeap () returned 0xd20000 [0091.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0091.129] GetProcessHeap () returned 0xd20000 [0091.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.129] GetProcessHeap () returned 0xd20000 [0091.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.129] GetProcessHeap () returned 0xd20000 [0091.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0091.129] GetProcessHeap () returned 0xd20000 [0091.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0091.129] GetProcessHeap () returned 0xd20000 [0091.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.129] GetProcessHeap () returned 0xd20000 [0091.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.129] GetProcessHeap () returned 0xd20000 [0091.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0091.130] GetProcessHeap () returned 0xd20000 [0091.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0091.130] GetProcessHeap () returned 0xd20000 [0091.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0091.130] GetProcessHeap () returned 0xd20000 [0091.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0091.130] GetProcessHeap () returned 0xd20000 [0091.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0091.130] GetProcessHeap () returned 0xd20000 [0091.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0091.130] GetProcessHeap () returned 0xd20000 [0091.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0091.130] GetProcessHeap () returned 0xd20000 [0091.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0091.130] GetProcessHeap () returned 0xd20000 [0091.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.130] GetProcessHeap () returned 0xd20000 [0091.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.130] GetProcessHeap () returned 0xd20000 [0091.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.131] GetProcessHeap () returned 0xd20000 [0091.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.131] GetProcessHeap () returned 0xd20000 [0091.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0091.131] GetProcessHeap () returned 0xd20000 [0091.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0091.131] GetProcessHeap () returned 0xd20000 [0091.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.131] GetProcessHeap () returned 0xd20000 [0091.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.131] GetProcessHeap () returned 0xd20000 [0091.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.131] GetProcessHeap () returned 0xd20000 [0091.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.131] GetProcessHeap () returned 0xd20000 [0091.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0091.131] GetProcessHeap () returned 0xd20000 [0091.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0091.131] GetProcessHeap () returned 0xd20000 [0091.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0091.132] GetProcessHeap () returned 0xd20000 [0091.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0091.132] GetProcessHeap () returned 0xd20000 [0091.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0091.132] GetProcessHeap () returned 0xd20000 [0091.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0091.132] GetProcessHeap () returned 0xd20000 [0091.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.132] GetProcessHeap () returned 0xd20000 [0091.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.132] GetProcessHeap () returned 0xd20000 [0091.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.132] GetProcessHeap () returned 0xd20000 [0091.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.132] GetProcessHeap () returned 0xd20000 [0091.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.132] GetProcessHeap () returned 0xd20000 [0091.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.133] GetProcessHeap () returned 0xd20000 [0091.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0091.133] GetProcessHeap () returned 0xd20000 [0091.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0091.133] GetProcessHeap () returned 0xd20000 [0091.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.133] GetProcessHeap () returned 0xd20000 [0091.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.133] GetProcessHeap () returned 0xd20000 [0091.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.133] GetProcessHeap () returned 0xd20000 [0091.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.133] GetProcessHeap () returned 0xd20000 [0091.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.133] GetProcessHeap () returned 0xd20000 [0091.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.133] GetProcessHeap () returned 0xd20000 [0091.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0091.133] GetProcessHeap () returned 0xd20000 [0091.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0091.134] GetProcessHeap () returned 0xd20000 [0091.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.134] GetProcessHeap () returned 0xd20000 [0091.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.134] GetProcessHeap () returned 0xd20000 [0091.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.134] GetProcessHeap () returned 0xd20000 [0091.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.134] GetProcessHeap () returned 0xd20000 [0091.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0091.134] GetProcessHeap () returned 0xd20000 [0091.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0091.134] GetProcessHeap () returned 0xd20000 [0091.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.134] GetProcessHeap () returned 0xd20000 [0091.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.134] GetProcessHeap () returned 0xd20000 [0091.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0091.134] GetProcessHeap () returned 0xd20000 [0091.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0091.135] GetProcessHeap () returned 0xd20000 [0091.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.135] GetProcessHeap () returned 0xd20000 [0091.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.135] GetProcessHeap () returned 0xd20000 [0091.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0091.135] GetProcessHeap () returned 0xd20000 [0091.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0091.135] GetProcessHeap () returned 0xd20000 [0091.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.135] GetProcessHeap () returned 0xd20000 [0091.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.135] GetProcessHeap () returned 0xd20000 [0091.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.135] GetProcessHeap () returned 0xd20000 [0091.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.135] GetProcessHeap () returned 0xd20000 [0091.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0091.135] GetProcessHeap () returned 0xd20000 [0091.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0091.136] GetProcessHeap () returned 0xd20000 [0091.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.136] GetProcessHeap () returned 0xd20000 [0091.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.136] GetProcessHeap () returned 0xd20000 [0091.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.136] GetProcessHeap () returned 0xd20000 [0091.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.136] GetProcessHeap () returned 0xd20000 [0091.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.136] GetProcessHeap () returned 0xd20000 [0091.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.136] GetProcessHeap () returned 0xd20000 [0091.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.136] GetProcessHeap () returned 0xd20000 [0091.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.136] GetProcessHeap () returned 0xd20000 [0091.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.137] GetProcessHeap () returned 0xd20000 [0091.137] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.137] GetProcessHeap () returned 0xd20000 [0091.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.137] GetProcessHeap () returned 0xd20000 [0091.137] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.137] GetProcessHeap () returned 0xd20000 [0091.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.137] GetProcessHeap () returned 0xd20000 [0091.137] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.137] GetProcessHeap () returned 0xd20000 [0091.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.137] GetProcessHeap () returned 0xd20000 [0091.137] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.137] GetProcessHeap () returned 0xd20000 [0091.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.137] GetProcessHeap () returned 0xd20000 [0091.137] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.137] GetProcessHeap () returned 0xd20000 [0091.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.138] GetProcessHeap () returned 0xd20000 [0091.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.138] GetProcessHeap () returned 0xd20000 [0091.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0091.138] GetProcessHeap () returned 0xd20000 [0091.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0091.138] GetProcessHeap () returned 0xd20000 [0091.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.138] GetProcessHeap () returned 0xd20000 [0091.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.138] GetProcessHeap () returned 0xd20000 [0091.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.138] GetProcessHeap () returned 0xd20000 [0091.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.138] GetProcessHeap () returned 0xd20000 [0091.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.138] GetProcessHeap () returned 0xd20000 [0091.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.138] GetProcessHeap () returned 0xd20000 [0091.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.139] GetProcessHeap () returned 0xd20000 [0091.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.139] GetProcessHeap () returned 0xd20000 [0091.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.139] GetProcessHeap () returned 0xd20000 [0091.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.139] GetProcessHeap () returned 0xd20000 [0091.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.139] GetProcessHeap () returned 0xd20000 [0091.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.139] GetProcessHeap () returned 0xd20000 [0091.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.139] GetProcessHeap () returned 0xd20000 [0091.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.139] GetProcessHeap () returned 0xd20000 [0091.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.140] GetProcessHeap () returned 0xd20000 [0091.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.140] GetProcessHeap () returned 0xd20000 [0091.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0091.140] GetProcessHeap () returned 0xd20000 [0091.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0091.140] GetProcessHeap () returned 0xd20000 [0091.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.140] GetProcessHeap () returned 0xd20000 [0091.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.140] GetProcessHeap () returned 0xd20000 [0091.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.140] GetProcessHeap () returned 0xd20000 [0091.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.140] GetProcessHeap () returned 0xd20000 [0091.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0091.140] GetProcessHeap () returned 0xd20000 [0091.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0091.141] GetProcessHeap () returned 0xd20000 [0091.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.141] GetProcessHeap () returned 0xd20000 [0091.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.141] GetProcessHeap () returned 0xd20000 [0091.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0091.141] GetProcessHeap () returned 0xd20000 [0091.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0091.141] GetProcessHeap () returned 0xd20000 [0091.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.141] GetProcessHeap () returned 0xd20000 [0091.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.141] GetProcessHeap () returned 0xd20000 [0091.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.141] GetProcessHeap () returned 0xd20000 [0091.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.141] GetProcessHeap () returned 0xd20000 [0091.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.142] GetProcessHeap () returned 0xd20000 [0091.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.142] GetProcessHeap () returned 0xd20000 [0091.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.142] GetProcessHeap () returned 0xd20000 [0091.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.142] GetProcessHeap () returned 0xd20000 [0091.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0091.142] GetProcessHeap () returned 0xd20000 [0091.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0091.142] GetProcessHeap () returned 0xd20000 [0091.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.142] GetProcessHeap () returned 0xd20000 [0091.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.142] GetProcessHeap () returned 0xd20000 [0091.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.142] GetProcessHeap () returned 0xd20000 [0091.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.142] GetProcessHeap () returned 0xd20000 [0091.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.143] GetProcessHeap () returned 0xd20000 [0091.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.143] GetProcessHeap () returned 0xd20000 [0091.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.143] GetProcessHeap () returned 0xd20000 [0091.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.143] GetProcessHeap () returned 0xd20000 [0091.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.143] GetProcessHeap () returned 0xd20000 [0091.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.143] GetProcessHeap () returned 0xd20000 [0091.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.143] GetProcessHeap () returned 0xd20000 [0091.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.143] GetProcessHeap () returned 0xd20000 [0091.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.143] GetProcessHeap () returned 0xd20000 [0091.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.144] GetProcessHeap () returned 0xd20000 [0091.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0091.144] GetProcessHeap () returned 0xd20000 [0091.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0091.144] GetProcessHeap () returned 0xd20000 [0091.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0091.144] GetProcessHeap () returned 0xd20000 [0091.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0091.144] GetProcessHeap () returned 0xd20000 [0091.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0091.144] GetProcessHeap () returned 0xd20000 [0091.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0091.144] GetProcessHeap () returned 0xd20000 [0091.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.144] GetProcessHeap () returned 0xd20000 [0091.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.144] GetProcessHeap () returned 0xd20000 [0091.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.145] GetProcessHeap () returned 0xd20000 [0091.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.145] GetProcessHeap () returned 0xd20000 [0091.145] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0091.145] GetProcessHeap () returned 0xd20000 [0091.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0091.145] GetProcessHeap () returned 0xd20000 [0091.145] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.145] GetProcessHeap () returned 0xd20000 [0091.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.145] GetProcessHeap () returned 0xd20000 [0091.145] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0091.145] GetProcessHeap () returned 0xd20000 [0091.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0091.145] GetProcessHeap () returned 0xd20000 [0091.145] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0091.145] GetProcessHeap () returned 0xd20000 [0091.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0091.146] GetProcessHeap () returned 0xd20000 [0091.146] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.146] GetProcessHeap () returned 0xd20000 [0091.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.146] GetProcessHeap () returned 0xd20000 [0091.146] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.146] GetProcessHeap () returned 0xd20000 [0091.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.146] GetProcessHeap () returned 0xd20000 [0091.146] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0091.146] GetProcessHeap () returned 0xd20000 [0091.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0091.146] GetProcessHeap () returned 0xd20000 [0091.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0091.146] GetProcessHeap () returned 0xd20000 [0091.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0091.146] GetProcessHeap () returned 0xd20000 [0091.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0091.147] GetProcessHeap () returned 0xd20000 [0091.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0091.147] GetProcessHeap () returned 0xd20000 [0091.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44588 | out: hHeap=0xd20000) returned 1 [0091.147] GetProcessHeap () returned 0xd20000 [0091.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0091.147] GetProcessHeap () returned 0xd20000 [0091.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0091.147] GetProcessHeap () returned 0xd20000 [0091.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0091.147] GetProcessHeap () returned 0xd20000 [0091.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0091.147] GetProcessHeap () returned 0xd20000 [0091.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0091.147] GetProcessHeap () returned 0xd20000 [0091.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0091.147] WriteFile (in: hFile=0x230, lpBuffer=0xd4d7c8*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d7c8*, lpNumberOfBytesWritten=0x299d864*=0x389, lpOverlapped=0x0) returned 1 [0091.157] GetProcessHeap () returned 0xd20000 [0091.157] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4d7c8, Size=0x30) returned 0xd4d7c8 [0091.157] GetProcessHeap () returned 0xd20000 [0091.157] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0091.157] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0091.157] GetProcessHeap () returned 0xd20000 [0091.157] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x41b70) returned 0xd4d800 [0091.161] ReadFile (in: hFile=0x230, lpBuffer=0xd4d800, nNumberOfBytesToRead=0x41b70, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4d800*, lpNumberOfBytesRead=0x299d7e8*=0x41b70, lpOverlapped=0x0) returned 1 [0091.174] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0091.174] WriteFile (in: hFile=0x230, lpBuffer=0xd4d800*, nNumberOfBytesToWrite=0x41b70, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4d800*, lpNumberOfBytesWritten=0x299d7e4*=0x41b70, lpOverlapped=0x0) returned 1 [0091.183] GetProcessHeap () returned 0xd20000 [0091.183] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4d800 | out: hHeap=0xd20000) returned 1 [0091.183] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0091.183] WriteFile (in: hFile=0x230, lpBuffer=0xd4d7c8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d7c8*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0091.185] CloseHandle (hObject=0x230) returned 1 [0091.207] GetProcessHeap () returned 0xd20000 [0091.207] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd425a8 | out: hHeap=0xd20000) returned 1 [0091.207] GetProcessHeap () returned 0xd20000 [0091.208] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bcb0 | out: hHeap=0xd20000) returned 1 [0091.208] GetProcessHeap () returned 0xd20000 [0091.208] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0091.208] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" [0091.208] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css.[ponce.lorena@aol.com]" [0091.208] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\ui-dark.css"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\ui-dark.css.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0091.213] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\ui-dark.css" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css") returned 1 [0091.213] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\") returned="" [0091.213] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\HOW_RECOVER.html" [0091.213] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\Microsoft.WinJS\\css\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\microsoft.winjs\\css\\how_recover.html")) returned 0x20 [0091.214] GetProcessHeap () returned 0xd20000 [0091.214] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44510 | out: hHeap=0xd20000) returned 1 [0091.214] FindNextFileW (in: hFindFile=0xd49360, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6143a6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea6143a6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x41b67, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ui-dark.css", cAlternateFileName="")) returned 0 [0091.214] FindClose (in: hFindFile=0xd49360 | out: hFindFile=0xd49360) returned 1 [0091.214] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\" [0091.214] GetProcessHeap () returned 0xd20000 [0091.214] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3c308 | out: hHeap=0xd20000) returned 1 [0091.214] GetProcessHeap () returned 0xd20000 [0091.214] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0091.214] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned 38 [0091.214] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\*") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\*" [0091.214] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3c4d9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea5f6eb5, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd48e60 [0091.218] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0091.218] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3c4d9e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea5f6eb5, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.221] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0091.221] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0091.221] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c6124, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c6124, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1af6d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_ar-sa.htm", cAlternateFileName="EULA_A~1.HTM")) returned 1 [0091.221] lstrcmpiW (lpString1="EULA_ar-sa.htm", lpString2=".") returned 1 [0091.221] lstrcmpiW (lpString1="EULA_ar-sa.htm", lpString2="..") returned 1 [0091.221] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_ar-sa.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" [0091.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_ar-sa.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0091.221] GetProcessHeap () returned 0xd20000 [0091.221] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd44678 [0091.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_ar-sa.htm", cchWideChar=-1, lpMultiByteStr=0xd44678, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_ar-sa.htm", lpUsedDefaultChar=0x0) returned 15 [0091.221] lstrlenA (lpString="EULA_ar-sa.htm") returned 14 [0091.221] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0091.221] lstrlenA (lpString="EULA_ar-sa.htm") returned 14 [0091.221] lstrlenA (lpString=".dll") returned 4 [0091.221] lstrlenA (lpString=".dll") returned 4 [0091.221] lstrlenA (lpString="EULA_ar-sa.htm") returned 14 [0091.221] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0091.221] lstrlenA (lpString="EULA_ar-sa.htm") returned 14 [0091.222] lstrlenA (lpString=".ini") returned 4 [0091.222] lstrlenA (lpString=".ini") returned 4 [0091.222] lstrlenA (lpString="EULA_ar-sa.htm") returned 14 [0091.222] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0091.222] lstrlenA (lpString="EULA_ar-sa.htm") returned 14 [0091.222] lstrlenA (lpString=".inc") returned 4 [0091.222] lstrlenA (lpString=".inc") returned 4 [0091.222] lstrlenA (lpString="EULA_ar-sa.htm") returned 14 [0091.222] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0091.222] lstrcmpiW (lpString1="EULA_ar-sa.htm", lpString2="HOW_RECOVER.html") returned -1 [0091.222] lstrcmpiW (lpString1="EULA_ar-sa.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0091.222] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0091.222] lstrcmpiW (lpString1="EULA_ar-sa.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0091.222] GetProcessHeap () returned 0xd20000 [0091.222] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd428c8 [0091.222] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0091.223] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=110445) returned 1 [0091.223] GetProcessHeap () returned 0xd20000 [0091.223] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bcb0 [0091.223] GetProcessHeap () returned 0xd20000 [0091.223] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0091.223] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm") returned 52 [0091.223] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0091.224] GetProcessHeap () returned 0xd20000 [0091.224] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0091.224] GetProcessHeap () returned 0xd20000 [0091.224] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4d800 [0091.224] lstrlenA (lpString="rsa_encrypt") returned 11 [0091.224] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0091.226] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0091.226] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0091.226] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0091.226] GetProcessHeap () returned 0xd20000 [0091.226] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0091.226] lstrlenA (lpString="010001") returned 6 [0091.226] GetProcessHeap () returned 0xd20000 [0091.226] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc48 [0091.227] GetProcessHeap () returned 0xd20000 [0091.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0091.227] GetProcessHeap () returned 0xd20000 [0091.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4a9d8 [0091.227] GetProcessHeap () returned 0xd20000 [0091.227] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0091.227] GetProcessHeap () returned 0xd20000 [0091.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b7e8 [0091.227] GetProcessHeap () returned 0xd20000 [0091.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44808 [0091.227] GetProcessHeap () returned 0xd20000 [0091.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0091.227] GetProcessHeap () returned 0xd20000 [0091.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0091.227] GetProcessHeap () returned 0xd20000 [0091.227] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.227] GetProcessHeap () returned 0xd20000 [0091.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0091.228] GetProcessHeap () returned 0xd20000 [0091.228] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0091.228] GetProcessHeap () returned 0xd20000 [0091.228] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd451e0 [0091.228] GetProcessHeap () returned 0xd20000 [0091.228] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0091.228] GetProcessHeap () returned 0xd20000 [0091.228] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44408 [0091.228] GetProcessHeap () returned 0xd20000 [0091.228] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ac18 [0091.228] GetProcessHeap () returned 0xd20000 [0091.228] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0091.228] GetProcessHeap () returned 0xd20000 [0091.228] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0091.228] GetProcessHeap () returned 0xd20000 [0091.228] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ac18 | out: hHeap=0xd20000) returned 1 [0091.228] GetProcessHeap () returned 0xd20000 [0091.228] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0091.229] GetProcessHeap () returned 0xd20000 [0091.229] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446f0 [0091.229] GetProcessHeap () returned 0xd20000 [0091.229] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0091.229] GetProcessHeap () returned 0xd20000 [0091.229] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0091.229] GetProcessHeap () returned 0xd20000 [0091.229] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0091.229] GetProcessHeap () returned 0xd20000 [0091.229] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0091.229] GetProcessHeap () returned 0xd20000 [0091.229] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0091.229] GetProcessHeap () returned 0xd20000 [0091.229] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0091.229] GetProcessHeap () returned 0xd20000 [0091.229] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b128 [0091.229] GetProcessHeap () returned 0xd20000 [0091.229] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446f0 | out: hHeap=0xd20000) returned 1 [0091.229] GetProcessHeap () returned 0xd20000 [0091.230] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44c68 [0091.230] GetProcessHeap () returned 0xd20000 [0091.230] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b128 | out: hHeap=0xd20000) returned 1 [0091.230] GetProcessHeap () returned 0xd20000 [0091.230] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0091.230] GetProcessHeap () returned 0xd20000 [0091.230] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0091.230] GetProcessHeap () returned 0xd20000 [0091.230] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0091.230] GetProcessHeap () returned 0xd20000 [0091.230] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0091.230] GetProcessHeap () returned 0xd20000 [0091.230] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.230] GetProcessHeap () returned 0xd20000 [0091.230] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.230] GetProcessHeap () returned 0xd20000 [0091.230] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.230] GetProcessHeap () returned 0xd20000 [0091.231] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.231] GetProcessHeap () returned 0xd20000 [0091.231] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.231] GetProcessHeap () returned 0xd20000 [0091.231] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.231] GetProcessHeap () returned 0xd20000 [0091.231] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.231] GetProcessHeap () returned 0xd20000 [0091.231] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.231] GetProcessHeap () returned 0xd20000 [0091.231] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.231] GetProcessHeap () returned 0xd20000 [0091.231] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.231] GetProcessHeap () returned 0xd20000 [0091.231] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.231] GetProcessHeap () returned 0xd20000 [0091.231] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.231] GetProcessHeap () returned 0xd20000 [0091.231] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0091.232] GetProcessHeap () returned 0xd20000 [0091.232] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0091.232] GetProcessHeap () returned 0xd20000 [0091.232] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.232] GetProcessHeap () returned 0xd20000 [0091.232] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.232] GetProcessHeap () returned 0xd20000 [0091.232] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.232] GetProcessHeap () returned 0xd20000 [0091.232] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.232] GetProcessHeap () returned 0xd20000 [0091.232] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0091.232] GetProcessHeap () returned 0xd20000 [0091.232] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0091.232] GetProcessHeap () returned 0xd20000 [0091.233] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.233] GetProcessHeap () returned 0xd20000 [0091.233] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.233] GetProcessHeap () returned 0xd20000 [0091.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.234] GetProcessHeap () returned 0xd20000 [0091.234] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.234] GetProcessHeap () returned 0xd20000 [0091.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0091.234] GetProcessHeap () returned 0xd20000 [0091.234] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0091.234] GetProcessHeap () returned 0xd20000 [0091.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.234] GetProcessHeap () returned 0xd20000 [0091.234] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.234] GetProcessHeap () returned 0xd20000 [0091.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.234] GetProcessHeap () returned 0xd20000 [0091.234] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.234] GetProcessHeap () returned 0xd20000 [0091.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.234] GetProcessHeap () returned 0xd20000 [0091.235] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.235] GetProcessHeap () returned 0xd20000 [0091.235] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.235] GetProcessHeap () returned 0xd20000 [0091.235] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.235] GetProcessHeap () returned 0xd20000 [0091.235] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.235] GetProcessHeap () returned 0xd20000 [0091.235] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.235] GetProcessHeap () returned 0xd20000 [0091.235] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.235] GetProcessHeap () returned 0xd20000 [0091.235] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.235] GetProcessHeap () returned 0xd20000 [0091.235] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0091.235] GetProcessHeap () returned 0xd20000 [0091.235] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0091.235] GetProcessHeap () returned 0xd20000 [0091.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.236] GetProcessHeap () returned 0xd20000 [0091.236] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.236] GetProcessHeap () returned 0xd20000 [0091.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.236] GetProcessHeap () returned 0xd20000 [0091.236] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.236] GetProcessHeap () returned 0xd20000 [0091.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.236] GetProcessHeap () returned 0xd20000 [0091.236] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.236] GetProcessHeap () returned 0xd20000 [0091.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.236] GetProcessHeap () returned 0xd20000 [0091.236] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.236] GetProcessHeap () returned 0xd20000 [0091.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.236] GetProcessHeap () returned 0xd20000 [0091.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.237] GetProcessHeap () returned 0xd20000 [0091.237] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.237] GetProcessHeap () returned 0xd20000 [0091.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.237] GetProcessHeap () returned 0xd20000 [0091.237] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.237] GetProcessHeap () returned 0xd20000 [0091.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.237] GetProcessHeap () returned 0xd20000 [0091.237] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.237] GetProcessHeap () returned 0xd20000 [0091.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.237] GetProcessHeap () returned 0xd20000 [0091.237] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.237] GetProcessHeap () returned 0xd20000 [0091.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.237] GetProcessHeap () returned 0xd20000 [0091.237] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.238] GetProcessHeap () returned 0xd20000 [0091.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.238] GetProcessHeap () returned 0xd20000 [0091.238] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0091.238] GetProcessHeap () returned 0xd20000 [0091.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0091.238] GetProcessHeap () returned 0xd20000 [0091.238] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.238] GetProcessHeap () returned 0xd20000 [0091.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.238] GetProcessHeap () returned 0xd20000 [0091.238] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.238] GetProcessHeap () returned 0xd20000 [0091.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.238] GetProcessHeap () returned 0xd20000 [0091.238] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.238] GetProcessHeap () returned 0xd20000 [0091.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.239] GetProcessHeap () returned 0xd20000 [0091.239] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0091.239] GetProcessHeap () returned 0xd20000 [0091.239] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0091.239] GetProcessHeap () returned 0xd20000 [0091.239] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0091.239] GetProcessHeap () returned 0xd20000 [0091.239] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0091.239] GetProcessHeap () returned 0xd20000 [0091.239] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.239] GetProcessHeap () returned 0xd20000 [0091.239] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.239] GetProcessHeap () returned 0xd20000 [0091.239] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.239] GetProcessHeap () returned 0xd20000 [0091.239] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.239] GetProcessHeap () returned 0xd20000 [0091.240] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0091.240] GetProcessHeap () returned 0xd20000 [0091.240] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0091.240] GetProcessHeap () returned 0xd20000 [0091.240] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.240] GetProcessHeap () returned 0xd20000 [0091.240] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.240] GetProcessHeap () returned 0xd20000 [0091.240] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0091.240] GetProcessHeap () returned 0xd20000 [0091.240] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0091.240] GetProcessHeap () returned 0xd20000 [0091.240] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0091.240] GetProcessHeap () returned 0xd20000 [0091.240] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0091.240] GetProcessHeap () returned 0xd20000 [0091.240] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.240] GetProcessHeap () returned 0xd20000 [0091.240] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.240] GetProcessHeap () returned 0xd20000 [0091.241] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0091.241] GetProcessHeap () returned 0xd20000 [0091.241] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0091.241] GetProcessHeap () returned 0xd20000 [0091.241] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.241] GetProcessHeap () returned 0xd20000 [0091.241] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.241] GetProcessHeap () returned 0xd20000 [0091.241] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0091.241] GetProcessHeap () returned 0xd20000 [0091.241] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0091.241] GetProcessHeap () returned 0xd20000 [0091.241] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.241] GetProcessHeap () returned 0xd20000 [0091.241] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.241] GetProcessHeap () returned 0xd20000 [0091.241] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.241] GetProcessHeap () returned 0xd20000 [0091.242] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.242] GetProcessHeap () returned 0xd20000 [0091.242] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.242] GetProcessHeap () returned 0xd20000 [0091.242] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.242] GetProcessHeap () returned 0xd20000 [0091.242] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0091.242] GetProcessHeap () returned 0xd20000 [0091.242] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0091.242] GetProcessHeap () returned 0xd20000 [0091.242] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0091.242] GetProcessHeap () returned 0xd20000 [0091.242] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0091.242] GetProcessHeap () returned 0xd20000 [0091.242] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.242] GetProcessHeap () returned 0xd20000 [0091.242] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.242] GetProcessHeap () returned 0xd20000 [0091.243] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.243] GetProcessHeap () returned 0xd20000 [0091.243] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.243] GetProcessHeap () returned 0xd20000 [0091.243] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0091.243] GetProcessHeap () returned 0xd20000 [0091.243] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0091.243] GetProcessHeap () returned 0xd20000 [0091.243] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.243] GetProcessHeap () returned 0xd20000 [0091.243] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.243] GetProcessHeap () returned 0xd20000 [0091.243] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0091.243] GetProcessHeap () returned 0xd20000 [0091.243] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0091.243] GetProcessHeap () returned 0xd20000 [0091.243] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.243] GetProcessHeap () returned 0xd20000 [0091.243] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.244] GetProcessHeap () returned 0xd20000 [0091.244] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.244] GetProcessHeap () returned 0xd20000 [0091.244] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.244] GetProcessHeap () returned 0xd20000 [0091.244] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.244] GetProcessHeap () returned 0xd20000 [0091.244] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.244] GetProcessHeap () returned 0xd20000 [0091.244] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.244] GetProcessHeap () returned 0xd20000 [0091.244] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.244] GetProcessHeap () returned 0xd20000 [0091.244] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.244] GetProcessHeap () returned 0xd20000 [0091.244] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.244] GetProcessHeap () returned 0xd20000 [0091.244] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0091.245] GetProcessHeap () returned 0xd20000 [0091.245] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0091.245] GetProcessHeap () returned 0xd20000 [0091.245] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.245] GetProcessHeap () returned 0xd20000 [0091.245] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.245] GetProcessHeap () returned 0xd20000 [0091.245] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0091.245] GetProcessHeap () returned 0xd20000 [0091.245] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0091.245] GetProcessHeap () returned 0xd20000 [0091.245] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0091.245] GetProcessHeap () returned 0xd20000 [0091.245] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0091.245] GetProcessHeap () returned 0xd20000 [0091.245] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0091.245] GetProcessHeap () returned 0xd20000 [0091.245] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0091.246] GetProcessHeap () returned 0xd20000 [0091.246] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.246] GetProcessHeap () returned 0xd20000 [0091.246] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.246] GetProcessHeap () returned 0xd20000 [0091.246] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.246] GetProcessHeap () returned 0xd20000 [0091.246] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.246] GetProcessHeap () returned 0xd20000 [0091.246] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0091.246] GetProcessHeap () returned 0xd20000 [0091.246] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0091.246] GetProcessHeap () returned 0xd20000 [0091.246] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.246] GetProcessHeap () returned 0xd20000 [0091.246] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.246] GetProcessHeap () returned 0xd20000 [0091.246] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.246] GetProcessHeap () returned 0xd20000 [0091.247] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.247] GetProcessHeap () returned 0xd20000 [0091.247] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.247] GetProcessHeap () returned 0xd20000 [0091.247] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.247] GetProcessHeap () returned 0xd20000 [0091.247] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.247] GetProcessHeap () returned 0xd20000 [0091.247] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.247] GetProcessHeap () returned 0xd20000 [0091.247] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0091.247] GetProcessHeap () returned 0xd20000 [0091.247] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0091.247] GetProcessHeap () returned 0xd20000 [0091.247] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0091.247] GetProcessHeap () returned 0xd20000 [0091.247] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0091.248] GetProcessHeap () returned 0xd20000 [0091.248] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.248] GetProcessHeap () returned 0xd20000 [0091.248] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.248] GetProcessHeap () returned 0xd20000 [0091.248] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0091.248] GetProcessHeap () returned 0xd20000 [0091.248] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0091.594] GetProcessHeap () returned 0xd20000 [0091.594] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0091.594] GetProcessHeap () returned 0xd20000 [0091.594] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0091.594] GetProcessHeap () returned 0xd20000 [0091.594] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.594] GetProcessHeap () returned 0xd20000 [0091.594] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.594] GetProcessHeap () returned 0xd20000 [0091.594] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0091.594] GetProcessHeap () returned 0xd20000 [0091.594] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0091.594] GetProcessHeap () returned 0xd20000 [0091.594] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.594] GetProcessHeap () returned 0xd20000 [0091.595] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.595] GetProcessHeap () returned 0xd20000 [0091.595] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.595] GetProcessHeap () returned 0xd20000 [0091.595] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.595] GetProcessHeap () returned 0xd20000 [0091.595] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.595] GetProcessHeap () returned 0xd20000 [0091.595] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.595] GetProcessHeap () returned 0xd20000 [0091.595] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0091.595] GetProcessHeap () returned 0xd20000 [0091.595] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0091.595] GetProcessHeap () returned 0xd20000 [0091.595] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0091.595] GetProcessHeap () returned 0xd20000 [0091.595] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0091.595] GetProcessHeap () returned 0xd20000 [0091.595] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44408 | out: hHeap=0xd20000) returned 1 [0091.596] GetProcessHeap () returned 0xd20000 [0091.596] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0091.596] GetProcessHeap () returned 0xd20000 [0091.596] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0091.596] GetProcessHeap () returned 0xd20000 [0091.596] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a9d8 | out: hHeap=0xd20000) returned 1 [0091.596] GetProcessHeap () returned 0xd20000 [0091.596] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0091.596] GetProcessHeap () returned 0xd20000 [0091.596] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0091.596] GetProcessHeap () returned 0xd20000 [0091.596] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0091.596] WriteFile (in: hFile=0x230, lpBuffer=0xd4d800*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d800*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0091.603] GetProcessHeap () returned 0xd20000 [0091.603] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4d800, Size=0x30) returned 0xd4d800 [0091.603] GetProcessHeap () returned 0xd20000 [0091.604] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0091.604] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0091.604] GetProcessHeap () returned 0xd20000 [0091.604] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1af6d) returned 0xd4d838 [0091.604] ReadFile (in: hFile=0x230, lpBuffer=0xd4d838, nNumberOfBytesToRead=0x1af6d, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4d838*, lpNumberOfBytesRead=0x299d7e8*=0x1af6d, lpOverlapped=0x0) returned 1 [0091.608] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0091.609] WriteFile (in: hFile=0x230, lpBuffer=0xd4d838*, nNumberOfBytesToWrite=0x1af6d, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4d838*, lpNumberOfBytesWritten=0x299d7e4*=0x1af6d, lpOverlapped=0x0) returned 1 [0091.612] GetProcessHeap () returned 0xd20000 [0091.612] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4d838 | out: hHeap=0xd20000) returned 1 [0091.612] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0091.612] WriteFile (in: hFile=0x230, lpBuffer=0xd4d800*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d800*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0091.614] CloseHandle (hObject=0x230) returned 1 [0091.621] GetProcessHeap () returned 0xd20000 [0091.621] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd428c8 | out: hHeap=0xd20000) returned 1 [0091.621] GetProcessHeap () returned 0xd20000 [0091.621] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bcb0 | out: hHeap=0xd20000) returned 1 [0091.621] GetProcessHeap () returned 0xd20000 [0091.621] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0091.622] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" [0091.622] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm.[ponce.lorena@aol.com]" [0091.622] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ar-sa.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0091.623] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ar-sa.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0091.623] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0091.623] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0091.623] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0xffffffff [0091.623] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0091.623] GetProcessHeap () returned 0xd20000 [0091.624] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bc38 [0091.624] GetProcessHeap () returned 0xd20000 [0091.624] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0091.634] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.635] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.635] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.636] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.636] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.636] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.636] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.636] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.636] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.636] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.636] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.637] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.637] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.637] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.637] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.637] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.638] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.638] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.638] GetProcessHeap () returned 0xd20000 [0091.638] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bc38 | out: hHeap=0xd20000) returned 1 [0091.638] GetProcessHeap () returned 0xd20000 [0091.638] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0091.638] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x299d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x299d9d0*=0x300, lpOverlapped=0x0) returned 1 [0091.639] GetProcessHeap () returned 0xd20000 [0091.639] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bb48 [0091.639] GetProcessHeap () returned 0xd20000 [0091.639] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0091.649] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.650] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.650] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.650] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.650] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.650] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.650] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.650] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.651] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.651] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.651] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.651] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.651] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.651] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.651] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.652] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.652] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.652] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.652] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.652] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.652] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.652] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.652] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.653] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.653] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.653] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.653] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.653] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.653] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.654] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.654] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.654] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.654] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.654] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.776] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.776] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.776] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.776] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.777] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.777] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.777] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.777] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.777] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.777] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.777] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.777] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.778] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.778] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.778] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.778] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.778] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.778] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.778] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.779] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.779] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.779] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.779] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.783] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.783] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.783] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.783] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.783] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.784] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.784] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.784] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.784] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.784] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.784] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.784] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.784] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.785] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.785] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.785] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.785] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.785] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.785] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.785] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.785] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.786] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.786] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.786] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.786] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.786] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.786] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.786] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.786] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.787] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.787] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.787] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.787] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.787] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.788] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.788] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.788] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.788] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.788] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.788] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.788] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.788] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.789] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.789] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.789] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.789] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.789] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.789] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.789] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.789] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.790] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.790] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.790] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0091.790] GetProcessHeap () returned 0xd20000 [0091.790] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bb48 | out: hHeap=0xd20000) returned 1 [0091.790] GetProcessHeap () returned 0xd20000 [0091.790] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0091.790] CloseHandle (hObject=0x230) returned 1 [0091.791] GetProcessHeap () returned 0xd20000 [0091.791] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44678 | out: hHeap=0xd20000) returned 1 [0091.791] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c74ab, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c74ab, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x3de0d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_bg-bg.htm", cAlternateFileName="EULA_B~1.HTM")) returned 1 [0091.791] lstrcmpiW (lpString1="EULA_bg-bg.htm", lpString2=".") returned 1 [0091.792] lstrcmpiW (lpString1="EULA_bg-bg.htm", lpString2="..") returned 1 [0091.792] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_bg-bg.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" [0091.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_bg-bg.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0091.792] GetProcessHeap () returned 0xd20000 [0091.792] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd44510 [0091.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_bg-bg.htm", cchWideChar=-1, lpMultiByteStr=0xd44510, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_bg-bg.htm", lpUsedDefaultChar=0x0) returned 15 [0091.792] lstrlenA (lpString="EULA_bg-bg.htm") returned 14 [0091.792] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0091.792] lstrlenA (lpString="EULA_bg-bg.htm") returned 14 [0091.792] lstrlenA (lpString=".dll") returned 4 [0091.792] lstrlenA (lpString=".dll") returned 4 [0091.792] lstrlenA (lpString="EULA_bg-bg.htm") returned 14 [0091.792] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0091.792] lstrlenA (lpString="EULA_bg-bg.htm") returned 14 [0091.793] lstrlenA (lpString=".ini") returned 4 [0091.793] lstrlenA (lpString=".ini") returned 4 [0091.793] lstrlenA (lpString="EULA_bg-bg.htm") returned 14 [0091.793] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0091.793] lstrlenA (lpString="EULA_bg-bg.htm") returned 14 [0091.793] lstrlenA (lpString=".inc") returned 4 [0091.793] lstrlenA (lpString=".inc") returned 4 [0091.793] lstrlenA (lpString="EULA_bg-bg.htm") returned 14 [0091.793] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0091.793] lstrcmpiW (lpString1="EULA_bg-bg.htm", lpString2="HOW_RECOVER.html") returned -1 [0091.793] lstrcmpiW (lpString1="EULA_bg-bg.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0091.793] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0091.793] lstrcmpiW (lpString1="EULA_bg-bg.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0091.793] GetProcessHeap () returned 0xd20000 [0091.793] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd424b8 [0091.793] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0091.794] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=253453) returned 1 [0091.794] GetProcessHeap () returned 0xd20000 [0091.794] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c250 [0091.794] GetProcessHeap () returned 0xd20000 [0091.795] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0091.795] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm") returned 52 [0091.795] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0091.795] GetProcessHeap () returned 0xd20000 [0091.796] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0091.796] GetProcessHeap () returned 0xd20000 [0091.796] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x383) returned 0xd4d838 [0091.796] lstrlenA (lpString="rsa_encrypt") returned 11 [0091.796] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0091.799] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0091.799] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0091.799] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0091.799] GetProcessHeap () returned 0xd20000 [0091.799] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0091.799] lstrlenA (lpString="010001") returned 6 [0091.799] GetProcessHeap () returned 0xd20000 [0091.799] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc58 [0091.799] GetProcessHeap () returned 0xd20000 [0091.799] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0091.799] GetProcessHeap () returned 0xd20000 [0091.799] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b128 [0091.799] GetProcessHeap () returned 0xd20000 [0091.800] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0091.800] GetProcessHeap () returned 0xd20000 [0091.800] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4adc8 [0091.800] GetProcessHeap () returned 0xd20000 [0091.800] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44fb0 [0091.800] GetProcessHeap () returned 0xd20000 [0091.800] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd28 [0091.800] GetProcessHeap () returned 0xd20000 [0091.800] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0091.800] GetProcessHeap () returned 0xd20000 [0091.800] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0091.800] GetProcessHeap () returned 0xd20000 [0091.800] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0091.800] GetProcessHeap () returned 0xd20000 [0091.800] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0091.800] GetProcessHeap () returned 0xd20000 [0091.800] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44920 [0091.800] GetProcessHeap () returned 0xd20000 [0091.800] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0091.800] GetProcessHeap () returned 0xd20000 [0091.801] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444c8 [0091.801] GetProcessHeap () returned 0xd20000 [0091.801] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0091.801] GetProcessHeap () returned 0xd20000 [0091.801] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0091.801] GetProcessHeap () returned 0xd20000 [0091.801] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0091.801] GetProcessHeap () returned 0xd20000 [0091.801] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0091.801] GetProcessHeap () returned 0xd20000 [0091.801] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0091.801] GetProcessHeap () returned 0xd20000 [0091.801] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44660 [0091.801] GetProcessHeap () returned 0xd20000 [0091.801] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0091.801] GetProcessHeap () returned 0xd20000 [0091.801] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0091.801] GetProcessHeap () returned 0xd20000 [0091.801] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0091.802] GetProcessHeap () returned 0xd20000 [0091.802] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0091.802] GetProcessHeap () returned 0xd20000 [0091.802] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0091.802] GetProcessHeap () returned 0xd20000 [0091.802] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0091.802] GetProcessHeap () returned 0xd20000 [0091.802] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b3f8 [0091.802] GetProcessHeap () returned 0xd20000 [0091.802] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44660 | out: hHeap=0xd20000) returned 1 [0091.802] GetProcessHeap () returned 0xd20000 [0091.802] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0091.802] GetProcessHeap () returned 0xd20000 [0091.802] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b3f8 | out: hHeap=0xd20000) returned 1 [0091.802] GetProcessHeap () returned 0xd20000 [0091.802] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.802] GetProcessHeap () returned 0xd20000 [0091.802] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.802] GetProcessHeap () returned 0xd20000 [0091.803] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.803] GetProcessHeap () returned 0xd20000 [0091.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.803] GetProcessHeap () returned 0xd20000 [0091.803] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.803] GetProcessHeap () returned 0xd20000 [0091.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.803] GetProcessHeap () returned 0xd20000 [0091.803] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0091.803] GetProcessHeap () returned 0xd20000 [0091.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0091.803] GetProcessHeap () returned 0xd20000 [0091.803] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.803] GetProcessHeap () returned 0xd20000 [0091.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.803] GetProcessHeap () returned 0xd20000 [0091.803] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.803] GetProcessHeap () returned 0xd20000 [0091.804] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.804] GetProcessHeap () returned 0xd20000 [0091.804] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.804] GetProcessHeap () returned 0xd20000 [0091.804] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.804] GetProcessHeap () returned 0xd20000 [0091.804] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0091.804] GetProcessHeap () returned 0xd20000 [0091.804] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0091.804] GetProcessHeap () returned 0xd20000 [0091.804] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.804] GetProcessHeap () returned 0xd20000 [0091.804] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.804] GetProcessHeap () returned 0xd20000 [0091.804] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.804] GetProcessHeap () returned 0xd20000 [0091.804] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.804] GetProcessHeap () returned 0xd20000 [0091.805] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0091.805] GetProcessHeap () returned 0xd20000 [0091.805] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0091.805] GetProcessHeap () returned 0xd20000 [0091.805] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.805] GetProcessHeap () returned 0xd20000 [0091.805] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.805] GetProcessHeap () returned 0xd20000 [0091.805] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0091.805] GetProcessHeap () returned 0xd20000 [0091.805] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0091.805] GetProcessHeap () returned 0xd20000 [0091.805] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.805] GetProcessHeap () returned 0xd20000 [0091.805] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.805] GetProcessHeap () returned 0xd20000 [0091.805] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0091.805] GetProcessHeap () returned 0xd20000 [0091.806] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0091.806] GetProcessHeap () returned 0xd20000 [0091.806] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.806] GetProcessHeap () returned 0xd20000 [0091.806] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.806] GetProcessHeap () returned 0xd20000 [0091.806] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.806] GetProcessHeap () returned 0xd20000 [0091.806] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.806] GetProcessHeap () returned 0xd20000 [0091.806] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0091.806] GetProcessHeap () returned 0xd20000 [0091.806] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0091.806] GetProcessHeap () returned 0xd20000 [0091.806] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.806] GetProcessHeap () returned 0xd20000 [0091.806] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.806] GetProcessHeap () returned 0xd20000 [0091.806] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.807] GetProcessHeap () returned 0xd20000 [0091.807] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.807] GetProcessHeap () returned 0xd20000 [0091.807] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.807] GetProcessHeap () returned 0xd20000 [0091.807] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.807] GetProcessHeap () returned 0xd20000 [0091.807] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0091.807] GetProcessHeap () returned 0xd20000 [0091.807] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0091.807] GetProcessHeap () returned 0xd20000 [0091.807] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.807] GetProcessHeap () returned 0xd20000 [0091.807] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.807] GetProcessHeap () returned 0xd20000 [0091.807] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0091.807] GetProcessHeap () returned 0xd20000 [0091.807] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0091.808] GetProcessHeap () returned 0xd20000 [0091.808] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.808] GetProcessHeap () returned 0xd20000 [0091.808] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.808] GetProcessHeap () returned 0xd20000 [0091.808] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.808] GetProcessHeap () returned 0xd20000 [0091.808] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.808] GetProcessHeap () returned 0xd20000 [0091.808] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.808] GetProcessHeap () returned 0xd20000 [0091.808] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.808] GetProcessHeap () returned 0xd20000 [0091.808] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.808] GetProcessHeap () returned 0xd20000 [0091.808] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.808] GetProcessHeap () returned 0xd20000 [0091.808] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0091.809] GetProcessHeap () returned 0xd20000 [0091.809] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0091.809] GetProcessHeap () returned 0xd20000 [0091.809] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.809] GetProcessHeap () returned 0xd20000 [0091.809] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.809] GetProcessHeap () returned 0xd20000 [0091.809] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.809] GetProcessHeap () returned 0xd20000 [0091.809] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.809] GetProcessHeap () returned 0xd20000 [0091.809] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0091.809] GetProcessHeap () returned 0xd20000 [0091.809] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0091.809] GetProcessHeap () returned 0xd20000 [0091.809] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0091.809] GetProcessHeap () returned 0xd20000 [0091.809] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0091.810] GetProcessHeap () returned 0xd20000 [0091.810] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.810] GetProcessHeap () returned 0xd20000 [0091.810] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.810] GetProcessHeap () returned 0xd20000 [0091.810] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.810] GetProcessHeap () returned 0xd20000 [0091.810] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.810] GetProcessHeap () returned 0xd20000 [0091.810] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.810] GetProcessHeap () returned 0xd20000 [0091.810] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.810] GetProcessHeap () returned 0xd20000 [0091.810] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.810] GetProcessHeap () returned 0xd20000 [0091.810] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.810] GetProcessHeap () returned 0xd20000 [0091.810] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0091.811] GetProcessHeap () returned 0xd20000 [0091.811] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0091.811] GetProcessHeap () returned 0xd20000 [0091.811] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0091.811] GetProcessHeap () returned 0xd20000 [0091.811] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0091.811] GetProcessHeap () returned 0xd20000 [0091.811] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.811] GetProcessHeap () returned 0xd20000 [0091.811] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.811] GetProcessHeap () returned 0xd20000 [0091.811] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0091.811] GetProcessHeap () returned 0xd20000 [0091.811] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0091.811] GetProcessHeap () returned 0xd20000 [0091.811] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.812] GetProcessHeap () returned 0xd20000 [0091.812] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.812] GetProcessHeap () returned 0xd20000 [0091.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0091.812] GetProcessHeap () returned 0xd20000 [0091.812] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0091.812] GetProcessHeap () returned 0xd20000 [0091.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.812] GetProcessHeap () returned 0xd20000 [0091.812] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.812] GetProcessHeap () returned 0xd20000 [0091.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.812] GetProcessHeap () returned 0xd20000 [0091.812] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.812] GetProcessHeap () returned 0xd20000 [0091.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.812] GetProcessHeap () returned 0xd20000 [0091.812] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.812] GetProcessHeap () returned 0xd20000 [0091.813] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.813] GetProcessHeap () returned 0xd20000 [0091.813] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.813] GetProcessHeap () returned 0xd20000 [0091.813] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0091.813] GetProcessHeap () returned 0xd20000 [0091.813] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0091.813] GetProcessHeap () returned 0xd20000 [0091.813] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.813] GetProcessHeap () returned 0xd20000 [0091.813] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.813] GetProcessHeap () returned 0xd20000 [0091.813] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.813] GetProcessHeap () returned 0xd20000 [0091.813] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.813] GetProcessHeap () returned 0xd20000 [0091.813] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.814] GetProcessHeap () returned 0xd20000 [0091.814] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.814] GetProcessHeap () returned 0xd20000 [0091.814] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0091.814] GetProcessHeap () returned 0xd20000 [0091.814] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0091.814] GetProcessHeap () returned 0xd20000 [0091.814] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.814] GetProcessHeap () returned 0xd20000 [0091.814] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.814] GetProcessHeap () returned 0xd20000 [0091.814] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.814] GetProcessHeap () returned 0xd20000 [0091.814] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.814] GetProcessHeap () returned 0xd20000 [0091.814] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.814] GetProcessHeap () returned 0xd20000 [0091.814] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.815] GetProcessHeap () returned 0xd20000 [0091.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0091.815] GetProcessHeap () returned 0xd20000 [0091.815] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0091.815] GetProcessHeap () returned 0xd20000 [0091.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0091.815] GetProcessHeap () returned 0xd20000 [0091.815] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0091.815] GetProcessHeap () returned 0xd20000 [0091.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0091.815] GetProcessHeap () returned 0xd20000 [0091.815] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0091.815] GetProcessHeap () returned 0xd20000 [0091.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.815] GetProcessHeap () returned 0xd20000 [0091.815] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.815] GetProcessHeap () returned 0xd20000 [0091.816] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.816] GetProcessHeap () returned 0xd20000 [0091.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.816] GetProcessHeap () returned 0xd20000 [0091.816] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0091.816] GetProcessHeap () returned 0xd20000 [0091.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0091.816] GetProcessHeap () returned 0xd20000 [0091.816] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.816] GetProcessHeap () returned 0xd20000 [0091.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.816] GetProcessHeap () returned 0xd20000 [0091.816] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.816] GetProcessHeap () returned 0xd20000 [0091.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.816] GetProcessHeap () returned 0xd20000 [0091.816] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.816] GetProcessHeap () returned 0xd20000 [0091.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.817] GetProcessHeap () returned 0xd20000 [0091.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.817] GetProcessHeap () returned 0xd20000 [0091.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.817] GetProcessHeap () returned 0xd20000 [0091.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0091.817] GetProcessHeap () returned 0xd20000 [0091.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0091.817] GetProcessHeap () returned 0xd20000 [0091.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0091.817] GetProcessHeap () returned 0xd20000 [0091.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0091.817] GetProcessHeap () returned 0xd20000 [0091.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0091.817] GetProcessHeap () returned 0xd20000 [0091.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0091.817] GetProcessHeap () returned 0xd20000 [0091.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.817] GetProcessHeap () returned 0xd20000 [0091.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.818] GetProcessHeap () returned 0xd20000 [0091.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0091.818] GetProcessHeap () returned 0xd20000 [0091.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0091.818] GetProcessHeap () returned 0xd20000 [0091.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.818] GetProcessHeap () returned 0xd20000 [0091.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.818] GetProcessHeap () returned 0xd20000 [0091.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0091.818] GetProcessHeap () returned 0xd20000 [0091.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0091.818] GetProcessHeap () returned 0xd20000 [0091.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0091.818] GetProcessHeap () returned 0xd20000 [0091.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0091.818] GetProcessHeap () returned 0xd20000 [0091.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0091.818] GetProcessHeap () returned 0xd20000 [0091.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0091.819] GetProcessHeap () returned 0xd20000 [0091.819] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0091.819] GetProcessHeap () returned 0xd20000 [0091.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0091.819] GetProcessHeap () returned 0xd20000 [0091.819] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.819] GetProcessHeap () returned 0xd20000 [0091.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.819] GetProcessHeap () returned 0xd20000 [0091.819] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0091.819] GetProcessHeap () returned 0xd20000 [0091.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0091.819] GetProcessHeap () returned 0xd20000 [0091.819] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.819] GetProcessHeap () returned 0xd20000 [0091.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.819] GetProcessHeap () returned 0xd20000 [0091.819] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.819] GetProcessHeap () returned 0xd20000 [0091.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.820] GetProcessHeap () returned 0xd20000 [0091.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0091.820] GetProcessHeap () returned 0xd20000 [0091.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0091.820] GetProcessHeap () returned 0xd20000 [0091.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0091.820] GetProcessHeap () returned 0xd20000 [0091.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0091.820] GetProcessHeap () returned 0xd20000 [0091.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0091.820] GetProcessHeap () returned 0xd20000 [0091.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0091.820] GetProcessHeap () returned 0xd20000 [0091.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.820] GetProcessHeap () returned 0xd20000 [0091.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.820] GetProcessHeap () returned 0xd20000 [0091.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.821] GetProcessHeap () returned 0xd20000 [0091.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.821] GetProcessHeap () returned 0xd20000 [0091.821] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.821] GetProcessHeap () returned 0xd20000 [0091.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.821] GetProcessHeap () returned 0xd20000 [0091.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0091.821] GetProcessHeap () returned 0xd20000 [0091.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0091.821] GetProcessHeap () returned 0xd20000 [0091.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0091.821] GetProcessHeap () returned 0xd20000 [0091.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0091.821] GetProcessHeap () returned 0xd20000 [0091.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444c8 | out: hHeap=0xd20000) returned 1 [0091.821] GetProcessHeap () returned 0xd20000 [0091.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4adc8 | out: hHeap=0xd20000) returned 1 [0091.821] GetProcessHeap () returned 0xd20000 [0091.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0091.822] GetProcessHeap () returned 0xd20000 [0091.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b128 | out: hHeap=0xd20000) returned 1 [0091.822] GetProcessHeap () returned 0xd20000 [0091.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0091.822] GetProcessHeap () returned 0xd20000 [0091.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0091.822] GetProcessHeap () returned 0xd20000 [0091.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0091.822] WriteFile (in: hFile=0x230, lpBuffer=0xd4d838*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d838*, lpNumberOfBytesWritten=0x299d864*=0x383, lpOverlapped=0x0) returned 1 [0091.829] GetProcessHeap () returned 0xd20000 [0091.829] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4d838, Size=0x30) returned 0xd4d838 [0091.829] GetProcessHeap () returned 0xd20000 [0091.829] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0091.830] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0091.830] GetProcessHeap () returned 0xd20000 [0091.830] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x3de10) returned 0xd4d870 [0091.831] ReadFile (in: hFile=0x230, lpBuffer=0xd4d870, nNumberOfBytesToRead=0x3de10, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4d870*, lpNumberOfBytesRead=0x299d7e8*=0x3de10, lpOverlapped=0x0) returned 1 [0091.838] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0091.838] WriteFile (in: hFile=0x230, lpBuffer=0xd4d870*, nNumberOfBytesToWrite=0x3de10, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4d870*, lpNumberOfBytesWritten=0x299d7e4*=0x3de10, lpOverlapped=0x0) returned 1 [0091.843] GetProcessHeap () returned 0xd20000 [0091.843] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4d870 | out: hHeap=0xd20000) returned 1 [0091.844] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0091.844] WriteFile (in: hFile=0x230, lpBuffer=0xd4d838*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d838*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0091.845] CloseHandle (hObject=0x230) returned 1 [0091.855] GetProcessHeap () returned 0xd20000 [0091.855] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd424b8 | out: hHeap=0xd20000) returned 1 [0091.855] GetProcessHeap () returned 0xd20000 [0091.855] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c250 | out: hHeap=0xd20000) returned 1 [0091.855] GetProcessHeap () returned 0xd20000 [0091.855] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0091.855] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" [0091.855] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm.[ponce.lorena@aol.com]" [0091.855] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_bg-bg.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0091.856] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_bg-bg.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0091.856] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0091.856] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0091.856] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0091.857] GetProcessHeap () returned 0xd20000 [0091.857] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44510 | out: hHeap=0xd20000) returned 1 [0091.857] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3c882e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3c882e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x14573, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_cs-cz.htm", cAlternateFileName="EULA_C~1.HTM")) returned 1 [0091.857] lstrcmpiW (lpString1="EULA_cs-cz.htm", lpString2=".") returned 1 [0091.857] lstrcmpiW (lpString1="EULA_cs-cz.htm", lpString2="..") returned 1 [0091.857] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_cs-cz.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" [0091.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_cs-cz.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0091.857] GetProcessHeap () returned 0xd20000 [0091.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd446a8 [0091.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_cs-cz.htm", cchWideChar=-1, lpMultiByteStr=0xd446a8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_cs-cz.htm", lpUsedDefaultChar=0x0) returned 15 [0091.857] lstrlenA (lpString="EULA_cs-cz.htm") returned 14 [0091.857] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0091.857] lstrlenA (lpString="EULA_cs-cz.htm") returned 14 [0091.858] lstrlenA (lpString=".dll") returned 4 [0091.858] lstrlenA (lpString=".dll") returned 4 [0091.858] lstrlenA (lpString="EULA_cs-cz.htm") returned 14 [0091.858] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0091.858] lstrlenA (lpString="EULA_cs-cz.htm") returned 14 [0091.858] lstrlenA (lpString=".ini") returned 4 [0091.858] lstrlenA (lpString=".ini") returned 4 [0091.858] lstrlenA (lpString="EULA_cs-cz.htm") returned 14 [0091.858] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0091.858] lstrlenA (lpString="EULA_cs-cz.htm") returned 14 [0091.858] lstrlenA (lpString=".inc") returned 4 [0091.858] lstrlenA (lpString=".inc") returned 4 [0091.859] lstrlenA (lpString="EULA_cs-cz.htm") returned 14 [0091.859] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0091.859] lstrcmpiW (lpString1="EULA_cs-cz.htm", lpString2="HOW_RECOVER.html") returned -1 [0091.859] lstrcmpiW (lpString1="EULA_cs-cz.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0091.859] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0091.859] lstrcmpiW (lpString1="EULA_cs-cz.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0091.859] GetProcessHeap () returned 0xd20000 [0091.859] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd426c0 [0091.859] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0091.860] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=83315) returned 1 [0091.860] GetProcessHeap () returned 0xd20000 [0091.860] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bf08 [0091.860] GetProcessHeap () returned 0xd20000 [0091.860] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0091.860] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm") returned 52 [0091.860] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0091.860] GetProcessHeap () returned 0xd20000 [0091.860] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0091.860] GetProcessHeap () returned 0xd20000 [0091.860] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x38d) returned 0xd4d870 [0091.861] lstrlenA (lpString="rsa_encrypt") returned 11 [0091.861] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0091.865] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0091.865] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0091.865] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0091.865] GetProcessHeap () returned 0xd20000 [0091.865] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0091.865] lstrlenA (lpString="010001") returned 6 [0091.865] GetProcessHeap () returned 0xd20000 [0091.865] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc48 [0091.865] GetProcessHeap () returned 0xd20000 [0091.865] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0091.865] GetProcessHeap () returned 0xd20000 [0091.865] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ad38 [0091.865] GetProcessHeap () returned 0xd20000 [0091.865] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0091.866] GetProcessHeap () returned 0xd20000 [0091.866] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b3f8 [0091.866] GetProcessHeap () returned 0xd20000 [0091.866] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45528 [0091.866] GetProcessHeap () returned 0xd20000 [0091.866] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0091.866] GetProcessHeap () returned 0xd20000 [0091.866] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0091.866] GetProcessHeap () returned 0xd20000 [0091.866] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.866] GetProcessHeap () returned 0xd20000 [0091.866] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0091.866] GetProcessHeap () returned 0xd20000 [0091.866] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0091.866] GetProcessHeap () returned 0xd20000 [0091.866] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44fb0 [0091.866] GetProcessHeap () returned 0xd20000 [0091.866] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.866] GetProcessHeap () returned 0xd20000 [0091.866] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44468 [0091.867] GetProcessHeap () returned 0xd20000 [0091.867] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b758 [0091.867] GetProcessHeap () returned 0xd20000 [0091.867] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0091.867] GetProcessHeap () returned 0xd20000 [0091.867] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0091.867] GetProcessHeap () returned 0xd20000 [0091.867] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b758 | out: hHeap=0xd20000) returned 1 [0091.867] GetProcessHeap () returned 0xd20000 [0091.867] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0091.867] GetProcessHeap () returned 0xd20000 [0091.867] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44690 [0091.867] GetProcessHeap () returned 0xd20000 [0091.867] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.867] GetProcessHeap () returned 0xd20000 [0091.867] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0091.867] GetProcessHeap () returned 0xd20000 [0091.867] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.867] GetProcessHeap () returned 0xd20000 [0091.867] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.868] GetProcessHeap () returned 0xd20000 [0091.868] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0091.868] GetProcessHeap () returned 0xd20000 [0091.868] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0091.868] GetProcessHeap () returned 0xd20000 [0091.868] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b008 [0091.868] GetProcessHeap () returned 0xd20000 [0091.868] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44690 | out: hHeap=0xd20000) returned 1 [0091.868] GetProcessHeap () returned 0xd20000 [0091.868] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0091.868] GetProcessHeap () returned 0xd20000 [0091.868] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b008 | out: hHeap=0xd20000) returned 1 [0091.868] GetProcessHeap () returned 0xd20000 [0091.868] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.868] GetProcessHeap () returned 0xd20000 [0091.868] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.868] GetProcessHeap () returned 0xd20000 [0091.868] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.868] GetProcessHeap () returned 0xd20000 [0091.868] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.869] GetProcessHeap () returned 0xd20000 [0091.869] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.869] GetProcessHeap () returned 0xd20000 [0091.869] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.869] GetProcessHeap () returned 0xd20000 [0091.869] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.869] GetProcessHeap () returned 0xd20000 [0091.869] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.869] GetProcessHeap () returned 0xd20000 [0091.869] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0091.869] GetProcessHeap () returned 0xd20000 [0091.869] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0091.869] GetProcessHeap () returned 0xd20000 [0091.869] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.869] GetProcessHeap () returned 0xd20000 [0091.869] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.869] GetProcessHeap () returned 0xd20000 [0091.869] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.869] GetProcessHeap () returned 0xd20000 [0091.869] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.869] GetProcessHeap () returned 0xd20000 [0091.870] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.870] GetProcessHeap () returned 0xd20000 [0091.870] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.870] GetProcessHeap () returned 0xd20000 [0091.870] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.870] GetProcessHeap () returned 0xd20000 [0091.870] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.870] GetProcessHeap () returned 0xd20000 [0091.870] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.870] GetProcessHeap () returned 0xd20000 [0091.870] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.870] GetProcessHeap () returned 0xd20000 [0091.870] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.870] GetProcessHeap () returned 0xd20000 [0091.870] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.870] GetProcessHeap () returned 0xd20000 [0091.870] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.870] GetProcessHeap () returned 0xd20000 [0091.870] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.870] GetProcessHeap () returned 0xd20000 [0091.871] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.871] GetProcessHeap () returned 0xd20000 [0091.871] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.871] GetProcessHeap () returned 0xd20000 [0091.871] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.871] GetProcessHeap () returned 0xd20000 [0091.871] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.871] GetProcessHeap () returned 0xd20000 [0091.871] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.871] GetProcessHeap () returned 0xd20000 [0091.871] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.871] GetProcessHeap () returned 0xd20000 [0091.871] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0091.871] GetProcessHeap () returned 0xd20000 [0091.871] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0091.871] GetProcessHeap () returned 0xd20000 [0091.871] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.871] GetProcessHeap () returned 0xd20000 [0091.871] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.872] GetProcessHeap () returned 0xd20000 [0091.872] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.872] GetProcessHeap () returned 0xd20000 [0091.872] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.872] GetProcessHeap () returned 0xd20000 [0091.872] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.872] GetProcessHeap () returned 0xd20000 [0091.872] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.872] GetProcessHeap () returned 0xd20000 [0091.872] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0091.872] GetProcessHeap () returned 0xd20000 [0091.872] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0091.872] GetProcessHeap () returned 0xd20000 [0091.872] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0091.872] GetProcessHeap () returned 0xd20000 [0091.872] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0091.872] GetProcessHeap () returned 0xd20000 [0091.872] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.872] GetProcessHeap () returned 0xd20000 [0091.872] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.872] GetProcessHeap () returned 0xd20000 [0091.873] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.873] GetProcessHeap () returned 0xd20000 [0091.873] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.873] GetProcessHeap () returned 0xd20000 [0091.873] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0091.873] GetProcessHeap () returned 0xd20000 [0091.873] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0091.873] GetProcessHeap () returned 0xd20000 [0091.873] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.873] GetProcessHeap () returned 0xd20000 [0091.873] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.873] GetProcessHeap () returned 0xd20000 [0091.873] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0091.873] GetProcessHeap () returned 0xd20000 [0091.874] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0091.874] GetProcessHeap () returned 0xd20000 [0091.874] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0091.874] GetProcessHeap () returned 0xd20000 [0091.874] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0091.874] GetProcessHeap () returned 0xd20000 [0091.874] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.874] GetProcessHeap () returned 0xd20000 [0091.874] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.874] GetProcessHeap () returned 0xd20000 [0091.874] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0091.874] GetProcessHeap () returned 0xd20000 [0091.874] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0091.874] GetProcessHeap () returned 0xd20000 [0091.874] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.874] GetProcessHeap () returned 0xd20000 [0091.874] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.874] GetProcessHeap () returned 0xd20000 [0091.874] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0091.875] GetProcessHeap () returned 0xd20000 [0091.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0091.875] GetProcessHeap () returned 0xd20000 [0091.875] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.875] GetProcessHeap () returned 0xd20000 [0091.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.875] GetProcessHeap () returned 0xd20000 [0091.875] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.875] GetProcessHeap () returned 0xd20000 [0091.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.875] GetProcessHeap () returned 0xd20000 [0091.875] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.875] GetProcessHeap () returned 0xd20000 [0091.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.875] GetProcessHeap () returned 0xd20000 [0091.875] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0091.875] GetProcessHeap () returned 0xd20000 [0091.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0091.875] GetProcessHeap () returned 0xd20000 [0091.875] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0091.875] GetProcessHeap () returned 0xd20000 [0091.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0091.876] GetProcessHeap () returned 0xd20000 [0091.876] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.876] GetProcessHeap () returned 0xd20000 [0091.876] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.876] GetProcessHeap () returned 0xd20000 [0091.876] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.876] GetProcessHeap () returned 0xd20000 [0091.876] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.876] GetProcessHeap () returned 0xd20000 [0091.876] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0091.876] GetProcessHeap () returned 0xd20000 [0091.876] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0091.876] GetProcessHeap () returned 0xd20000 [0091.876] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.876] GetProcessHeap () returned 0xd20000 [0091.876] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.876] GetProcessHeap () returned 0xd20000 [0091.876] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0091.876] GetProcessHeap () returned 0xd20000 [0091.876] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0091.877] GetProcessHeap () returned 0xd20000 [0091.877] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.877] GetProcessHeap () returned 0xd20000 [0091.877] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.877] GetProcessHeap () returned 0xd20000 [0091.877] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.877] GetProcessHeap () returned 0xd20000 [0091.877] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.877] GetProcessHeap () returned 0xd20000 [0091.877] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.877] GetProcessHeap () returned 0xd20000 [0091.877] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.877] GetProcessHeap () returned 0xd20000 [0091.877] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.877] GetProcessHeap () returned 0xd20000 [0091.877] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.877] GetProcessHeap () returned 0xd20000 [0091.877] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.877] GetProcessHeap () returned 0xd20000 [0091.877] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.877] GetProcessHeap () returned 0xd20000 [0091.878] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0091.878] GetProcessHeap () returned 0xd20000 [0091.878] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0091.878] GetProcessHeap () returned 0xd20000 [0091.878] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.878] GetProcessHeap () returned 0xd20000 [0091.878] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.878] GetProcessHeap () returned 0xd20000 [0091.878] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0091.878] GetProcessHeap () returned 0xd20000 [0091.878] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0091.878] GetProcessHeap () returned 0xd20000 [0091.878] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0091.878] GetProcessHeap () returned 0xd20000 [0091.878] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0091.878] GetProcessHeap () returned 0xd20000 [0091.878] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0091.878] GetProcessHeap () returned 0xd20000 [0091.878] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0091.878] GetProcessHeap () returned 0xd20000 [0091.879] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.879] GetProcessHeap () returned 0xd20000 [0091.879] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.879] GetProcessHeap () returned 0xd20000 [0091.879] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.879] GetProcessHeap () returned 0xd20000 [0091.879] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.879] GetProcessHeap () returned 0xd20000 [0091.879] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0091.879] GetProcessHeap () returned 0xd20000 [0091.879] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0091.879] GetProcessHeap () returned 0xd20000 [0091.879] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.879] GetProcessHeap () returned 0xd20000 [0091.879] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.879] GetProcessHeap () returned 0xd20000 [0091.879] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.879] GetProcessHeap () returned 0xd20000 [0091.879] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.879] GetProcessHeap () returned 0xd20000 [0091.880] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.880] GetProcessHeap () returned 0xd20000 [0091.880] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.880] GetProcessHeap () returned 0xd20000 [0091.880] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.880] GetProcessHeap () returned 0xd20000 [0091.880] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.880] GetProcessHeap () returned 0xd20000 [0091.880] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0091.880] GetProcessHeap () returned 0xd20000 [0091.880] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0091.880] GetProcessHeap () returned 0xd20000 [0091.880] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0091.880] GetProcessHeap () returned 0xd20000 [0091.880] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0091.880] GetProcessHeap () returned 0xd20000 [0091.880] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.880] GetProcessHeap () returned 0xd20000 [0091.880] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.880] GetProcessHeap () returned 0xd20000 [0091.881] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0091.881] GetProcessHeap () returned 0xd20000 [0091.881] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0091.881] GetProcessHeap () returned 0xd20000 [0091.881] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0091.881] GetProcessHeap () returned 0xd20000 [0091.881] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0091.881] GetProcessHeap () returned 0xd20000 [0091.881] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.881] GetProcessHeap () returned 0xd20000 [0091.881] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.881] GetProcessHeap () returned 0xd20000 [0091.881] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0091.881] GetProcessHeap () returned 0xd20000 [0091.881] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0091.881] GetProcessHeap () returned 0xd20000 [0091.881] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.881] GetProcessHeap () returned 0xd20000 [0091.881] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.882] GetProcessHeap () returned 0xd20000 [0091.882] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.882] GetProcessHeap () returned 0xd20000 [0091.882] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.882] GetProcessHeap () returned 0xd20000 [0091.882] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.882] GetProcessHeap () returned 0xd20000 [0091.882] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.882] GetProcessHeap () returned 0xd20000 [0091.882] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.882] GetProcessHeap () returned 0xd20000 [0091.882] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.882] GetProcessHeap () returned 0xd20000 [0091.882] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.882] GetProcessHeap () returned 0xd20000 [0091.882] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.882] GetProcessHeap () returned 0xd20000 [0091.882] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0091.882] GetProcessHeap () returned 0xd20000 [0091.882] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0091.883] GetProcessHeap () returned 0xd20000 [0091.883] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0091.883] GetProcessHeap () returned 0xd20000 [0091.883] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0091.883] GetProcessHeap () returned 0xd20000 [0091.883] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.883] GetProcessHeap () returned 0xd20000 [0091.883] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.883] GetProcessHeap () returned 0xd20000 [0091.883] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.883] GetProcessHeap () returned 0xd20000 [0091.883] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.883] GetProcessHeap () returned 0xd20000 [0091.883] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0091.883] GetProcessHeap () returned 0xd20000 [0091.883] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0091.883] GetProcessHeap () returned 0xd20000 [0091.883] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0091.884] GetProcessHeap () returned 0xd20000 [0091.884] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0091.884] GetProcessHeap () returned 0xd20000 [0091.884] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0091.884] GetProcessHeap () returned 0xd20000 [0091.884] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0091.884] GetProcessHeap () returned 0xd20000 [0091.884] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0091.884] GetProcessHeap () returned 0xd20000 [0091.884] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0091.884] GetProcessHeap () returned 0xd20000 [0091.884] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0091.884] GetProcessHeap () returned 0xd20000 [0091.884] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0091.884] GetProcessHeap () returned 0xd20000 [0091.884] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.885] GetProcessHeap () returned 0xd20000 [0091.885] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.885] GetProcessHeap () returned 0xd20000 [0091.885] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0091.885] GetProcessHeap () returned 0xd20000 [0091.885] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0091.885] GetProcessHeap () returned 0xd20000 [0091.885] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.885] GetProcessHeap () returned 0xd20000 [0091.885] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.885] GetProcessHeap () returned 0xd20000 [0091.885] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.885] GetProcessHeap () returned 0xd20000 [0091.885] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.885] GetProcessHeap () returned 0xd20000 [0091.886] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.886] GetProcessHeap () returned 0xd20000 [0091.886] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.886] GetProcessHeap () returned 0xd20000 [0091.886] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.886] GetProcessHeap () returned 0xd20000 [0091.886] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.886] GetProcessHeap () returned 0xd20000 [0091.886] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0091.886] GetProcessHeap () returned 0xd20000 [0091.886] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0091.886] GetProcessHeap () returned 0xd20000 [0091.886] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0091.886] GetProcessHeap () returned 0xd20000 [0091.886] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0091.886] GetProcessHeap () returned 0xd20000 [0091.887] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44468 | out: hHeap=0xd20000) returned 1 [0091.887] GetProcessHeap () returned 0xd20000 [0091.887] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b3f8 | out: hHeap=0xd20000) returned 1 [0091.887] GetProcessHeap () returned 0xd20000 [0091.887] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0091.887] GetProcessHeap () returned 0xd20000 [0091.887] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ad38 | out: hHeap=0xd20000) returned 1 [0091.887] GetProcessHeap () returned 0xd20000 [0091.887] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0091.887] GetProcessHeap () returned 0xd20000 [0091.887] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0091.887] GetProcessHeap () returned 0xd20000 [0091.887] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0091.887] WriteFile (in: hFile=0x230, lpBuffer=0xd4d870*, nNumberOfBytesToWrite=0x38d, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d870*, lpNumberOfBytesWritten=0x299d864*=0x38d, lpOverlapped=0x0) returned 1 [0091.895] GetProcessHeap () returned 0xd20000 [0091.895] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4d870, Size=0x30) returned 0xd4d870 [0091.895] GetProcessHeap () returned 0xd20000 [0091.895] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0091.895] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0091.895] GetProcessHeap () returned 0xd20000 [0091.895] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x14580) returned 0xd4d8a8 [0091.897] ReadFile (in: hFile=0x230, lpBuffer=0xd4d8a8, nNumberOfBytesToRead=0x14580, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4d8a8*, lpNumberOfBytesRead=0x299d7e8*=0x14580, lpOverlapped=0x0) returned 1 [0091.900] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0091.900] WriteFile (in: hFile=0x230, lpBuffer=0xd4d8a8*, nNumberOfBytesToWrite=0x14580, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4d8a8*, lpNumberOfBytesWritten=0x299d7e4*=0x14580, lpOverlapped=0x0) returned 1 [0091.903] GetProcessHeap () returned 0xd20000 [0091.903] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4d8a8 | out: hHeap=0xd20000) returned 1 [0091.903] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0091.903] WriteFile (in: hFile=0x230, lpBuffer=0xd4d870*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d870*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0091.905] CloseHandle (hObject=0x230) returned 1 [0091.909] GetProcessHeap () returned 0xd20000 [0091.909] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd426c0 | out: hHeap=0xd20000) returned 1 [0091.910] GetProcessHeap () returned 0xd20000 [0091.910] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bf08 | out: hHeap=0xd20000) returned 1 [0091.910] GetProcessHeap () returned 0xd20000 [0091.910] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0091.910] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" [0091.910] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm.[ponce.lorena@aol.com]" [0091.910] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_cs-cz.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0091.911] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_cs-cz.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0091.911] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0091.911] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0091.911] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0091.911] GetProcessHeap () returned 0xd20000 [0091.911] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446a8 | out: hHeap=0xd20000) returned 1 [0091.911] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3caf18, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3caf18, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xfe95, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_da-dk.htm", cAlternateFileName="EULA_D~1.HTM")) returned 1 [0091.911] lstrcmpiW (lpString1="EULA_da-dk.htm", lpString2=".") returned 1 [0091.911] lstrcmpiW (lpString1="EULA_da-dk.htm", lpString2="..") returned 1 [0091.911] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_da-dk.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" [0091.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_da-dk.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0091.911] GetProcessHeap () returned 0xd20000 [0091.911] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd446d8 [0091.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_da-dk.htm", cchWideChar=-1, lpMultiByteStr=0xd446d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_da-dk.htm", lpUsedDefaultChar=0x0) returned 15 [0091.912] lstrlenA (lpString="EULA_da-dk.htm") returned 14 [0091.912] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0091.912] lstrlenA (lpString="EULA_da-dk.htm") returned 14 [0091.912] lstrlenA (lpString=".dll") returned 4 [0091.912] lstrlenA (lpString=".dll") returned 4 [0091.912] lstrlenA (lpString="EULA_da-dk.htm") returned 14 [0091.912] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0091.912] lstrlenA (lpString="EULA_da-dk.htm") returned 14 [0091.912] lstrlenA (lpString=".ini") returned 4 [0091.912] lstrlenA (lpString=".ini") returned 4 [0091.912] lstrlenA (lpString="EULA_da-dk.htm") returned 14 [0091.912] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0091.912] lstrlenA (lpString="EULA_da-dk.htm") returned 14 [0091.912] lstrlenA (lpString=".inc") returned 4 [0091.912] lstrlenA (lpString=".inc") returned 4 [0091.912] lstrlenA (lpString="EULA_da-dk.htm") returned 14 [0091.912] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0091.912] lstrcmpiW (lpString1="EULA_da-dk.htm", lpString2="HOW_RECOVER.html") returned -1 [0091.912] lstrcmpiW (lpString1="EULA_da-dk.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0091.913] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0091.913] lstrcmpiW (lpString1="EULA_da-dk.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0091.913] GetProcessHeap () returned 0xd20000 [0091.913] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd426c0 [0091.913] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0091.914] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=65173) returned 1 [0091.914] GetProcessHeap () returned 0xd20000 [0091.914] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bf80 [0091.915] GetProcessHeap () returned 0xd20000 [0091.915] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0091.915] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm") returned 52 [0091.915] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0091.915] GetProcessHeap () returned 0xd20000 [0091.915] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0091.915] GetProcessHeap () returned 0xd20000 [0091.915] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4d8a8 [0091.915] lstrlenA (lpString="rsa_encrypt") returned 11 [0091.915] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0091.917] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0091.917] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0091.917] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0091.917] GetProcessHeap () returned 0xd20000 [0091.917] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0091.917] lstrlenA (lpString="010001") returned 6 [0091.917] GetProcessHeap () returned 0xd20000 [0091.918] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cdb8 [0091.918] GetProcessHeap () returned 0xd20000 [0091.918] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0091.918] GetProcessHeap () returned 0xd20000 [0091.918] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ad38 [0091.918] GetProcessHeap () returned 0xd20000 [0091.918] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0091.918] GetProcessHeap () returned 0xd20000 [0091.918] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b3f8 [0091.918] GetProcessHeap () returned 0xd20000 [0091.918] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44920 [0091.918] GetProcessHeap () returned 0xd20000 [0091.918] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0091.918] GetProcessHeap () returned 0xd20000 [0091.918] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0091.918] GetProcessHeap () returned 0xd20000 [0091.918] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.918] GetProcessHeap () returned 0xd20000 [0091.918] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0091.919] GetProcessHeap () returned 0xd20000 [0091.919] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0091.919] GetProcessHeap () returned 0xd20000 [0091.919] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd451e0 [0091.919] GetProcessHeap () returned 0xd20000 [0091.919] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.919] GetProcessHeap () returned 0xd20000 [0091.919] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445a0 [0091.919] GetProcessHeap () returned 0xd20000 [0091.919] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b5a8 [0091.919] GetProcessHeap () returned 0xd20000 [0091.919] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0091.919] GetProcessHeap () returned 0xd20000 [0091.919] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0091.919] GetProcessHeap () returned 0xd20000 [0091.919] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b5a8 | out: hHeap=0xd20000) returned 1 [0091.919] GetProcessHeap () returned 0xd20000 [0091.919] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.919] GetProcessHeap () returned 0xd20000 [0091.920] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444f8 [0091.920] GetProcessHeap () returned 0xd20000 [0091.920] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.920] GetProcessHeap () returned 0xd20000 [0091.920] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.920] GetProcessHeap () returned 0xd20000 [0091.920] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0091.920] GetProcessHeap () returned 0xd20000 [0091.921] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0091.921] GetProcessHeap () returned 0xd20000 [0091.921] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.921] GetProcessHeap () returned 0xd20000 [0091.921] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.921] GetProcessHeap () returned 0xd20000 [0091.921] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b368 [0091.921] GetProcessHeap () returned 0xd20000 [0091.921] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444f8 | out: hHeap=0xd20000) returned 1 [0091.921] GetProcessHeap () returned 0xd20000 [0091.921] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0091.921] GetProcessHeap () returned 0xd20000 [0091.921] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b368 | out: hHeap=0xd20000) returned 1 [0091.921] GetProcessHeap () returned 0xd20000 [0091.921] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0091.921] GetProcessHeap () returned 0xd20000 [0091.921] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0091.921] GetProcessHeap () returned 0xd20000 [0091.921] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.922] GetProcessHeap () returned 0xd20000 [0091.922] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.922] GetProcessHeap () returned 0xd20000 [0091.922] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.922] GetProcessHeap () returned 0xd20000 [0091.922] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.922] GetProcessHeap () returned 0xd20000 [0091.922] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0091.922] GetProcessHeap () returned 0xd20000 [0091.922] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0091.922] GetProcessHeap () returned 0xd20000 [0091.922] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.922] GetProcessHeap () returned 0xd20000 [0091.922] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.922] GetProcessHeap () returned 0xd20000 [0091.922] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.922] GetProcessHeap () returned 0xd20000 [0091.922] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.922] GetProcessHeap () returned 0xd20000 [0091.923] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.923] GetProcessHeap () returned 0xd20000 [0091.923] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.923] GetProcessHeap () returned 0xd20000 [0091.923] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.923] GetProcessHeap () returned 0xd20000 [0091.923] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.923] GetProcessHeap () returned 0xd20000 [0091.923] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.923] GetProcessHeap () returned 0xd20000 [0091.923] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.923] GetProcessHeap () returned 0xd20000 [0091.923] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.923] GetProcessHeap () returned 0xd20000 [0091.923] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.923] GetProcessHeap () returned 0xd20000 [0091.923] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.923] GetProcessHeap () returned 0xd20000 [0091.923] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.924] GetProcessHeap () returned 0xd20000 [0091.924] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.924] GetProcessHeap () returned 0xd20000 [0091.924] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.924] GetProcessHeap () returned 0xd20000 [0091.924] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.924] GetProcessHeap () returned 0xd20000 [0091.924] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.924] GetProcessHeap () returned 0xd20000 [0091.924] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.924] GetProcessHeap () returned 0xd20000 [0091.924] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.924] GetProcessHeap () returned 0xd20000 [0091.924] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0091.924] GetProcessHeap () returned 0xd20000 [0091.924] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0091.924] GetProcessHeap () returned 0xd20000 [0091.924] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.924] GetProcessHeap () returned 0xd20000 [0091.925] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.925] GetProcessHeap () returned 0xd20000 [0091.925] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.925] GetProcessHeap () returned 0xd20000 [0091.925] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.925] GetProcessHeap () returned 0xd20000 [0091.925] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.925] GetProcessHeap () returned 0xd20000 [0091.925] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.925] GetProcessHeap () returned 0xd20000 [0091.925] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.925] GetProcessHeap () returned 0xd20000 [0091.925] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.925] GetProcessHeap () returned 0xd20000 [0091.925] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.925] GetProcessHeap () returned 0xd20000 [0091.925] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.925] GetProcessHeap () returned 0xd20000 [0091.925] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.926] GetProcessHeap () returned 0xd20000 [0091.926] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.926] GetProcessHeap () returned 0xd20000 [0091.926] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.926] GetProcessHeap () returned 0xd20000 [0091.926] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.926] GetProcessHeap () returned 0xd20000 [0091.926] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.926] GetProcessHeap () returned 0xd20000 [0091.926] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.926] GetProcessHeap () returned 0xd20000 [0091.926] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0091.926] GetProcessHeap () returned 0xd20000 [0091.926] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0091.926] GetProcessHeap () returned 0xd20000 [0091.926] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.926] GetProcessHeap () returned 0xd20000 [0091.926] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.926] GetProcessHeap () returned 0xd20000 [0091.927] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.927] GetProcessHeap () returned 0xd20000 [0091.927] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.927] GetProcessHeap () returned 0xd20000 [0091.927] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0091.927] GetProcessHeap () returned 0xd20000 [0091.927] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0091.927] GetProcessHeap () returned 0xd20000 [0091.927] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.927] GetProcessHeap () returned 0xd20000 [0091.927] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.927] GetProcessHeap () returned 0xd20000 [0091.927] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0091.927] GetProcessHeap () returned 0xd20000 [0091.927] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0091.927] GetProcessHeap () returned 0xd20000 [0091.927] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.927] GetProcessHeap () returned 0xd20000 [0091.928] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.928] GetProcessHeap () returned 0xd20000 [0091.928] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.928] GetProcessHeap () returned 0xd20000 [0091.928] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.928] GetProcessHeap () returned 0xd20000 [0091.928] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.928] GetProcessHeap () returned 0xd20000 [0091.928] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.928] GetProcessHeap () returned 0xd20000 [0091.928] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.928] GetProcessHeap () returned 0xd20000 [0091.928] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.928] GetProcessHeap () returned 0xd20000 [0091.928] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0091.928] GetProcessHeap () returned 0xd20000 [0091.928] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0091.928] GetProcessHeap () returned 0xd20000 [0091.928] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.929] GetProcessHeap () returned 0xd20000 [0091.929] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.929] GetProcessHeap () returned 0xd20000 [0091.929] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.929] GetProcessHeap () returned 0xd20000 [0091.929] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.929] GetProcessHeap () returned 0xd20000 [0091.929] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.929] GetProcessHeap () returned 0xd20000 [0091.929] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.929] GetProcessHeap () returned 0xd20000 [0091.929] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.929] GetProcessHeap () returned 0xd20000 [0091.929] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.929] GetProcessHeap () returned 0xd20000 [0091.929] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.929] GetProcessHeap () returned 0xd20000 [0091.929] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.929] GetProcessHeap () returned 0xd20000 [0091.930] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.930] GetProcessHeap () returned 0xd20000 [0091.930] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.930] GetProcessHeap () returned 0xd20000 [0091.930] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.930] GetProcessHeap () returned 0xd20000 [0091.930] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.930] GetProcessHeap () returned 0xd20000 [0091.930] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0091.930] GetProcessHeap () returned 0xd20000 [0091.930] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0091.930] GetProcessHeap () returned 0xd20000 [0091.930] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0091.930] GetProcessHeap () returned 0xd20000 [0091.930] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0091.930] GetProcessHeap () returned 0xd20000 [0091.930] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0091.930] GetProcessHeap () returned 0xd20000 [0091.930] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0091.930] GetProcessHeap () returned 0xd20000 [0091.931] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.931] GetProcessHeap () returned 0xd20000 [0091.931] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.931] GetProcessHeap () returned 0xd20000 [0091.931] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.931] GetProcessHeap () returned 0xd20000 [0091.931] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.931] GetProcessHeap () returned 0xd20000 [0091.931] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0091.931] GetProcessHeap () returned 0xd20000 [0091.931] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0091.931] GetProcessHeap () returned 0xd20000 [0091.931] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.931] GetProcessHeap () returned 0xd20000 [0091.931] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.931] GetProcessHeap () returned 0xd20000 [0091.931] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0091.931] GetProcessHeap () returned 0xd20000 [0091.931] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0091.932] GetProcessHeap () returned 0xd20000 [0091.932] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0091.932] GetProcessHeap () returned 0xd20000 [0091.932] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0091.932] GetProcessHeap () returned 0xd20000 [0091.932] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.932] GetProcessHeap () returned 0xd20000 [0091.932] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.932] GetProcessHeap () returned 0xd20000 [0091.932] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.932] GetProcessHeap () returned 0xd20000 [0091.932] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.932] GetProcessHeap () returned 0xd20000 [0091.932] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0091.932] GetProcessHeap () returned 0xd20000 [0091.932] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0091.932] GetProcessHeap () returned 0xd20000 [0091.932] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0091.932] GetProcessHeap () returned 0xd20000 [0091.933] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0091.933] GetProcessHeap () returned 0xd20000 [0091.933] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.933] GetProcessHeap () returned 0xd20000 [0091.933] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.933] GetProcessHeap () returned 0xd20000 [0091.933] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0091.933] GetProcessHeap () returned 0xd20000 [0091.933] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0091.933] GetProcessHeap () returned 0xd20000 [0091.933] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.933] GetProcessHeap () returned 0xd20000 [0091.933] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.933] GetProcessHeap () returned 0xd20000 [0091.933] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.933] GetProcessHeap () returned 0xd20000 [0091.933] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.933] GetProcessHeap () returned 0xd20000 [0091.933] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.934] GetProcessHeap () returned 0xd20000 [0091.934] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.934] GetProcessHeap () returned 0xd20000 [0091.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0091.934] GetProcessHeap () returned 0xd20000 [0091.934] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0091.934] GetProcessHeap () returned 0xd20000 [0091.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0091.934] GetProcessHeap () returned 0xd20000 [0091.934] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0091.934] GetProcessHeap () returned 0xd20000 [0091.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.934] GetProcessHeap () returned 0xd20000 [0091.934] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.934] GetProcessHeap () returned 0xd20000 [0091.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0091.934] GetProcessHeap () returned 0xd20000 [0091.934] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0091.934] GetProcessHeap () returned 0xd20000 [0091.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0091.934] GetProcessHeap () returned 0xd20000 [0091.935] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0091.935] GetProcessHeap () returned 0xd20000 [0091.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.935] GetProcessHeap () returned 0xd20000 [0091.935] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.935] GetProcessHeap () returned 0xd20000 [0091.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0091.935] GetProcessHeap () returned 0xd20000 [0091.935] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0091.935] GetProcessHeap () returned 0xd20000 [0091.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0091.935] GetProcessHeap () returned 0xd20000 [0091.935] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0091.935] GetProcessHeap () returned 0xd20000 [0091.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0091.935] GetProcessHeap () returned 0xd20000 [0091.935] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0091.935] GetProcessHeap () returned 0xd20000 [0091.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.935] GetProcessHeap () returned 0xd20000 [0091.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.936] GetProcessHeap () returned 0xd20000 [0091.936] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.936] GetProcessHeap () returned 0xd20000 [0091.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.936] GetProcessHeap () returned 0xd20000 [0091.936] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.936] GetProcessHeap () returned 0xd20000 [0091.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.936] GetProcessHeap () returned 0xd20000 [0091.936] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.936] GetProcessHeap () returned 0xd20000 [0091.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.936] GetProcessHeap () returned 0xd20000 [0091.936] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.936] GetProcessHeap () returned 0xd20000 [0091.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.936] GetProcessHeap () returned 0xd20000 [0091.936] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.937] GetProcessHeap () returned 0xd20000 [0091.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.937] GetProcessHeap () returned 0xd20000 [0091.937] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.937] GetProcessHeap () returned 0xd20000 [0091.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.937] GetProcessHeap () returned 0xd20000 [0091.937] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0091.937] GetProcessHeap () returned 0xd20000 [0091.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0091.937] GetProcessHeap () returned 0xd20000 [0091.937] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.937] GetProcessHeap () returned 0xd20000 [0091.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.937] GetProcessHeap () returned 0xd20000 [0091.937] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.937] GetProcessHeap () returned 0xd20000 [0091.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.937] GetProcessHeap () returned 0xd20000 [0091.937] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0091.938] GetProcessHeap () returned 0xd20000 [0091.938] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0091.938] GetProcessHeap () returned 0xd20000 [0091.938] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0091.938] GetProcessHeap () returned 0xd20000 [0091.938] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0091.938] GetProcessHeap () returned 0xd20000 [0091.938] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0091.938] GetProcessHeap () returned 0xd20000 [0091.938] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0091.938] GetProcessHeap () returned 0xd20000 [0091.938] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0091.938] GetProcessHeap () returned 0xd20000 [0091.938] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0091.938] GetProcessHeap () returned 0xd20000 [0091.938] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.938] GetProcessHeap () returned 0xd20000 [0091.938] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.938] GetProcessHeap () returned 0xd20000 [0091.938] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0091.939] GetProcessHeap () returned 0xd20000 [0091.939] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0091.939] GetProcessHeap () returned 0xd20000 [0091.939] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0091.939] GetProcessHeap () returned 0xd20000 [0091.939] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0091.939] GetProcessHeap () returned 0xd20000 [0091.939] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0091.939] GetProcessHeap () returned 0xd20000 [0091.939] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0091.939] GetProcessHeap () returned 0xd20000 [0091.939] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0091.939] GetProcessHeap () returned 0xd20000 [0091.939] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0091.939] GetProcessHeap () returned 0xd20000 [0091.939] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445a0 | out: hHeap=0xd20000) returned 1 [0091.939] GetProcessHeap () returned 0xd20000 [0091.939] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b3f8 | out: hHeap=0xd20000) returned 1 [0091.939] GetProcessHeap () returned 0xd20000 [0091.940] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0091.940] GetProcessHeap () returned 0xd20000 [0091.940] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ad38 | out: hHeap=0xd20000) returned 1 [0091.940] GetProcessHeap () returned 0xd20000 [0091.940] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0091.940] GetProcessHeap () returned 0xd20000 [0091.940] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0091.940] GetProcessHeap () returned 0xd20000 [0091.940] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0091.940] WriteFile (in: hFile=0x230, lpBuffer=0xd4d8a8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d8a8*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0091.979] GetProcessHeap () returned 0xd20000 [0091.979] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4d8a8, Size=0x30) returned 0xd4d8a8 [0091.979] GetProcessHeap () returned 0xd20000 [0091.979] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0091.980] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0091.980] GetProcessHeap () returned 0xd20000 [0091.980] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xfe95) returned 0xd4d8e0 [0091.980] ReadFile (in: hFile=0x230, lpBuffer=0xd4d8e0, nNumberOfBytesToRead=0xfe95, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4d8e0*, lpNumberOfBytesRead=0x299d7e8*=0xfe95, lpOverlapped=0x0) returned 1 [0091.985] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0091.986] WriteFile (in: hFile=0x230, lpBuffer=0xd4d8e0*, nNumberOfBytesToWrite=0xfe95, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4d8e0*, lpNumberOfBytesWritten=0x299d7e4*=0xfe95, lpOverlapped=0x0) returned 1 [0091.989] GetProcessHeap () returned 0xd20000 [0091.989] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4d8e0 | out: hHeap=0xd20000) returned 1 [0091.989] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0091.989] WriteFile (in: hFile=0x230, lpBuffer=0xd4d8a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d8a8*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0091.991] CloseHandle (hObject=0x230) returned 1 [0091.995] GetProcessHeap () returned 0xd20000 [0091.995] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd426c0 | out: hHeap=0xd20000) returned 1 [0091.995] GetProcessHeap () returned 0xd20000 [0091.995] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bf80 | out: hHeap=0xd20000) returned 1 [0091.995] GetProcessHeap () returned 0xd20000 [0091.995] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0091.995] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" [0091.995] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm.[ponce.lorena@aol.com]" [0091.995] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_da-dk.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0092.001] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_da-dk.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0092.002] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0092.002] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0092.002] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0092.002] GetProcessHeap () returned 0xd20000 [0092.002] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446d8 | out: hHeap=0xd20000) returned 1 [0092.002] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d10e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d10e9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1133d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_de-de.htm", cAlternateFileName="EULA_D~2.HTM")) returned 1 [0092.002] lstrcmpiW (lpString1="EULA_de-de.htm", lpString2=".") returned 1 [0092.002] lstrcmpiW (lpString1="EULA_de-de.htm", lpString2="..") returned 1 [0092.002] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_de-de.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" [0092.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_de-de.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0092.002] GetProcessHeap () returned 0xd20000 [0092.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd44438 [0092.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_de-de.htm", cchWideChar=-1, lpMultiByteStr=0xd44438, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_de-de.htm", lpUsedDefaultChar=0x0) returned 15 [0092.002] lstrlenA (lpString="EULA_de-de.htm") returned 14 [0092.002] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0092.002] lstrlenA (lpString="EULA_de-de.htm") returned 14 [0092.003] lstrlenA (lpString=".dll") returned 4 [0092.003] lstrlenA (lpString=".dll") returned 4 [0092.003] lstrlenA (lpString="EULA_de-de.htm") returned 14 [0092.003] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0092.003] lstrlenA (lpString="EULA_de-de.htm") returned 14 [0092.003] lstrlenA (lpString=".ini") returned 4 [0092.003] lstrlenA (lpString=".ini") returned 4 [0092.003] lstrlenA (lpString="EULA_de-de.htm") returned 14 [0092.003] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0092.003] lstrlenA (lpString="EULA_de-de.htm") returned 14 [0092.003] lstrlenA (lpString=".inc") returned 4 [0092.003] lstrlenA (lpString=".inc") returned 4 [0092.003] lstrlenA (lpString="EULA_de-de.htm") returned 14 [0092.003] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0092.003] lstrcmpiW (lpString1="EULA_de-de.htm", lpString2="HOW_RECOVER.html") returned -1 [0092.003] lstrcmpiW (lpString1="EULA_de-de.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0092.003] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0092.003] lstrcmpiW (lpString1="EULA_de-de.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0092.004] GetProcessHeap () returned 0xd20000 [0092.004] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd428a0 [0092.004] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0092.004] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=70461) returned 1 [0092.004] GetProcessHeap () returned 0xd20000 [0092.004] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4be90 [0092.004] GetProcessHeap () returned 0xd20000 [0092.004] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0092.004] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm") returned 52 [0092.004] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0092.005] GetProcessHeap () returned 0xd20000 [0092.005] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0092.005] GetProcessHeap () returned 0xd20000 [0092.005] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x383) returned 0xd4d8e0 [0092.005] lstrlenA (lpString="rsa_encrypt") returned 11 [0092.005] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0092.007] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0092.007] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0092.007] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0092.007] GetProcessHeap () returned 0xd20000 [0092.007] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0092.008] lstrlenA (lpString="010001") returned 6 [0092.008] GetProcessHeap () returned 0xd20000 [0092.008] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc98 [0092.008] GetProcessHeap () returned 0xd20000 [0092.008] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0092.008] GetProcessHeap () returned 0xd20000 [0092.008] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aa68 [0092.008] GetProcessHeap () returned 0xd20000 [0092.008] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0092.008] GetProcessHeap () returned 0xd20000 [0092.008] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b008 [0092.008] GetProcessHeap () returned 0xd20000 [0092.008] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd450c8 [0092.008] GetProcessHeap () returned 0xd20000 [0092.008] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0092.008] GetProcessHeap () returned 0xd20000 [0092.008] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0092.008] GetProcessHeap () returned 0xd20000 [0092.009] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.009] GetProcessHeap () returned 0xd20000 [0092.009] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0092.009] GetProcessHeap () returned 0xd20000 [0092.009] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0092.009] GetProcessHeap () returned 0xd20000 [0092.009] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd451e0 [0092.009] GetProcessHeap () returned 0xd20000 [0092.009] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0092.009] GetProcessHeap () returned 0xd20000 [0092.009] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44510 [0092.009] GetProcessHeap () returned 0xd20000 [0092.009] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b1b8 [0092.009] GetProcessHeap () returned 0xd20000 [0092.009] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0092.009] GetProcessHeap () returned 0xd20000 [0092.009] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0092.009] GetProcessHeap () returned 0xd20000 [0092.009] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b1b8 | out: hHeap=0xd20000) returned 1 [0092.009] GetProcessHeap () returned 0xd20000 [0092.009] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.010] GetProcessHeap () returned 0xd20000 [0092.010] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445a0 [0092.010] GetProcessHeap () returned 0xd20000 [0092.010] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0092.010] GetProcessHeap () returned 0xd20000 [0092.010] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.010] GetProcessHeap () returned 0xd20000 [0092.010] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.010] GetProcessHeap () returned 0xd20000 [0092.010] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.010] GetProcessHeap () returned 0xd20000 [0092.010] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0092.010] GetProcessHeap () returned 0xd20000 [0092.010] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0092.010] GetProcessHeap () returned 0xd20000 [0092.010] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b518 [0092.010] GetProcessHeap () returned 0xd20000 [0092.010] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445a0 | out: hHeap=0xd20000) returned 1 [0092.010] GetProcessHeap () returned 0xd20000 [0092.011] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0092.011] GetProcessHeap () returned 0xd20000 [0092.011] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0092.011] GetProcessHeap () returned 0xd20000 [0092.011] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.011] GetProcessHeap () returned 0xd20000 [0092.011] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.011] GetProcessHeap () returned 0xd20000 [0092.011] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0092.011] GetProcessHeap () returned 0xd20000 [0092.011] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0092.011] GetProcessHeap () returned 0xd20000 [0092.011] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.011] GetProcessHeap () returned 0xd20000 [0092.011] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.011] GetProcessHeap () returned 0xd20000 [0092.011] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.011] GetProcessHeap () returned 0xd20000 [0092.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.012] GetProcessHeap () returned 0xd20000 [0092.012] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.012] GetProcessHeap () returned 0xd20000 [0092.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.012] GetProcessHeap () returned 0xd20000 [0092.012] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0092.012] GetProcessHeap () returned 0xd20000 [0092.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0092.012] GetProcessHeap () returned 0xd20000 [0092.012] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0092.012] GetProcessHeap () returned 0xd20000 [0092.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0092.012] GetProcessHeap () returned 0xd20000 [0092.012] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.012] GetProcessHeap () returned 0xd20000 [0092.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.012] GetProcessHeap () returned 0xd20000 [0092.012] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.013] GetProcessHeap () returned 0xd20000 [0092.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.013] GetProcessHeap () returned 0xd20000 [0092.013] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0092.013] GetProcessHeap () returned 0xd20000 [0092.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0092.013] GetProcessHeap () returned 0xd20000 [0092.013] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.013] GetProcessHeap () returned 0xd20000 [0092.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.013] GetProcessHeap () returned 0xd20000 [0092.013] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0092.013] GetProcessHeap () returned 0xd20000 [0092.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0092.013] GetProcessHeap () returned 0xd20000 [0092.013] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0092.013] GetProcessHeap () returned 0xd20000 [0092.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0092.013] GetProcessHeap () returned 0xd20000 [0092.014] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.014] GetProcessHeap () returned 0xd20000 [0092.014] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.014] GetProcessHeap () returned 0xd20000 [0092.014] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0092.014] GetProcessHeap () returned 0xd20000 [0092.014] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0092.014] GetProcessHeap () returned 0xd20000 [0092.015] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.015] GetProcessHeap () returned 0xd20000 [0092.015] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.015] GetProcessHeap () returned 0xd20000 [0092.015] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0092.015] GetProcessHeap () returned 0xd20000 [0092.015] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0092.015] GetProcessHeap () returned 0xd20000 [0092.015] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.015] GetProcessHeap () returned 0xd20000 [0092.015] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.015] GetProcessHeap () returned 0xd20000 [0092.015] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.015] GetProcessHeap () returned 0xd20000 [0092.015] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.015] GetProcessHeap () returned 0xd20000 [0092.015] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.015] GetProcessHeap () returned 0xd20000 [0092.015] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.016] GetProcessHeap () returned 0xd20000 [0092.016] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0092.016] GetProcessHeap () returned 0xd20000 [0092.016] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0092.016] GetProcessHeap () returned 0xd20000 [0092.016] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0092.016] GetProcessHeap () returned 0xd20000 [0092.016] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0092.016] GetProcessHeap () returned 0xd20000 [0092.016] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.016] GetProcessHeap () returned 0xd20000 [0092.016] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.016] GetProcessHeap () returned 0xd20000 [0092.016] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.016] GetProcessHeap () returned 0xd20000 [0092.016] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.016] GetProcessHeap () returned 0xd20000 [0092.016] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0092.016] GetProcessHeap () returned 0xd20000 [0092.016] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0092.017] GetProcessHeap () returned 0xd20000 [0092.017] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.017] GetProcessHeap () returned 0xd20000 [0092.017] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.017] GetProcessHeap () returned 0xd20000 [0092.017] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0092.017] GetProcessHeap () returned 0xd20000 [0092.017] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0092.017] GetProcessHeap () returned 0xd20000 [0092.017] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.017] GetProcessHeap () returned 0xd20000 [0092.017] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.017] GetProcessHeap () returned 0xd20000 [0092.017] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.017] GetProcessHeap () returned 0xd20000 [0092.017] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.017] GetProcessHeap () returned 0xd20000 [0092.017] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.017] GetProcessHeap () returned 0xd20000 [0092.018] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.018] GetProcessHeap () returned 0xd20000 [0092.018] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.018] GetProcessHeap () returned 0xd20000 [0092.018] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.018] GetProcessHeap () returned 0xd20000 [0092.018] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.018] GetProcessHeap () returned 0xd20000 [0092.018] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.018] GetProcessHeap () returned 0xd20000 [0092.018] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0092.018] GetProcessHeap () returned 0xd20000 [0092.018] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0092.018] GetProcessHeap () returned 0xd20000 [0092.018] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.018] GetProcessHeap () returned 0xd20000 [0092.018] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.018] GetProcessHeap () returned 0xd20000 [0092.018] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0092.018] GetProcessHeap () returned 0xd20000 [0092.019] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0092.019] GetProcessHeap () returned 0xd20000 [0092.019] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0092.019] GetProcessHeap () returned 0xd20000 [0092.019] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0092.019] GetProcessHeap () returned 0xd20000 [0092.019] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0092.019] GetProcessHeap () returned 0xd20000 [0092.019] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0092.019] GetProcessHeap () returned 0xd20000 [0092.019] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.019] GetProcessHeap () returned 0xd20000 [0092.019] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.019] GetProcessHeap () returned 0xd20000 [0092.019] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.019] GetProcessHeap () returned 0xd20000 [0092.019] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.019] GetProcessHeap () returned 0xd20000 [0092.019] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0092.020] GetProcessHeap () returned 0xd20000 [0092.020] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0092.020] GetProcessHeap () returned 0xd20000 [0092.020] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.020] GetProcessHeap () returned 0xd20000 [0092.020] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.020] GetProcessHeap () returned 0xd20000 [0092.020] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.020] GetProcessHeap () returned 0xd20000 [0092.020] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.020] GetProcessHeap () returned 0xd20000 [0092.020] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.020] GetProcessHeap () returned 0xd20000 [0092.020] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.020] GetProcessHeap () returned 0xd20000 [0092.020] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.020] GetProcessHeap () returned 0xd20000 [0092.020] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.020] GetProcessHeap () returned 0xd20000 [0092.021] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0092.021] GetProcessHeap () returned 0xd20000 [0092.021] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0092.021] GetProcessHeap () returned 0xd20000 [0092.021] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0092.021] GetProcessHeap () returned 0xd20000 [0092.021] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0092.021] GetProcessHeap () returned 0xd20000 [0092.021] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.021] GetProcessHeap () returned 0xd20000 [0092.021] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.021] GetProcessHeap () returned 0xd20000 [0092.021] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0092.021] GetProcessHeap () returned 0xd20000 [0092.021] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0092.021] GetProcessHeap () returned 0xd20000 [0092.021] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0092.021] GetProcessHeap () returned 0xd20000 [0092.021] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0092.021] GetProcessHeap () returned 0xd20000 [0092.021] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.022] GetProcessHeap () returned 0xd20000 [0092.022] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.022] GetProcessHeap () returned 0xd20000 [0092.022] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0092.022] GetProcessHeap () returned 0xd20000 [0092.022] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0092.022] GetProcessHeap () returned 0xd20000 [0092.022] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.022] GetProcessHeap () returned 0xd20000 [0092.022] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.022] GetProcessHeap () returned 0xd20000 [0092.022] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.022] GetProcessHeap () returned 0xd20000 [0092.022] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.022] GetProcessHeap () returned 0xd20000 [0092.022] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.022] GetProcessHeap () returned 0xd20000 [0092.022] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.022] GetProcessHeap () returned 0xd20000 [0092.022] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.023] GetProcessHeap () returned 0xd20000 [0092.023] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.023] GetProcessHeap () returned 0xd20000 [0092.023] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.023] GetProcessHeap () returned 0xd20000 [0092.023] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.023] GetProcessHeap () returned 0xd20000 [0092.023] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0092.023] GetProcessHeap () returned 0xd20000 [0092.023] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0092.023] GetProcessHeap () returned 0xd20000 [0092.023] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0092.023] GetProcessHeap () returned 0xd20000 [0092.023] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0092.023] GetProcessHeap () returned 0xd20000 [0092.023] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0092.023] GetProcessHeap () returned 0xd20000 [0092.023] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0092.023] GetProcessHeap () returned 0xd20000 [0092.023] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.024] GetProcessHeap () returned 0xd20000 [0092.024] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.024] GetProcessHeap () returned 0xd20000 [0092.024] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0092.024] GetProcessHeap () returned 0xd20000 [0092.024] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0092.024] GetProcessHeap () returned 0xd20000 [0092.024] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0092.024] GetProcessHeap () returned 0xd20000 [0092.024] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0092.024] GetProcessHeap () returned 0xd20000 [0092.024] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0092.024] GetProcessHeap () returned 0xd20000 [0092.024] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0092.024] GetProcessHeap () returned 0xd20000 [0092.024] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0092.024] GetProcessHeap () returned 0xd20000 [0092.024] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0092.024] GetProcessHeap () returned 0xd20000 [0092.024] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0092.024] GetProcessHeap () returned 0xd20000 [0092.025] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0092.025] GetProcessHeap () returned 0xd20000 [0092.025] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.025] GetProcessHeap () returned 0xd20000 [0092.025] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.025] GetProcessHeap () returned 0xd20000 [0092.025] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0092.025] GetProcessHeap () returned 0xd20000 [0092.025] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0092.025] GetProcessHeap () returned 0xd20000 [0092.025] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.025] GetProcessHeap () returned 0xd20000 [0092.025] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.025] GetProcessHeap () returned 0xd20000 [0092.025] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.025] GetProcessHeap () returned 0xd20000 [0092.025] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.025] GetProcessHeap () returned 0xd20000 [0092.025] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.025] GetProcessHeap () returned 0xd20000 [0092.025] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.026] GetProcessHeap () returned 0xd20000 [0092.026] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.026] GetProcessHeap () returned 0xd20000 [0092.026] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.026] GetProcessHeap () returned 0xd20000 [0092.026] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0092.026] GetProcessHeap () returned 0xd20000 [0092.026] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0092.026] GetProcessHeap () returned 0xd20000 [0092.026] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.026] GetProcessHeap () returned 0xd20000 [0092.026] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.026] GetProcessHeap () returned 0xd20000 [0092.026] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0092.026] GetProcessHeap () returned 0xd20000 [0092.026] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0092.026] GetProcessHeap () returned 0xd20000 [0092.026] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.026] GetProcessHeap () returned 0xd20000 [0092.026] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.027] GetProcessHeap () returned 0xd20000 [0092.027] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0092.027] GetProcessHeap () returned 0xd20000 [0092.027] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0092.027] GetProcessHeap () returned 0xd20000 [0092.027] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.027] GetProcessHeap () returned 0xd20000 [0092.027] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.027] GetProcessHeap () returned 0xd20000 [0092.027] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0092.027] GetProcessHeap () returned 0xd20000 [0092.027] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0092.027] GetProcessHeap () returned 0xd20000 [0092.027] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.027] GetProcessHeap () returned 0xd20000 [0092.027] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.027] GetProcessHeap () returned 0xd20000 [0092.027] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0092.027] GetProcessHeap () returned 0xd20000 [0092.027] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0092.027] GetProcessHeap () returned 0xd20000 [0092.028] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.028] GetProcessHeap () returned 0xd20000 [0092.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.028] GetProcessHeap () returned 0xd20000 [0092.028] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0092.028] GetProcessHeap () returned 0xd20000 [0092.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0092.028] GetProcessHeap () returned 0xd20000 [0092.028] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0092.028] GetProcessHeap () returned 0xd20000 [0092.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0092.028] GetProcessHeap () returned 0xd20000 [0092.028] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.028] GetProcessHeap () returned 0xd20000 [0092.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.028] GetProcessHeap () returned 0xd20000 [0092.028] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.028] GetProcessHeap () returned 0xd20000 [0092.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.028] GetProcessHeap () returned 0xd20000 [0092.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0092.029] GetProcessHeap () returned 0xd20000 [0092.029] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0092.029] GetProcessHeap () returned 0xd20000 [0092.029] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0092.029] GetProcessHeap () returned 0xd20000 [0092.029] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0092.029] GetProcessHeap () returned 0xd20000 [0092.029] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44510 | out: hHeap=0xd20000) returned 1 [0092.029] GetProcessHeap () returned 0xd20000 [0092.029] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b008 | out: hHeap=0xd20000) returned 1 [0092.029] GetProcessHeap () returned 0xd20000 [0092.029] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0092.029] GetProcessHeap () returned 0xd20000 [0092.029] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aa68 | out: hHeap=0xd20000) returned 1 [0092.166] GetProcessHeap () returned 0xd20000 [0092.166] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0092.166] GetProcessHeap () returned 0xd20000 [0092.166] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0092.166] GetProcessHeap () returned 0xd20000 [0092.166] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0092.167] WriteFile (in: hFile=0x230, lpBuffer=0xd4d8e0*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d8e0*, lpNumberOfBytesWritten=0x299d864*=0x383, lpOverlapped=0x0) returned 1 [0092.174] GetProcessHeap () returned 0xd20000 [0092.174] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4d8e0, Size=0x30) returned 0xd4d8e0 [0092.174] GetProcessHeap () returned 0xd20000 [0092.174] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0092.174] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0092.174] GetProcessHeap () returned 0xd20000 [0092.174] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x11340) returned 0xd4d918 [0092.175] ReadFile (in: hFile=0x230, lpBuffer=0xd4d918, nNumberOfBytesToRead=0x11340, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4d918*, lpNumberOfBytesRead=0x299d7e8*=0x11340, lpOverlapped=0x0) returned 1 [0092.178] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0092.178] WriteFile (in: hFile=0x230, lpBuffer=0xd4d918*, nNumberOfBytesToWrite=0x11340, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4d918*, lpNumberOfBytesWritten=0x299d7e4*=0x11340, lpOverlapped=0x0) returned 1 [0092.199] GetProcessHeap () returned 0xd20000 [0092.199] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4d918 | out: hHeap=0xd20000) returned 1 [0092.199] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0092.199] WriteFile (in: hFile=0x230, lpBuffer=0xd4d8e0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d8e0*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0092.201] CloseHandle (hObject=0x230) returned 1 [0092.206] GetProcessHeap () returned 0xd20000 [0092.206] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd428a0 | out: hHeap=0xd20000) returned 1 [0092.206] GetProcessHeap () returned 0xd20000 [0092.206] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4be90 | out: hHeap=0xd20000) returned 1 [0092.206] GetProcessHeap () returned 0xd20000 [0092.206] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0092.206] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" [0092.206] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm.[ponce.lorena@aol.com]" [0092.206] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_de-de.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0092.207] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_de-de.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0092.207] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0092.207] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0092.207] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0092.207] GetProcessHeap () returned 0xd20000 [0092.207] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44438 | out: hHeap=0xd20000) returned 1 [0092.207] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d2466, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d2466, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x3a756, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_el-gr.htm", cAlternateFileName="EULA_E~1.HTM")) returned 1 [0092.207] lstrcmpiW (lpString1="EULA_el-gr.htm", lpString2=".") returned 1 [0092.207] lstrcmpiW (lpString1="EULA_el-gr.htm", lpString2="..") returned 1 [0092.208] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_el-gr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" [0092.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_el-gr.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0092.208] GetProcessHeap () returned 0xd20000 [0092.208] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd445a0 [0092.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_el-gr.htm", cchWideChar=-1, lpMultiByteStr=0xd445a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_el-gr.htm", lpUsedDefaultChar=0x0) returned 15 [0092.208] lstrlenA (lpString="EULA_el-gr.htm") returned 14 [0092.208] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0092.208] lstrlenA (lpString="EULA_el-gr.htm") returned 14 [0092.208] lstrlenA (lpString=".dll") returned 4 [0092.208] lstrlenA (lpString=".dll") returned 4 [0092.208] lstrlenA (lpString="EULA_el-gr.htm") returned 14 [0092.208] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0092.208] lstrlenA (lpString="EULA_el-gr.htm") returned 14 [0092.208] lstrlenA (lpString=".ini") returned 4 [0092.208] lstrlenA (lpString=".ini") returned 4 [0092.208] lstrlenA (lpString="EULA_el-gr.htm") returned 14 [0092.208] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0092.208] lstrlenA (lpString="EULA_el-gr.htm") returned 14 [0092.208] lstrlenA (lpString=".inc") returned 4 [0092.209] lstrlenA (lpString=".inc") returned 4 [0092.209] lstrlenA (lpString="EULA_el-gr.htm") returned 14 [0092.209] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0092.209] lstrcmpiW (lpString1="EULA_el-gr.htm", lpString2="HOW_RECOVER.html") returned -1 [0092.209] lstrcmpiW (lpString1="EULA_el-gr.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0092.209] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0092.209] lstrcmpiW (lpString1="EULA_el-gr.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0092.209] GetProcessHeap () returned 0xd20000 [0092.209] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd426c0 [0092.209] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0092.209] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=239446) returned 1 [0092.210] GetProcessHeap () returned 0xd20000 [0092.210] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bf08 [0092.210] GetProcessHeap () returned 0xd20000 [0092.210] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0092.210] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm") returned 52 [0092.210] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0092.210] GetProcessHeap () returned 0xd20000 [0092.210] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0092.210] GetProcessHeap () returned 0xd20000 [0092.210] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4d918 [0092.210] lstrlenA (lpString="rsa_encrypt") returned 11 [0092.210] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0092.212] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0092.212] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0092.213] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0092.213] GetProcessHeap () returned 0xd20000 [0092.213] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0092.213] lstrlenA (lpString="010001") returned 6 [0092.213] GetProcessHeap () returned 0xd20000 [0092.213] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cbe8 [0092.213] GetProcessHeap () returned 0xd20000 [0092.213] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0092.213] GetProcessHeap () returned 0xd20000 [0092.213] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0092.213] GetProcessHeap () returned 0xd20000 [0092.213] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0092.213] GetProcessHeap () returned 0xd20000 [0092.213] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b368 [0092.213] GetProcessHeap () returned 0xd20000 [0092.213] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44d80 [0092.213] GetProcessHeap () returned 0xd20000 [0092.213] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc28 [0092.214] GetProcessHeap () returned 0xd20000 [0092.214] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0092.214] GetProcessHeap () returned 0xd20000 [0092.214] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0092.214] GetProcessHeap () returned 0xd20000 [0092.214] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0092.214] GetProcessHeap () returned 0xd20000 [0092.214] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0092.214] GetProcessHeap () returned 0xd20000 [0092.214] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd451e0 [0092.214] GetProcessHeap () returned 0xd20000 [0092.214] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.214] GetProcessHeap () returned 0xd20000 [0092.214] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445d0 [0092.214] GetProcessHeap () returned 0xd20000 [0092.214] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b7e8 [0092.214] GetProcessHeap () returned 0xd20000 [0092.214] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0092.214] GetProcessHeap () returned 0xd20000 [0092.214] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0092.215] GetProcessHeap () returned 0xd20000 [0092.215] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0092.215] GetProcessHeap () returned 0xd20000 [0092.215] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.215] GetProcessHeap () returned 0xd20000 [0092.215] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446f0 [0092.215] GetProcessHeap () returned 0xd20000 [0092.215] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.215] GetProcessHeap () returned 0xd20000 [0092.215] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.215] GetProcessHeap () returned 0xd20000 [0092.215] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.215] GetProcessHeap () returned 0xd20000 [0092.215] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.215] GetProcessHeap () returned 0xd20000 [0092.215] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.215] GetProcessHeap () returned 0xd20000 [0092.215] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.216] GetProcessHeap () returned 0xd20000 [0092.216] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4ae58 [0092.216] GetProcessHeap () returned 0xd20000 [0092.216] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446f0 | out: hHeap=0xd20000) returned 1 [0092.216] GetProcessHeap () returned 0xd20000 [0092.216] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0092.216] GetProcessHeap () returned 0xd20000 [0092.216] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ae58 | out: hHeap=0xd20000) returned 1 [0092.216] GetProcessHeap () returned 0xd20000 [0092.216] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0092.216] GetProcessHeap () returned 0xd20000 [0092.216] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0092.216] GetProcessHeap () returned 0xd20000 [0092.216] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.216] GetProcessHeap () returned 0xd20000 [0092.216] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.216] GetProcessHeap () returned 0xd20000 [0092.216] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.216] GetProcessHeap () returned 0xd20000 [0092.217] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.217] GetProcessHeap () returned 0xd20000 [0092.217] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0092.223] GetProcessHeap () returned 0xd20000 [0092.223] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0092.223] GetProcessHeap () returned 0xd20000 [0092.223] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0092.223] GetProcessHeap () returned 0xd20000 [0092.223] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0092.223] GetProcessHeap () returned 0xd20000 [0092.223] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.223] GetProcessHeap () returned 0xd20000 [0092.223] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.223] GetProcessHeap () returned 0xd20000 [0092.224] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.224] GetProcessHeap () returned 0xd20000 [0092.224] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.224] GetProcessHeap () returned 0xd20000 [0092.224] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0092.224] GetProcessHeap () returned 0xd20000 [0092.224] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0092.224] GetProcessHeap () returned 0xd20000 [0092.224] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0092.224] GetProcessHeap () returned 0xd20000 [0092.224] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0092.224] GetProcessHeap () returned 0xd20000 [0092.224] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0092.224] GetProcessHeap () returned 0xd20000 [0092.224] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0092.224] GetProcessHeap () returned 0xd20000 [0092.224] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0092.224] GetProcessHeap () returned 0xd20000 [0092.224] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0092.225] GetProcessHeap () returned 0xd20000 [0092.225] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.225] GetProcessHeap () returned 0xd20000 [0092.225] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.225] GetProcessHeap () returned 0xd20000 [0092.225] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0092.225] GetProcessHeap () returned 0xd20000 [0092.225] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0092.225] GetProcessHeap () returned 0xd20000 [0092.225] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0092.225] GetProcessHeap () returned 0xd20000 [0092.225] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0092.225] GetProcessHeap () returned 0xd20000 [0092.225] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0092.225] GetProcessHeap () returned 0xd20000 [0092.225] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0092.225] GetProcessHeap () returned 0xd20000 [0092.225] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.225] GetProcessHeap () returned 0xd20000 [0092.225] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.226] GetProcessHeap () returned 0xd20000 [0092.226] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0092.226] GetProcessHeap () returned 0xd20000 [0092.226] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0092.226] GetProcessHeap () returned 0xd20000 [0092.226] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.226] GetProcessHeap () returned 0xd20000 [0092.226] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.226] GetProcessHeap () returned 0xd20000 [0092.226] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.226] GetProcessHeap () returned 0xd20000 [0092.226] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.226] GetProcessHeap () returned 0xd20000 [0092.226] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0092.226] GetProcessHeap () returned 0xd20000 [0092.226] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0092.226] GetProcessHeap () returned 0xd20000 [0092.226] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.226] GetProcessHeap () returned 0xd20000 [0092.227] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.227] GetProcessHeap () returned 0xd20000 [0092.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.227] GetProcessHeap () returned 0xd20000 [0092.227] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.227] GetProcessHeap () returned 0xd20000 [0092.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.227] GetProcessHeap () returned 0xd20000 [0092.227] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.227] GetProcessHeap () returned 0xd20000 [0092.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0092.227] GetProcessHeap () returned 0xd20000 [0092.227] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0092.227] GetProcessHeap () returned 0xd20000 [0092.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0092.227] GetProcessHeap () returned 0xd20000 [0092.227] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0092.227] GetProcessHeap () returned 0xd20000 [0092.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.228] GetProcessHeap () returned 0xd20000 [0092.228] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.228] GetProcessHeap () returned 0xd20000 [0092.228] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.228] GetProcessHeap () returned 0xd20000 [0092.228] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.228] GetProcessHeap () returned 0xd20000 [0092.228] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0092.228] GetProcessHeap () returned 0xd20000 [0092.228] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0092.228] GetProcessHeap () returned 0xd20000 [0092.228] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0092.228] GetProcessHeap () returned 0xd20000 [0092.228] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0092.228] GetProcessHeap () returned 0xd20000 [0092.228] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0092.228] GetProcessHeap () returned 0xd20000 [0092.228] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0092.229] GetProcessHeap () returned 0xd20000 [0092.229] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.229] GetProcessHeap () returned 0xd20000 [0092.229] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.229] GetProcessHeap () returned 0xd20000 [0092.229] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0092.229] GetProcessHeap () returned 0xd20000 [0092.229] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0092.229] GetProcessHeap () returned 0xd20000 [0092.229] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0092.229] GetProcessHeap () returned 0xd20000 [0092.229] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0092.229] GetProcessHeap () returned 0xd20000 [0092.229] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.229] GetProcessHeap () returned 0xd20000 [0092.229] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.229] GetProcessHeap () returned 0xd20000 [0092.229] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0092.229] GetProcessHeap () returned 0xd20000 [0092.230] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0092.230] GetProcessHeap () returned 0xd20000 [0092.230] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0092.230] GetProcessHeap () returned 0xd20000 [0092.230] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0092.230] GetProcessHeap () returned 0xd20000 [0092.230] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.230] GetProcessHeap () returned 0xd20000 [0092.230] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.230] GetProcessHeap () returned 0xd20000 [0092.230] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0092.230] GetProcessHeap () returned 0xd20000 [0092.230] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0092.230] GetProcessHeap () returned 0xd20000 [0092.230] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0092.230] GetProcessHeap () returned 0xd20000 [0092.230] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0092.230] GetProcessHeap () returned 0xd20000 [0092.231] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0092.231] GetProcessHeap () returned 0xd20000 [0092.231] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0092.231] GetProcessHeap () returned 0xd20000 [0092.231] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.231] GetProcessHeap () returned 0xd20000 [0092.231] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.231] GetProcessHeap () returned 0xd20000 [0092.231] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0092.231] GetProcessHeap () returned 0xd20000 [0092.231] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0092.231] GetProcessHeap () returned 0xd20000 [0092.231] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.231] GetProcessHeap () returned 0xd20000 [0092.231] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.231] GetProcessHeap () returned 0xd20000 [0092.231] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0092.231] GetProcessHeap () returned 0xd20000 [0092.232] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0092.232] GetProcessHeap () returned 0xd20000 [0092.232] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0092.232] GetProcessHeap () returned 0xd20000 [0092.232] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0092.232] GetProcessHeap () returned 0xd20000 [0092.232] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0092.232] GetProcessHeap () returned 0xd20000 [0092.232] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0092.232] GetProcessHeap () returned 0xd20000 [0092.232] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0092.232] GetProcessHeap () returned 0xd20000 [0092.232] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0092.232] GetProcessHeap () returned 0xd20000 [0092.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.234] GetProcessHeap () returned 0xd20000 [0092.234] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.234] GetProcessHeap () returned 0xd20000 [0092.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0092.234] GetProcessHeap () returned 0xd20000 [0092.234] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0092.234] GetProcessHeap () returned 0xd20000 [0092.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0092.234] GetProcessHeap () returned 0xd20000 [0092.234] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0092.234] GetProcessHeap () returned 0xd20000 [0092.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.234] GetProcessHeap () returned 0xd20000 [0092.234] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.234] GetProcessHeap () returned 0xd20000 [0092.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0092.235] GetProcessHeap () returned 0xd20000 [0092.235] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0092.235] GetProcessHeap () returned 0xd20000 [0092.235] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0092.235] GetProcessHeap () returned 0xd20000 [0092.235] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0092.235] GetProcessHeap () returned 0xd20000 [0092.235] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0092.235] GetProcessHeap () returned 0xd20000 [0092.235] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0092.235] GetProcessHeap () returned 0xd20000 [0092.235] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.235] GetProcessHeap () returned 0xd20000 [0092.235] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.235] GetProcessHeap () returned 0xd20000 [0092.235] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.235] GetProcessHeap () returned 0xd20000 [0092.235] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.235] GetProcessHeap () returned 0xd20000 [0092.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.236] GetProcessHeap () returned 0xd20000 [0092.236] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.236] GetProcessHeap () returned 0xd20000 [0092.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.236] GetProcessHeap () returned 0xd20000 [0092.236] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.236] GetProcessHeap () returned 0xd20000 [0092.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.236] GetProcessHeap () returned 0xd20000 [0092.236] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.236] GetProcessHeap () returned 0xd20000 [0092.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.236] GetProcessHeap () returned 0xd20000 [0092.236] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.236] GetProcessHeap () returned 0xd20000 [0092.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.236] GetProcessHeap () returned 0xd20000 [0092.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.237] GetProcessHeap () returned 0xd20000 [0092.237] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0092.237] GetProcessHeap () returned 0xd20000 [0092.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0092.237] GetProcessHeap () returned 0xd20000 [0092.237] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.237] GetProcessHeap () returned 0xd20000 [0092.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.237] GetProcessHeap () returned 0xd20000 [0092.237] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.237] GetProcessHeap () returned 0xd20000 [0092.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.237] GetProcessHeap () returned 0xd20000 [0092.237] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0092.237] GetProcessHeap () returned 0xd20000 [0092.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0092.237] GetProcessHeap () returned 0xd20000 [0092.237] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0092.237] GetProcessHeap () returned 0xd20000 [0092.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0092.238] GetProcessHeap () returned 0xd20000 [0092.238] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0092.238] GetProcessHeap () returned 0xd20000 [0092.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0092.238] GetProcessHeap () returned 0xd20000 [0092.238] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0092.238] GetProcessHeap () returned 0xd20000 [0092.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0092.238] GetProcessHeap () returned 0xd20000 [0092.238] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.238] GetProcessHeap () returned 0xd20000 [0092.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.238] GetProcessHeap () returned 0xd20000 [0092.238] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.238] GetProcessHeap () returned 0xd20000 [0092.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.238] GetProcessHeap () returned 0xd20000 [0092.238] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.238] GetProcessHeap () returned 0xd20000 [0092.239] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.239] GetProcessHeap () returned 0xd20000 [0092.239] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0092.239] GetProcessHeap () returned 0xd20000 [0092.239] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0092.239] GetProcessHeap () returned 0xd20000 [0092.239] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0092.239] GetProcessHeap () returned 0xd20000 [0092.239] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0092.239] GetProcessHeap () returned 0xd20000 [0092.239] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0092.239] GetProcessHeap () returned 0xd20000 [0092.239] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0092.239] GetProcessHeap () returned 0xd20000 [0092.239] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0092.239] GetProcessHeap () returned 0xd20000 [0092.239] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0092.239] GetProcessHeap () returned 0xd20000 [0092.239] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0092.240] GetProcessHeap () returned 0xd20000 [0092.240] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0092.240] GetProcessHeap () returned 0xd20000 [0092.240] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.240] GetProcessHeap () returned 0xd20000 [0092.240] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.240] GetProcessHeap () returned 0xd20000 [0092.240] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0092.240] GetProcessHeap () returned 0xd20000 [0092.240] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0092.240] GetProcessHeap () returned 0xd20000 [0092.240] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0092.240] GetProcessHeap () returned 0xd20000 [0092.240] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0092.240] GetProcessHeap () returned 0xd20000 [0092.240] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.240] GetProcessHeap () returned 0xd20000 [0092.240] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.240] GetProcessHeap () returned 0xd20000 [0092.240] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0092.240] GetProcessHeap () returned 0xd20000 [0092.241] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0092.241] GetProcessHeap () returned 0xd20000 [0092.241] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0092.241] GetProcessHeap () returned 0xd20000 [0092.241] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0092.241] GetProcessHeap () returned 0xd20000 [0092.241] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0092.241] GetProcessHeap () returned 0xd20000 [0092.241] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0092.241] GetProcessHeap () returned 0xd20000 [0092.241] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.241] GetProcessHeap () returned 0xd20000 [0092.241] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.241] GetProcessHeap () returned 0xd20000 [0092.241] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0092.241] GetProcessHeap () returned 0xd20000 [0092.241] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0092.241] GetProcessHeap () returned 0xd20000 [0092.241] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0092.242] GetProcessHeap () returned 0xd20000 [0092.242] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0092.242] GetProcessHeap () returned 0xd20000 [0092.242] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0092.242] GetProcessHeap () returned 0xd20000 [0092.242] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0092.242] GetProcessHeap () returned 0xd20000 [0092.242] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445d0 | out: hHeap=0xd20000) returned 1 [0092.242] GetProcessHeap () returned 0xd20000 [0092.242] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b368 | out: hHeap=0xd20000) returned 1 [0092.242] GetProcessHeap () returned 0xd20000 [0092.242] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0092.242] GetProcessHeap () returned 0xd20000 [0092.242] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0092.242] GetProcessHeap () returned 0xd20000 [0092.242] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0092.242] GetProcessHeap () returned 0xd20000 [0092.242] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0092.243] GetProcessHeap () returned 0xd20000 [0092.243] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0092.243] WriteFile (in: hFile=0x230, lpBuffer=0xd4d918*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d918*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0092.291] GetProcessHeap () returned 0xd20000 [0092.291] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4d918, Size=0x30) returned 0xd4d918 [0092.291] GetProcessHeap () returned 0xd20000 [0092.292] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0092.292] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0092.292] GetProcessHeap () returned 0xd20000 [0092.292] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x3a756) returned 0xd4d950 [0092.414] ReadFile (in: hFile=0x230, lpBuffer=0xd4d950, nNumberOfBytesToRead=0x3a756, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4d950*, lpNumberOfBytesRead=0x299d7e8*=0x3a756, lpOverlapped=0x0) returned 1 [0092.475] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0092.475] WriteFile (in: hFile=0x230, lpBuffer=0xd4d950*, nNumberOfBytesToWrite=0x3a756, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4d950*, lpNumberOfBytesWritten=0x299d7e4*=0x3a756, lpOverlapped=0x0) returned 1 [0092.798] GetProcessHeap () returned 0xd20000 [0092.798] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4d950 | out: hHeap=0xd20000) returned 1 [0092.798] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0092.798] WriteFile (in: hFile=0x230, lpBuffer=0xd4d918*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d918*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0092.800] CloseHandle (hObject=0x230) returned 1 [0092.808] GetProcessHeap () returned 0xd20000 [0092.808] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd426c0 | out: hHeap=0xd20000) returned 1 [0092.808] GetProcessHeap () returned 0xd20000 [0092.808] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bf08 | out: hHeap=0xd20000) returned 1 [0092.808] GetProcessHeap () returned 0xd20000 [0092.808] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0092.808] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" [0092.808] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm.[ponce.lorena@aol.com]" [0092.808] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_el-gr.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0092.809] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_el-gr.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0092.809] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0092.809] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0092.809] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0092.809] GetProcessHeap () returned 0xd20000 [0092.809] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445a0 | out: hHeap=0xd20000) returned 1 [0092.809] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d5f05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d5f05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xe4b5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_en-gb.htm", cAlternateFileName="EULA_E~2.HTM")) returned 1 [0092.810] lstrcmpiW (lpString1="EULA_en-gb.htm", lpString2=".") returned 1 [0092.810] lstrcmpiW (lpString1="EULA_en-gb.htm", lpString2="..") returned 1 [0092.810] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_en-gb.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" [0092.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_en-gb.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0092.810] GetProcessHeap () returned 0xd20000 [0092.810] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd444c8 [0092.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_en-gb.htm", cchWideChar=-1, lpMultiByteStr=0xd444c8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_en-gb.htm", lpUsedDefaultChar=0x0) returned 15 [0092.810] lstrlenA (lpString="EULA_en-gb.htm") returned 14 [0092.810] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0092.810] lstrlenA (lpString="EULA_en-gb.htm") returned 14 [0092.810] lstrlenA (lpString=".dll") returned 4 [0092.810] lstrlenA (lpString=".dll") returned 4 [0092.810] lstrlenA (lpString="EULA_en-gb.htm") returned 14 [0092.810] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0092.810] lstrlenA (lpString="EULA_en-gb.htm") returned 14 [0092.810] lstrlenA (lpString=".ini") returned 4 [0092.810] lstrlenA (lpString=".ini") returned 4 [0092.810] lstrlenA (lpString="EULA_en-gb.htm") returned 14 [0092.810] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0092.810] lstrlenA (lpString="EULA_en-gb.htm") returned 14 [0092.811] lstrlenA (lpString=".inc") returned 4 [0092.811] lstrlenA (lpString=".inc") returned 4 [0092.811] lstrlenA (lpString="EULA_en-gb.htm") returned 14 [0092.811] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0092.811] lstrcmpiW (lpString1="EULA_en-gb.htm", lpString2="HOW_RECOVER.html") returned -1 [0092.811] lstrcmpiW (lpString1="EULA_en-gb.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0092.811] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0092.811] lstrcmpiW (lpString1="EULA_en-gb.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0092.811] GetProcessHeap () returned 0xd20000 [0092.811] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd426c0 [0092.811] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0092.812] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=58549) returned 1 [0092.812] GetProcessHeap () returned 0xd20000 [0092.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bd28 [0092.812] GetProcessHeap () returned 0xd20000 [0092.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0092.812] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm") returned 52 [0092.812] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0092.812] GetProcessHeap () returned 0xd20000 [0092.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0092.812] GetProcessHeap () returned 0xd20000 [0092.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4d950 [0092.814] lstrlenA (lpString="rsa_encrypt") returned 11 [0092.814] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0092.817] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0092.817] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0092.817] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0092.817] GetProcessHeap () returned 0xd20000 [0092.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0092.817] lstrlenA (lpString="010001") returned 6 [0092.817] GetProcessHeap () returned 0xd20000 [0092.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc98 [0092.817] GetProcessHeap () returned 0xd20000 [0092.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0092.817] GetProcessHeap () returned 0xd20000 [0092.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4a948 [0092.817] GetProcessHeap () returned 0xd20000 [0092.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0092.817] GetProcessHeap () returned 0xd20000 [0092.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b5a8 [0092.818] GetProcessHeap () returned 0xd20000 [0092.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45410 [0092.818] GetProcessHeap () returned 0xd20000 [0092.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd98 [0092.818] GetProcessHeap () returned 0xd20000 [0092.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0092.818] GetProcessHeap () returned 0xd20000 [0092.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.818] GetProcessHeap () returned 0xd20000 [0092.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0092.818] GetProcessHeap () returned 0xd20000 [0092.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0092.818] GetProcessHeap () returned 0xd20000 [0092.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44e98 [0092.818] GetProcessHeap () returned 0xd20000 [0092.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.818] GetProcessHeap () returned 0xd20000 [0092.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444e0 [0092.818] GetProcessHeap () returned 0xd20000 [0092.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4a9d8 [0092.818] GetProcessHeap () returned 0xd20000 [0092.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0092.819] GetProcessHeap () returned 0xd20000 [0092.819] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0092.819] GetProcessHeap () returned 0xd20000 [0092.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a9d8 | out: hHeap=0xd20000) returned 1 [0092.819] GetProcessHeap () returned 0xd20000 [0092.819] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0092.819] GetProcessHeap () returned 0xd20000 [0092.819] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444f8 [0092.819] GetProcessHeap () returned 0xd20000 [0092.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.819] GetProcessHeap () returned 0xd20000 [0092.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0092.819] GetProcessHeap () returned 0xd20000 [0092.819] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.819] GetProcessHeap () returned 0xd20000 [0092.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.819] GetProcessHeap () returned 0xd20000 [0092.819] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0092.819] GetProcessHeap () returned 0xd20000 [0092.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0092.820] GetProcessHeap () returned 0xd20000 [0092.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b488 [0092.820] GetProcessHeap () returned 0xd20000 [0092.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444f8 | out: hHeap=0xd20000) returned 1 [0092.820] GetProcessHeap () returned 0xd20000 [0092.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0092.820] GetProcessHeap () returned 0xd20000 [0092.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b488 | out: hHeap=0xd20000) returned 1 [0092.820] GetProcessHeap () returned 0xd20000 [0092.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0092.820] GetProcessHeap () returned 0xd20000 [0092.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0092.820] GetProcessHeap () returned 0xd20000 [0092.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.820] GetProcessHeap () returned 0xd20000 [0092.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.820] GetProcessHeap () returned 0xd20000 [0092.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0092.820] GetProcessHeap () returned 0xd20000 [0092.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0092.821] GetProcessHeap () returned 0xd20000 [0092.821] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.821] GetProcessHeap () returned 0xd20000 [0092.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.821] GetProcessHeap () returned 0xd20000 [0092.821] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.821] GetProcessHeap () returned 0xd20000 [0092.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.821] GetProcessHeap () returned 0xd20000 [0092.821] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.821] GetProcessHeap () returned 0xd20000 [0092.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.821] GetProcessHeap () returned 0xd20000 [0092.821] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0092.821] GetProcessHeap () returned 0xd20000 [0092.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0092.821] GetProcessHeap () returned 0xd20000 [0092.821] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0092.821] GetProcessHeap () returned 0xd20000 [0092.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0092.822] GetProcessHeap () returned 0xd20000 [0092.822] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.822] GetProcessHeap () returned 0xd20000 [0092.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.822] GetProcessHeap () returned 0xd20000 [0092.822] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.822] GetProcessHeap () returned 0xd20000 [0092.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.822] GetProcessHeap () returned 0xd20000 [0092.822] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0092.822] GetProcessHeap () returned 0xd20000 [0092.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0092.822] GetProcessHeap () returned 0xd20000 [0092.822] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.822] GetProcessHeap () returned 0xd20000 [0092.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.822] GetProcessHeap () returned 0xd20000 [0092.822] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0092.822] GetProcessHeap () returned 0xd20000 [0092.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0092.823] GetProcessHeap () returned 0xd20000 [0092.823] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.823] GetProcessHeap () returned 0xd20000 [0092.823] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.823] GetProcessHeap () returned 0xd20000 [0092.823] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.823] GetProcessHeap () returned 0xd20000 [0092.823] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.823] GetProcessHeap () returned 0xd20000 [0092.823] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.823] GetProcessHeap () returned 0xd20000 [0092.823] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.823] GetProcessHeap () returned 0xd20000 [0092.823] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.823] GetProcessHeap () returned 0xd20000 [0092.823] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.823] GetProcessHeap () returned 0xd20000 [0092.823] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.823] GetProcessHeap () returned 0xd20000 [0092.823] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.824] GetProcessHeap () returned 0xd20000 [0092.824] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0092.824] GetProcessHeap () returned 0xd20000 [0092.824] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0092.824] GetProcessHeap () returned 0xd20000 [0092.824] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.824] GetProcessHeap () returned 0xd20000 [0092.824] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.824] GetProcessHeap () returned 0xd20000 [0092.824] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0092.824] GetProcessHeap () returned 0xd20000 [0092.824] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0092.824] GetProcessHeap () returned 0xd20000 [0092.824] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0092.824] GetProcessHeap () returned 0xd20000 [0092.824] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0092.824] GetProcessHeap () returned 0xd20000 [0092.824] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0092.824] GetProcessHeap () returned 0xd20000 [0092.824] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0092.824] GetProcessHeap () returned 0xd20000 [0092.824] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.824] GetProcessHeap () returned 0xd20000 [0092.825] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.825] GetProcessHeap () returned 0xd20000 [0092.825] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.825] GetProcessHeap () returned 0xd20000 [0092.825] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.825] GetProcessHeap () returned 0xd20000 [0092.825] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0092.825] GetProcessHeap () returned 0xd20000 [0092.825] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0092.825] GetProcessHeap () returned 0xd20000 [0092.825] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.825] GetProcessHeap () returned 0xd20000 [0092.825] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.825] GetProcessHeap () returned 0xd20000 [0092.825] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.825] GetProcessHeap () returned 0xd20000 [0092.825] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.825] GetProcessHeap () returned 0xd20000 [0092.825] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.825] GetProcessHeap () returned 0xd20000 [0092.826] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.826] GetProcessHeap () returned 0xd20000 [0092.826] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.826] GetProcessHeap () returned 0xd20000 [0092.826] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.826] GetProcessHeap () returned 0xd20000 [0092.826] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0092.826] GetProcessHeap () returned 0xd20000 [0092.826] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0092.826] GetProcessHeap () returned 0xd20000 [0092.826] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0092.826] GetProcessHeap () returned 0xd20000 [0092.826] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0092.826] GetProcessHeap () returned 0xd20000 [0092.826] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.826] GetProcessHeap () returned 0xd20000 [0092.826] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.826] GetProcessHeap () returned 0xd20000 [0092.826] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0092.826] GetProcessHeap () returned 0xd20000 [0092.826] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0092.826] GetProcessHeap () returned 0xd20000 [0092.827] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0092.827] GetProcessHeap () returned 0xd20000 [0092.827] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0092.827] GetProcessHeap () returned 0xd20000 [0092.827] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.827] GetProcessHeap () returned 0xd20000 [0092.827] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.827] GetProcessHeap () returned 0xd20000 [0092.827] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0092.827] GetProcessHeap () returned 0xd20000 [0092.827] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0092.827] GetProcessHeap () returned 0xd20000 [0092.827] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.827] GetProcessHeap () returned 0xd20000 [0092.827] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.827] GetProcessHeap () returned 0xd20000 [0092.827] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.827] GetProcessHeap () returned 0xd20000 [0092.827] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.827] GetProcessHeap () returned 0xd20000 [0092.827] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.828] GetProcessHeap () returned 0xd20000 [0092.828] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.828] GetProcessHeap () returned 0xd20000 [0092.828] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.828] GetProcessHeap () returned 0xd20000 [0092.828] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.828] GetProcessHeap () returned 0xd20000 [0092.828] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.828] GetProcessHeap () returned 0xd20000 [0092.828] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.828] GetProcessHeap () returned 0xd20000 [0092.828] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0092.828] GetProcessHeap () returned 0xd20000 [0092.828] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0092.829] GetProcessHeap () returned 0xd20000 [0092.829] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0092.829] GetProcessHeap () returned 0xd20000 [0092.829] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0092.829] GetProcessHeap () returned 0xd20000 [0092.829] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0092.829] GetProcessHeap () returned 0xd20000 [0092.829] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0092.829] GetProcessHeap () returned 0xd20000 [0092.829] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.829] GetProcessHeap () returned 0xd20000 [0092.829] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.829] GetProcessHeap () returned 0xd20000 [0092.829] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0092.829] GetProcessHeap () returned 0xd20000 [0092.829] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0092.829] GetProcessHeap () returned 0xd20000 [0092.829] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0092.829] GetProcessHeap () returned 0xd20000 [0092.829] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0092.830] GetProcessHeap () returned 0xd20000 [0092.830] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0092.830] GetProcessHeap () returned 0xd20000 [0092.830] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0092.830] GetProcessHeap () returned 0xd20000 [0092.830] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0092.830] GetProcessHeap () returned 0xd20000 [0092.830] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0092.830] GetProcessHeap () returned 0xd20000 [0092.830] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0092.830] GetProcessHeap () returned 0xd20000 [0092.830] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0092.830] GetProcessHeap () returned 0xd20000 [0092.830] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.830] GetProcessHeap () returned 0xd20000 [0092.830] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.830] GetProcessHeap () returned 0xd20000 [0092.830] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0092.830] GetProcessHeap () returned 0xd20000 [0092.830] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0092.830] GetProcessHeap () returned 0xd20000 [0092.831] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.831] GetProcessHeap () returned 0xd20000 [0092.831] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.831] GetProcessHeap () returned 0xd20000 [0092.831] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.831] GetProcessHeap () returned 0xd20000 [0092.831] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.831] GetProcessHeap () returned 0xd20000 [0092.831] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.831] GetProcessHeap () returned 0xd20000 [0092.831] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.831] GetProcessHeap () returned 0xd20000 [0092.831] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.831] GetProcessHeap () returned 0xd20000 [0092.831] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.831] GetProcessHeap () returned 0xd20000 [0092.831] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0092.831] GetProcessHeap () returned 0xd20000 [0092.831] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0092.832] GetProcessHeap () returned 0xd20000 [0092.832] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.832] GetProcessHeap () returned 0xd20000 [0092.832] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.832] GetProcessHeap () returned 0xd20000 [0092.832] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0092.832] GetProcessHeap () returned 0xd20000 [0092.832] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0092.832] GetProcessHeap () returned 0xd20000 [0092.832] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.832] GetProcessHeap () returned 0xd20000 [0092.832] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.832] GetProcessHeap () returned 0xd20000 [0092.832] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0092.832] GetProcessHeap () returned 0xd20000 [0092.832] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0092.832] GetProcessHeap () returned 0xd20000 [0092.832] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.832] GetProcessHeap () returned 0xd20000 [0092.832] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.832] GetProcessHeap () returned 0xd20000 [0092.833] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0092.833] GetProcessHeap () returned 0xd20000 [0092.833] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0092.833] GetProcessHeap () returned 0xd20000 [0092.833] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.833] GetProcessHeap () returned 0xd20000 [0092.833] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.833] GetProcessHeap () returned 0xd20000 [0092.833] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0092.833] GetProcessHeap () returned 0xd20000 [0092.833] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0092.833] GetProcessHeap () returned 0xd20000 [0092.833] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.833] GetProcessHeap () returned 0xd20000 [0092.833] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.833] GetProcessHeap () returned 0xd20000 [0092.833] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0092.833] GetProcessHeap () returned 0xd20000 [0092.833] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0092.833] GetProcessHeap () returned 0xd20000 [0092.833] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0092.834] GetProcessHeap () returned 0xd20000 [0092.834] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0092.834] GetProcessHeap () returned 0xd20000 [0092.834] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.834] GetProcessHeap () returned 0xd20000 [0092.834] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.834] GetProcessHeap () returned 0xd20000 [0092.834] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0092.834] GetProcessHeap () returned 0xd20000 [0092.834] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0092.834] GetProcessHeap () returned 0xd20000 [0092.834] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0092.834] GetProcessHeap () returned 0xd20000 [0092.834] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0092.834] GetProcessHeap () returned 0xd20000 [0092.834] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.834] GetProcessHeap () returned 0xd20000 [0092.834] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.834] GetProcessHeap () returned 0xd20000 [0092.834] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.834] GetProcessHeap () returned 0xd20000 [0092.835] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.835] GetProcessHeap () returned 0xd20000 [0092.835] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.835] GetProcessHeap () returned 0xd20000 [0092.835] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.835] GetProcessHeap () returned 0xd20000 [0092.835] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0092.835] GetProcessHeap () returned 0xd20000 [0092.835] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0092.835] GetProcessHeap () returned 0xd20000 [0092.835] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.835] GetProcessHeap () returned 0xd20000 [0092.835] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.835] GetProcessHeap () returned 0xd20000 [0092.835] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0092.835] GetProcessHeap () returned 0xd20000 [0092.835] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0092.835] GetProcessHeap () returned 0xd20000 [0092.835] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.835] GetProcessHeap () returned 0xd20000 [0092.835] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.836] GetProcessHeap () returned 0xd20000 [0092.836] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0092.836] GetProcessHeap () returned 0xd20000 [0092.836] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0092.836] GetProcessHeap () returned 0xd20000 [0092.836] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0092.836] GetProcessHeap () returned 0xd20000 [0092.836] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0092.836] GetProcessHeap () returned 0xd20000 [0092.836] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0092.836] GetProcessHeap () returned 0xd20000 [0092.836] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0092.836] GetProcessHeap () returned 0xd20000 [0092.836] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0092.836] GetProcessHeap () returned 0xd20000 [0092.836] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0092.836] GetProcessHeap () returned 0xd20000 [0092.836] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0092.836] GetProcessHeap () returned 0xd20000 [0092.836] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0092.836] GetProcessHeap () returned 0xd20000 [0092.837] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0092.837] GetProcessHeap () returned 0xd20000 [0092.837] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0092.837] GetProcessHeap () returned 0xd20000 [0092.837] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0092.837] GetProcessHeap () returned 0xd20000 [0092.837] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0092.837] GetProcessHeap () returned 0xd20000 [0092.837] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0092.837] GetProcessHeap () returned 0xd20000 [0092.837] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0092.837] GetProcessHeap () returned 0xd20000 [0092.837] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444e0 | out: hHeap=0xd20000) returned 1 [0092.837] GetProcessHeap () returned 0xd20000 [0092.837] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b5a8 | out: hHeap=0xd20000) returned 1 [0092.837] GetProcessHeap () returned 0xd20000 [0092.837] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0092.837] GetProcessHeap () returned 0xd20000 [0092.837] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a948 | out: hHeap=0xd20000) returned 1 [0092.837] GetProcessHeap () returned 0xd20000 [0092.837] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0092.838] GetProcessHeap () returned 0xd20000 [0092.838] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0092.838] GetProcessHeap () returned 0xd20000 [0092.838] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0092.838] WriteFile (in: hFile=0x230, lpBuffer=0xd4d950*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d950*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0092.843] GetProcessHeap () returned 0xd20000 [0092.843] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4d950, Size=0x30) returned 0xd4d950 [0092.843] GetProcessHeap () returned 0xd20000 [0092.843] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0092.843] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0092.843] GetProcessHeap () returned 0xd20000 [0092.844] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xe4b5) returned 0xd4d988 [0092.845] ReadFile (in: hFile=0x230, lpBuffer=0xd4d988, nNumberOfBytesToRead=0xe4b5, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4d988*, lpNumberOfBytesRead=0x299d7e8*=0xe4b5, lpOverlapped=0x0) returned 1 [0092.847] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0092.847] WriteFile (in: hFile=0x230, lpBuffer=0xd4d988*, nNumberOfBytesToWrite=0xe4b5, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4d988*, lpNumberOfBytesWritten=0x299d7e4*=0xe4b5, lpOverlapped=0x0) returned 1 [0092.850] GetProcessHeap () returned 0xd20000 [0092.850] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4d988 | out: hHeap=0xd20000) returned 1 [0092.850] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0092.850] WriteFile (in: hFile=0x230, lpBuffer=0xd4d950*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d950*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0092.852] CloseHandle (hObject=0x230) returned 1 [0092.855] GetProcessHeap () returned 0xd20000 [0092.855] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd426c0 | out: hHeap=0xd20000) returned 1 [0092.855] GetProcessHeap () returned 0xd20000 [0092.855] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bd28 | out: hHeap=0xd20000) returned 1 [0092.855] GetProcessHeap () returned 0xd20000 [0092.855] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0092.855] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" [0092.855] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm.[ponce.lorena@aol.com]" [0092.856] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-gb.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0092.856] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-gb.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0092.856] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0092.857] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0092.857] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0092.857] GetProcessHeap () returned 0xd20000 [0092.857] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444c8 | out: hHeap=0xd20000) returned 1 [0092.857] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3d997f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3d997f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xe4b5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_en-us.htm", cAlternateFileName="EULA_E~3.HTM")) returned 1 [0092.857] lstrcmpiW (lpString1="EULA_en-us.htm", lpString2=".") returned 1 [0092.857] lstrcmpiW (lpString1="EULA_en-us.htm", lpString2="..") returned 1 [0092.857] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_en-us.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" [0092.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_en-us.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0092.857] GetProcessHeap () returned 0xd20000 [0092.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd44420 [0092.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_en-us.htm", cchWideChar=-1, lpMultiByteStr=0xd44420, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_en-us.htm", lpUsedDefaultChar=0x0) returned 15 [0092.857] lstrlenA (lpString="EULA_en-us.htm") returned 14 [0092.857] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0092.857] lstrlenA (lpString="EULA_en-us.htm") returned 14 [0092.857] lstrlenA (lpString=".dll") returned 4 [0092.858] lstrlenA (lpString=".dll") returned 4 [0092.858] lstrlenA (lpString="EULA_en-us.htm") returned 14 [0092.858] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0092.858] lstrlenA (lpString="EULA_en-us.htm") returned 14 [0092.858] lstrlenA (lpString=".ini") returned 4 [0092.858] lstrlenA (lpString=".ini") returned 4 [0092.858] lstrlenA (lpString="EULA_en-us.htm") returned 14 [0092.858] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0092.858] lstrlenA (lpString="EULA_en-us.htm") returned 14 [0092.858] lstrlenA (lpString=".inc") returned 4 [0092.858] lstrlenA (lpString=".inc") returned 4 [0092.858] lstrlenA (lpString="EULA_en-us.htm") returned 14 [0092.858] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0092.858] lstrcmpiW (lpString1="EULA_en-us.htm", lpString2="HOW_RECOVER.html") returned -1 [0092.858] lstrcmpiW (lpString1="EULA_en-us.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0092.858] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0092.858] lstrcmpiW (lpString1="EULA_en-us.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0092.858] GetProcessHeap () returned 0xd20000 [0092.858] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42828 [0092.858] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0093.122] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=58549) returned 1 [0093.122] GetProcessHeap () returned 0xd20000 [0093.122] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bd28 [0093.122] GetProcessHeap () returned 0xd20000 [0093.122] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0093.122] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm") returned 52 [0093.122] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0093.122] GetProcessHeap () returned 0xd20000 [0093.122] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0093.122] GetProcessHeap () returned 0xd20000 [0093.122] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4d988 [0093.123] lstrlenA (lpString="rsa_encrypt") returned 11 [0093.123] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0093.125] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0093.125] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0093.125] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0093.125] GetProcessHeap () returned 0xd20000 [0093.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0093.125] lstrlenA (lpString="010001") returned 6 [0093.125] GetProcessHeap () returned 0xd20000 [0093.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd98 [0093.125] GetProcessHeap () returned 0xd20000 [0093.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0093.125] GetProcessHeap () returned 0xd20000 [0093.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b758 [0093.126] GetProcessHeap () returned 0xd20000 [0093.126] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0093.126] GetProcessHeap () returned 0xd20000 [0093.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ae58 [0093.126] GetProcessHeap () returned 0xd20000 [0093.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45410 [0093.126] GetProcessHeap () returned 0xd20000 [0093.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc48 [0093.126] GetProcessHeap () returned 0xd20000 [0093.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0093.126] GetProcessHeap () returned 0xd20000 [0093.126] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0093.126] GetProcessHeap () returned 0xd20000 [0093.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0093.126] GetProcessHeap () returned 0xd20000 [0093.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0093.126] GetProcessHeap () returned 0xd20000 [0093.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd45640 [0093.126] GetProcessHeap () returned 0xd20000 [0093.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.126] GetProcessHeap () returned 0xd20000 [0093.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446c0 [0093.126] GetProcessHeap () returned 0xd20000 [0093.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b7e8 [0093.126] GetProcessHeap () returned 0xd20000 [0093.127] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0093.127] GetProcessHeap () returned 0xd20000 [0093.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44c68 [0093.127] GetProcessHeap () returned 0xd20000 [0093.127] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0093.127] GetProcessHeap () returned 0xd20000 [0093.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0093.127] GetProcessHeap () returned 0xd20000 [0093.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444c8 [0093.127] GetProcessHeap () returned 0xd20000 [0093.127] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.127] GetProcessHeap () returned 0xd20000 [0093.127] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0093.127] GetProcessHeap () returned 0xd20000 [0093.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.127] GetProcessHeap () returned 0xd20000 [0093.127] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.127] GetProcessHeap () returned 0xd20000 [0093.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.127] GetProcessHeap () returned 0xd20000 [0093.127] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.127] GetProcessHeap () returned 0xd20000 [0093.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b488 [0093.128] GetProcessHeap () returned 0xd20000 [0093.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444c8 | out: hHeap=0xd20000) returned 1 [0093.128] GetProcessHeap () returned 0xd20000 [0093.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0093.128] GetProcessHeap () returned 0xd20000 [0093.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b488 | out: hHeap=0xd20000) returned 1 [0093.128] GetProcessHeap () returned 0xd20000 [0093.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0093.128] GetProcessHeap () returned 0xd20000 [0093.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0093.128] GetProcessHeap () returned 0xd20000 [0093.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.128] GetProcessHeap () returned 0xd20000 [0093.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.128] GetProcessHeap () returned 0xd20000 [0093.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0093.128] GetProcessHeap () returned 0xd20000 [0093.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0093.128] GetProcessHeap () returned 0xd20000 [0093.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.129] GetProcessHeap () returned 0xd20000 [0093.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.129] GetProcessHeap () returned 0xd20000 [0093.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.129] GetProcessHeap () returned 0xd20000 [0093.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.129] GetProcessHeap () returned 0xd20000 [0093.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0093.129] GetProcessHeap () returned 0xd20000 [0093.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0093.129] GetProcessHeap () returned 0xd20000 [0093.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.129] GetProcessHeap () returned 0xd20000 [0093.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.129] GetProcessHeap () returned 0xd20000 [0093.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.129] GetProcessHeap () returned 0xd20000 [0093.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.129] GetProcessHeap () returned 0xd20000 [0093.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.129] GetProcessHeap () returned 0xd20000 [0093.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.130] GetProcessHeap () returned 0xd20000 [0093.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.130] GetProcessHeap () returned 0xd20000 [0093.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.130] GetProcessHeap () returned 0xd20000 [0093.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.130] GetProcessHeap () returned 0xd20000 [0093.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.130] GetProcessHeap () returned 0xd20000 [0093.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.130] GetProcessHeap () returned 0xd20000 [0093.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.130] GetProcessHeap () returned 0xd20000 [0093.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.130] GetProcessHeap () returned 0xd20000 [0093.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.130] GetProcessHeap () returned 0xd20000 [0093.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0093.130] GetProcessHeap () returned 0xd20000 [0093.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0093.131] GetProcessHeap () returned 0xd20000 [0093.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0093.131] GetProcessHeap () returned 0xd20000 [0093.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0093.131] GetProcessHeap () returned 0xd20000 [0093.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0093.131] GetProcessHeap () returned 0xd20000 [0093.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0093.131] GetProcessHeap () returned 0xd20000 [0093.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.131] GetProcessHeap () returned 0xd20000 [0093.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.131] GetProcessHeap () returned 0xd20000 [0093.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0093.131] GetProcessHeap () returned 0xd20000 [0093.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0093.131] GetProcessHeap () returned 0xd20000 [0093.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0093.131] GetProcessHeap () returned 0xd20000 [0093.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0093.131] GetProcessHeap () returned 0xd20000 [0093.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.132] GetProcessHeap () returned 0xd20000 [0093.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.132] GetProcessHeap () returned 0xd20000 [0093.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0093.132] GetProcessHeap () returned 0xd20000 [0093.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0093.132] GetProcessHeap () returned 0xd20000 [0093.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0093.132] GetProcessHeap () returned 0xd20000 [0093.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0093.132] GetProcessHeap () returned 0xd20000 [0093.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.132] GetProcessHeap () returned 0xd20000 [0093.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.132] GetProcessHeap () returned 0xd20000 [0093.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.132] GetProcessHeap () returned 0xd20000 [0093.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.132] GetProcessHeap () returned 0xd20000 [0093.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0093.132] GetProcessHeap () returned 0xd20000 [0093.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0093.133] GetProcessHeap () returned 0xd20000 [0093.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0093.133] GetProcessHeap () returned 0xd20000 [0093.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0093.133] GetProcessHeap () returned 0xd20000 [0093.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.133] GetProcessHeap () returned 0xd20000 [0093.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.133] GetProcessHeap () returned 0xd20000 [0093.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0093.133] GetProcessHeap () returned 0xd20000 [0093.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0093.133] GetProcessHeap () returned 0xd20000 [0093.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.133] GetProcessHeap () returned 0xd20000 [0093.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.133] GetProcessHeap () returned 0xd20000 [0093.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.133] GetProcessHeap () returned 0xd20000 [0093.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.134] GetProcessHeap () returned 0xd20000 [0093.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.134] GetProcessHeap () returned 0xd20000 [0093.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.134] GetProcessHeap () returned 0xd20000 [0093.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0093.134] GetProcessHeap () returned 0xd20000 [0093.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0093.134] GetProcessHeap () returned 0xd20000 [0093.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0093.134] GetProcessHeap () returned 0xd20000 [0093.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0093.134] GetProcessHeap () returned 0xd20000 [0093.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.134] GetProcessHeap () returned 0xd20000 [0093.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.134] GetProcessHeap () returned 0xd20000 [0093.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0093.134] GetProcessHeap () returned 0xd20000 [0093.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0093.135] GetProcessHeap () returned 0xd20000 [0093.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0093.135] GetProcessHeap () returned 0xd20000 [0093.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0093.135] GetProcessHeap () returned 0xd20000 [0093.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.135] GetProcessHeap () returned 0xd20000 [0093.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.135] GetProcessHeap () returned 0xd20000 [0093.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0093.135] GetProcessHeap () returned 0xd20000 [0093.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0093.135] GetProcessHeap () returned 0xd20000 [0093.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.135] GetProcessHeap () returned 0xd20000 [0093.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.135] GetProcessHeap () returned 0xd20000 [0093.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0093.136] GetProcessHeap () returned 0xd20000 [0093.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0093.136] GetProcessHeap () returned 0xd20000 [0093.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.136] GetProcessHeap () returned 0xd20000 [0093.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.136] GetProcessHeap () returned 0xd20000 [0093.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.136] GetProcessHeap () returned 0xd20000 [0093.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.136] GetProcessHeap () returned 0xd20000 [0093.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.136] GetProcessHeap () returned 0xd20000 [0093.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.136] GetProcessHeap () returned 0xd20000 [0093.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.136] GetProcessHeap () returned 0xd20000 [0093.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.137] GetProcessHeap () returned 0xd20000 [0093.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.137] GetProcessHeap () returned 0xd20000 [0093.137] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.137] GetProcessHeap () returned 0xd20000 [0093.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.137] GetProcessHeap () returned 0xd20000 [0093.137] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.137] GetProcessHeap () returned 0xd20000 [0093.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.137] GetProcessHeap () returned 0xd20000 [0093.137] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.137] GetProcessHeap () returned 0xd20000 [0093.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0093.137] GetProcessHeap () returned 0xd20000 [0093.137] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0093.137] GetProcessHeap () returned 0xd20000 [0093.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.138] GetProcessHeap () returned 0xd20000 [0093.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.138] GetProcessHeap () returned 0xd20000 [0093.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.138] GetProcessHeap () returned 0xd20000 [0093.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.138] GetProcessHeap () returned 0xd20000 [0093.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.138] GetProcessHeap () returned 0xd20000 [0093.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.138] GetProcessHeap () returned 0xd20000 [0093.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0093.138] GetProcessHeap () returned 0xd20000 [0093.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0093.138] GetProcessHeap () returned 0xd20000 [0093.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.138] GetProcessHeap () returned 0xd20000 [0093.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.138] GetProcessHeap () returned 0xd20000 [0093.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0093.139] GetProcessHeap () returned 0xd20000 [0093.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0093.139] GetProcessHeap () returned 0xd20000 [0093.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.139] GetProcessHeap () returned 0xd20000 [0093.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.139] GetProcessHeap () returned 0xd20000 [0093.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.139] GetProcessHeap () returned 0xd20000 [0093.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.139] GetProcessHeap () returned 0xd20000 [0093.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.139] GetProcessHeap () returned 0xd20000 [0093.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.139] GetProcessHeap () returned 0xd20000 [0093.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.139] GetProcessHeap () returned 0xd20000 [0093.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.139] GetProcessHeap () returned 0xd20000 [0093.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0093.140] GetProcessHeap () returned 0xd20000 [0093.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0093.140] GetProcessHeap () returned 0xd20000 [0093.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0093.140] GetProcessHeap () returned 0xd20000 [0093.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0093.140] GetProcessHeap () returned 0xd20000 [0093.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.140] GetProcessHeap () returned 0xd20000 [0093.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.140] GetProcessHeap () returned 0xd20000 [0093.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0093.140] GetProcessHeap () returned 0xd20000 [0093.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0093.140] GetProcessHeap () returned 0xd20000 [0093.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.140] GetProcessHeap () returned 0xd20000 [0093.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.140] GetProcessHeap () returned 0xd20000 [0093.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.141] GetProcessHeap () returned 0xd20000 [0093.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.141] GetProcessHeap () returned 0xd20000 [0093.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.141] GetProcessHeap () returned 0xd20000 [0093.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.141] GetProcessHeap () returned 0xd20000 [0093.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.142] GetProcessHeap () returned 0xd20000 [0093.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.142] GetProcessHeap () returned 0xd20000 [0093.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0093.142] GetProcessHeap () returned 0xd20000 [0093.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0093.142] GetProcessHeap () returned 0xd20000 [0093.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0093.142] GetProcessHeap () returned 0xd20000 [0093.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0093.142] GetProcessHeap () returned 0xd20000 [0093.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0093.142] GetProcessHeap () returned 0xd20000 [0093.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0093.142] GetProcessHeap () returned 0xd20000 [0093.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.142] GetProcessHeap () returned 0xd20000 [0093.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.143] GetProcessHeap () returned 0xd20000 [0093.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0093.143] GetProcessHeap () returned 0xd20000 [0093.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0093.143] GetProcessHeap () returned 0xd20000 [0093.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.143] GetProcessHeap () returned 0xd20000 [0093.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.143] GetProcessHeap () returned 0xd20000 [0093.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0093.143] GetProcessHeap () returned 0xd20000 [0093.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0093.143] GetProcessHeap () returned 0xd20000 [0093.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0093.143] GetProcessHeap () returned 0xd20000 [0093.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0093.143] GetProcessHeap () returned 0xd20000 [0093.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.143] GetProcessHeap () returned 0xd20000 [0093.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.144] GetProcessHeap () returned 0xd20000 [0093.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0093.144] GetProcessHeap () returned 0xd20000 [0093.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0093.144] GetProcessHeap () returned 0xd20000 [0093.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0093.144] GetProcessHeap () returned 0xd20000 [0093.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0093.144] GetProcessHeap () returned 0xd20000 [0093.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.144] GetProcessHeap () returned 0xd20000 [0093.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.144] GetProcessHeap () returned 0xd20000 [0093.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.144] GetProcessHeap () returned 0xd20000 [0093.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.144] GetProcessHeap () returned 0xd20000 [0093.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.144] GetProcessHeap () returned 0xd20000 [0093.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.145] GetProcessHeap () returned 0xd20000 [0093.145] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0093.145] GetProcessHeap () returned 0xd20000 [0093.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0093.145] GetProcessHeap () returned 0xd20000 [0093.145] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.145] GetProcessHeap () returned 0xd20000 [0093.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.145] GetProcessHeap () returned 0xd20000 [0093.145] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.145] GetProcessHeap () returned 0xd20000 [0093.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.145] GetProcessHeap () returned 0xd20000 [0093.145] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.145] GetProcessHeap () returned 0xd20000 [0093.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.145] GetProcessHeap () returned 0xd20000 [0093.145] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0093.146] GetProcessHeap () returned 0xd20000 [0093.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0093.146] GetProcessHeap () returned 0xd20000 [0093.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0093.146] GetProcessHeap () returned 0xd20000 [0093.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0093.146] GetProcessHeap () returned 0xd20000 [0093.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0093.146] GetProcessHeap () returned 0xd20000 [0093.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0093.146] GetProcessHeap () returned 0xd20000 [0093.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446c0 | out: hHeap=0xd20000) returned 1 [0093.146] GetProcessHeap () returned 0xd20000 [0093.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ae58 | out: hHeap=0xd20000) returned 1 [0093.146] GetProcessHeap () returned 0xd20000 [0093.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0093.146] GetProcessHeap () returned 0xd20000 [0093.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b758 | out: hHeap=0xd20000) returned 1 [0093.147] GetProcessHeap () returned 0xd20000 [0093.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0093.147] GetProcessHeap () returned 0xd20000 [0093.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.147] GetProcessHeap () returned 0xd20000 [0093.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0093.147] WriteFile (in: hFile=0x230, lpBuffer=0xd4d988*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d988*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0093.153] GetProcessHeap () returned 0xd20000 [0093.153] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4d988, Size=0x30) returned 0xd4d988 [0093.153] GetProcessHeap () returned 0xd20000 [0093.153] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0093.153] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0093.153] GetProcessHeap () returned 0xd20000 [0093.153] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xe4b5) returned 0xd4d9c0 [0093.154] ReadFile (in: hFile=0x230, lpBuffer=0xd4d9c0, nNumberOfBytesToRead=0xe4b5, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4d9c0*, lpNumberOfBytesRead=0x299d7e8*=0xe4b5, lpOverlapped=0x0) returned 1 [0093.428] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0093.428] WriteFile (in: hFile=0x230, lpBuffer=0xd4d9c0*, nNumberOfBytesToWrite=0xe4b5, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4d9c0*, lpNumberOfBytesWritten=0x299d7e4*=0xe4b5, lpOverlapped=0x0) returned 1 [0093.432] GetProcessHeap () returned 0xd20000 [0093.432] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4d9c0 | out: hHeap=0xd20000) returned 1 [0093.432] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0093.432] WriteFile (in: hFile=0x230, lpBuffer=0xd4d988*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d988*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0093.434] CloseHandle (hObject=0x230) returned 1 [0093.441] GetProcessHeap () returned 0xd20000 [0093.441] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42828 | out: hHeap=0xd20000) returned 1 [0093.441] GetProcessHeap () returned 0xd20000 [0093.441] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bd28 | out: hHeap=0xd20000) returned 1 [0093.441] GetProcessHeap () returned 0xd20000 [0093.441] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0093.442] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" [0093.442] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm.[ponce.lorena@aol.com]" [0093.442] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_en-us.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0093.443] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_en-us.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0093.443] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0093.443] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0093.443] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0093.443] GetProcessHeap () returned 0xd20000 [0093.443] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44420 | out: hHeap=0xd20000) returned 1 [0093.443] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dad37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dad37, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x110b8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_es-es.htm", cAlternateFileName="EULA_E~4.HTM")) returned 1 [0093.443] lstrcmpiW (lpString1="EULA_es-es.htm", lpString2=".") returned 1 [0093.443] lstrcmpiW (lpString1="EULA_es-es.htm", lpString2="..") returned 1 [0093.443] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_es-es.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" [0093.443] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_es-es.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0093.443] GetProcessHeap () returned 0xd20000 [0093.443] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd444e0 [0093.444] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_es-es.htm", cchWideChar=-1, lpMultiByteStr=0xd444e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_es-es.htm", lpUsedDefaultChar=0x0) returned 15 [0093.444] lstrlenA (lpString="EULA_es-es.htm") returned 14 [0093.444] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0093.444] lstrlenA (lpString="EULA_es-es.htm") returned 14 [0093.444] lstrlenA (lpString=".dll") returned 4 [0093.444] lstrlenA (lpString=".dll") returned 4 [0093.444] lstrlenA (lpString="EULA_es-es.htm") returned 14 [0093.444] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0093.444] lstrlenA (lpString="EULA_es-es.htm") returned 14 [0093.444] lstrlenA (lpString=".ini") returned 4 [0093.444] lstrlenA (lpString=".ini") returned 4 [0093.444] lstrlenA (lpString="EULA_es-es.htm") returned 14 [0093.444] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0093.444] lstrlenA (lpString="EULA_es-es.htm") returned 14 [0093.444] lstrlenA (lpString=".inc") returned 4 [0093.444] lstrlenA (lpString=".inc") returned 4 [0093.444] lstrlenA (lpString="EULA_es-es.htm") returned 14 [0093.444] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0093.444] lstrcmpiW (lpString1="EULA_es-es.htm", lpString2="HOW_RECOVER.html") returned -1 [0093.444] lstrcmpiW (lpString1="EULA_es-es.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0093.445] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0093.445] lstrcmpiW (lpString1="EULA_es-es.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0093.445] GetProcessHeap () returned 0xd20000 [0093.445] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42828 [0093.445] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0093.445] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=69816) returned 1 [0093.445] GetProcessHeap () returned 0xd20000 [0093.446] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bbc0 [0093.446] GetProcessHeap () returned 0xd20000 [0093.446] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0093.446] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm") returned 52 [0093.446] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0093.446] GetProcessHeap () returned 0xd20000 [0093.446] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0093.446] GetProcessHeap () returned 0xd20000 [0093.446] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x388) returned 0xd4d9c0 [0093.446] lstrlenA (lpString="rsa_encrypt") returned 11 [0093.446] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0093.448] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0093.448] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0093.448] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0093.448] GetProcessHeap () returned 0xd20000 [0093.448] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0093.448] lstrlenA (lpString="010001") returned 6 [0093.448] GetProcessHeap () returned 0xd20000 [0093.448] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd98 [0093.449] GetProcessHeap () returned 0xd20000 [0093.449] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0093.449] GetProcessHeap () returned 0xd20000 [0093.449] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aca8 [0093.449] GetProcessHeap () returned 0xd20000 [0093.449] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0093.449] GetProcessHeap () returned 0xd20000 [0093.449] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b3f8 [0093.449] GetProcessHeap () returned 0xd20000 [0093.449] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44c68 [0093.449] GetProcessHeap () returned 0xd20000 [0093.449] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd28 [0093.449] GetProcessHeap () returned 0xd20000 [0093.449] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0093.449] GetProcessHeap () returned 0xd20000 [0093.449] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.449] GetProcessHeap () returned 0xd20000 [0093.449] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0093.449] GetProcessHeap () returned 0xd20000 [0093.450] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0093.450] GetProcessHeap () returned 0xd20000 [0093.450] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd45640 [0093.450] GetProcessHeap () returned 0xd20000 [0093.450] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.450] GetProcessHeap () returned 0xd20000 [0093.450] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44570 [0093.450] GetProcessHeap () returned 0xd20000 [0093.450] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b2d8 [0093.450] GetProcessHeap () returned 0xd20000 [0093.450] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0093.450] GetProcessHeap () returned 0xd20000 [0093.450] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0093.450] GetProcessHeap () returned 0xd20000 [0093.450] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b2d8 | out: hHeap=0xd20000) returned 1 [0093.450] GetProcessHeap () returned 0xd20000 [0093.450] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.450] GetProcessHeap () returned 0xd20000 [0093.450] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446a8 [0093.450] GetProcessHeap () returned 0xd20000 [0093.450] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.450] GetProcessHeap () returned 0xd20000 [0093.451] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.451] GetProcessHeap () returned 0xd20000 [0093.451] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.451] GetProcessHeap () returned 0xd20000 [0093.451] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.451] GetProcessHeap () returned 0xd20000 [0093.451] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.451] GetProcessHeap () returned 0xd20000 [0093.451] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.451] GetProcessHeap () returned 0xd20000 [0093.451] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b368 [0093.451] GetProcessHeap () returned 0xd20000 [0093.451] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446a8 | out: hHeap=0xd20000) returned 1 [0093.451] GetProcessHeap () returned 0xd20000 [0093.451] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0093.451] GetProcessHeap () returned 0xd20000 [0093.451] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b368 | out: hHeap=0xd20000) returned 1 [0093.451] GetProcessHeap () returned 0xd20000 [0093.451] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.451] GetProcessHeap () returned 0xd20000 [0093.451] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.451] GetProcessHeap () returned 0xd20000 [0093.451] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.452] GetProcessHeap () returned 0xd20000 [0093.452] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.452] GetProcessHeap () returned 0xd20000 [0093.452] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.452] GetProcessHeap () returned 0xd20000 [0093.452] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.452] GetProcessHeap () returned 0xd20000 [0093.452] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.452] GetProcessHeap () returned 0xd20000 [0093.452] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.452] GetProcessHeap () returned 0xd20000 [0093.452] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.452] GetProcessHeap () returned 0xd20000 [0093.452] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.452] GetProcessHeap () returned 0xd20000 [0093.452] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.452] GetProcessHeap () returned 0xd20000 [0093.452] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.452] GetProcessHeap () returned 0xd20000 [0093.452] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0093.453] GetProcessHeap () returned 0xd20000 [0093.453] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0093.453] GetProcessHeap () returned 0xd20000 [0093.453] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.453] GetProcessHeap () returned 0xd20000 [0093.453] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.453] GetProcessHeap () returned 0xd20000 [0093.453] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.453] GetProcessHeap () returned 0xd20000 [0093.453] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.453] GetProcessHeap () returned 0xd20000 [0093.453] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.453] GetProcessHeap () returned 0xd20000 [0093.453] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.453] GetProcessHeap () returned 0xd20000 [0093.453] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.453] GetProcessHeap () returned 0xd20000 [0093.453] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.453] GetProcessHeap () returned 0xd20000 [0093.453] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0093.454] GetProcessHeap () returned 0xd20000 [0093.454] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0093.454] GetProcessHeap () returned 0xd20000 [0093.454] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.454] GetProcessHeap () returned 0xd20000 [0093.454] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.454] GetProcessHeap () returned 0xd20000 [0093.454] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.454] GetProcessHeap () returned 0xd20000 [0093.454] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.454] GetProcessHeap () returned 0xd20000 [0093.454] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.454] GetProcessHeap () returned 0xd20000 [0093.454] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.454] GetProcessHeap () returned 0xd20000 [0093.454] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.454] GetProcessHeap () returned 0xd20000 [0093.454] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.454] GetProcessHeap () returned 0xd20000 [0093.454] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0093.454] GetProcessHeap () returned 0xd20000 [0093.454] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0093.455] GetProcessHeap () returned 0xd20000 [0093.455] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.455] GetProcessHeap () returned 0xd20000 [0093.455] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.455] GetProcessHeap () returned 0xd20000 [0093.455] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.455] GetProcessHeap () returned 0xd20000 [0093.455] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.455] GetProcessHeap () returned 0xd20000 [0093.455] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0093.455] GetProcessHeap () returned 0xd20000 [0093.455] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0093.455] GetProcessHeap () returned 0xd20000 [0093.455] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0093.455] GetProcessHeap () returned 0xd20000 [0093.455] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0093.455] GetProcessHeap () returned 0xd20000 [0093.455] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.455] GetProcessHeap () returned 0xd20000 [0093.455] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.455] GetProcessHeap () returned 0xd20000 [0093.455] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0093.456] GetProcessHeap () returned 0xd20000 [0093.456] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0093.456] GetProcessHeap () returned 0xd20000 [0093.456] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.456] GetProcessHeap () returned 0xd20000 [0093.456] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.456] GetProcessHeap () returned 0xd20000 [0093.456] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.456] GetProcessHeap () returned 0xd20000 [0093.456] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.456] GetProcessHeap () returned 0xd20000 [0093.456] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.456] GetProcessHeap () returned 0xd20000 [0093.456] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.456] GetProcessHeap () returned 0xd20000 [0093.456] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.456] GetProcessHeap () returned 0xd20000 [0093.456] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.456] GetProcessHeap () returned 0xd20000 [0093.456] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.456] GetProcessHeap () returned 0xd20000 [0093.457] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.457] GetProcessHeap () returned 0xd20000 [0093.457] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.457] GetProcessHeap () returned 0xd20000 [0093.457] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.457] GetProcessHeap () returned 0xd20000 [0093.457] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0093.457] GetProcessHeap () returned 0xd20000 [0093.457] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0093.457] GetProcessHeap () returned 0xd20000 [0093.457] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0093.457] GetProcessHeap () returned 0xd20000 [0093.457] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0093.457] GetProcessHeap () returned 0xd20000 [0093.457] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.457] GetProcessHeap () returned 0xd20000 [0093.457] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.457] GetProcessHeap () returned 0xd20000 [0093.457] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0093.457] GetProcessHeap () returned 0xd20000 [0093.458] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0093.458] GetProcessHeap () returned 0xd20000 [0093.458] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0093.458] GetProcessHeap () returned 0xd20000 [0093.458] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0093.458] GetProcessHeap () returned 0xd20000 [0093.458] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.458] GetProcessHeap () returned 0xd20000 [0093.458] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.458] GetProcessHeap () returned 0xd20000 [0093.458] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.458] GetProcessHeap () returned 0xd20000 [0093.458] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.458] GetProcessHeap () returned 0xd20000 [0093.458] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0093.458] GetProcessHeap () returned 0xd20000 [0093.458] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0093.458] GetProcessHeap () returned 0xd20000 [0093.458] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.458] GetProcessHeap () returned 0xd20000 [0093.458] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.458] GetProcessHeap () returned 0xd20000 [0093.459] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0093.459] GetProcessHeap () returned 0xd20000 [0093.459] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0093.459] GetProcessHeap () returned 0xd20000 [0093.459] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.459] GetProcessHeap () returned 0xd20000 [0093.459] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.459] GetProcessHeap () returned 0xd20000 [0093.459] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.459] GetProcessHeap () returned 0xd20000 [0093.459] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.459] GetProcessHeap () returned 0xd20000 [0093.459] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.459] GetProcessHeap () returned 0xd20000 [0093.459] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.459] GetProcessHeap () returned 0xd20000 [0093.459] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.459] GetProcessHeap () returned 0xd20000 [0093.459] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.459] GetProcessHeap () returned 0xd20000 [0093.459] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.459] GetProcessHeap () returned 0xd20000 [0093.459] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.460] GetProcessHeap () returned 0xd20000 [0093.460] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.460] GetProcessHeap () returned 0xd20000 [0093.460] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.460] GetProcessHeap () returned 0xd20000 [0093.460] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.460] GetProcessHeap () returned 0xd20000 [0093.460] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.460] GetProcessHeap () returned 0xd20000 [0093.460] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.460] GetProcessHeap () returned 0xd20000 [0093.460] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.460] GetProcessHeap () returned 0xd20000 [0093.460] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0093.460] GetProcessHeap () returned 0xd20000 [0093.460] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0093.460] GetProcessHeap () returned 0xd20000 [0093.460] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.460] GetProcessHeap () returned 0xd20000 [0093.460] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.460] GetProcessHeap () returned 0xd20000 [0093.460] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0093.460] GetProcessHeap () returned 0xd20000 [0093.460] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0093.461] GetProcessHeap () returned 0xd20000 [0093.461] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.461] GetProcessHeap () returned 0xd20000 [0093.461] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.461] GetProcessHeap () returned 0xd20000 [0093.461] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.461] GetProcessHeap () returned 0xd20000 [0093.461] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.461] GetProcessHeap () returned 0xd20000 [0093.461] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.461] GetProcessHeap () returned 0xd20000 [0093.461] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.461] GetProcessHeap () returned 0xd20000 [0093.461] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0093.461] GetProcessHeap () returned 0xd20000 [0093.461] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0093.461] GetProcessHeap () returned 0xd20000 [0093.461] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0093.461] GetProcessHeap () returned 0xd20000 [0093.461] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0093.461] GetProcessHeap () returned 0xd20000 [0093.461] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.461] GetProcessHeap () returned 0xd20000 [0093.462] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.462] GetProcessHeap () returned 0xd20000 [0093.462] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.462] GetProcessHeap () returned 0xd20000 [0093.462] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.462] GetProcessHeap () returned 0xd20000 [0093.462] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.462] GetProcessHeap () returned 0xd20000 [0093.462] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.462] GetProcessHeap () returned 0xd20000 [0093.462] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.462] GetProcessHeap () returned 0xd20000 [0093.462] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.462] GetProcessHeap () returned 0xd20000 [0093.462] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.462] GetProcessHeap () returned 0xd20000 [0093.462] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.462] GetProcessHeap () returned 0xd20000 [0093.462] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.462] GetProcessHeap () returned 0xd20000 [0093.463] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.463] GetProcessHeap () returned 0xd20000 [0093.463] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0093.463] GetProcessHeap () returned 0xd20000 [0093.463] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0093.463] GetProcessHeap () returned 0xd20000 [0093.463] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.463] GetProcessHeap () returned 0xd20000 [0093.463] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.463] GetProcessHeap () returned 0xd20000 [0093.463] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0093.463] GetProcessHeap () returned 0xd20000 [0093.463] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0093.463] GetProcessHeap () returned 0xd20000 [0093.463] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.463] GetProcessHeap () returned 0xd20000 [0093.463] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.463] GetProcessHeap () returned 0xd20000 [0093.463] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.463] GetProcessHeap () returned 0xd20000 [0093.464] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.464] GetProcessHeap () returned 0xd20000 [0093.464] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.464] GetProcessHeap () returned 0xd20000 [0093.464] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.464] GetProcessHeap () returned 0xd20000 [0093.464] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.464] GetProcessHeap () returned 0xd20000 [0093.464] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.464] GetProcessHeap () returned 0xd20000 [0093.464] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0093.464] GetProcessHeap () returned 0xd20000 [0093.464] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0093.464] GetProcessHeap () returned 0xd20000 [0093.464] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0093.464] GetProcessHeap () returned 0xd20000 [0093.464] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0093.464] GetProcessHeap () returned 0xd20000 [0093.464] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0093.465] GetProcessHeap () returned 0xd20000 [0093.465] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0093.465] GetProcessHeap () returned 0xd20000 [0093.465] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.465] GetProcessHeap () returned 0xd20000 [0093.465] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.465] GetProcessHeap () returned 0xd20000 [0093.465] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.465] GetProcessHeap () returned 0xd20000 [0093.465] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.465] GetProcessHeap () returned 0xd20000 [0093.465] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0093.465] GetProcessHeap () returned 0xd20000 [0093.465] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0093.465] GetProcessHeap () returned 0xd20000 [0093.465] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.465] GetProcessHeap () returned 0xd20000 [0093.465] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.465] GetProcessHeap () returned 0xd20000 [0093.466] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.466] GetProcessHeap () returned 0xd20000 [0093.466] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.466] GetProcessHeap () returned 0xd20000 [0093.466] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0093.466] GetProcessHeap () returned 0xd20000 [0093.466] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0093.466] GetProcessHeap () returned 0xd20000 [0093.466] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.466] GetProcessHeap () returned 0xd20000 [0093.466] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.466] GetProcessHeap () returned 0xd20000 [0093.466] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0093.466] GetProcessHeap () returned 0xd20000 [0093.466] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0093.466] GetProcessHeap () returned 0xd20000 [0093.466] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.466] GetProcessHeap () returned 0xd20000 [0093.466] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.466] GetProcessHeap () returned 0xd20000 [0093.467] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.467] GetProcessHeap () returned 0xd20000 [0093.467] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.467] GetProcessHeap () returned 0xd20000 [0093.467] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.467] GetProcessHeap () returned 0xd20000 [0093.467] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.467] GetProcessHeap () returned 0xd20000 [0093.467] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.467] GetProcessHeap () returned 0xd20000 [0093.467] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.467] GetProcessHeap () returned 0xd20000 [0093.467] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.467] GetProcessHeap () returned 0xd20000 [0093.467] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.467] GetProcessHeap () returned 0xd20000 [0093.467] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.467] GetProcessHeap () returned 0xd20000 [0093.467] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.467] GetProcessHeap () returned 0xd20000 [0093.467] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0093.468] GetProcessHeap () returned 0xd20000 [0093.468] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0093.468] GetProcessHeap () returned 0xd20000 [0093.468] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0093.468] GetProcessHeap () returned 0xd20000 [0093.468] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0093.468] GetProcessHeap () returned 0xd20000 [0093.468] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44570 | out: hHeap=0xd20000) returned 1 [0093.468] GetProcessHeap () returned 0xd20000 [0093.468] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b3f8 | out: hHeap=0xd20000) returned 1 [0093.468] GetProcessHeap () returned 0xd20000 [0093.468] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0093.468] GetProcessHeap () returned 0xd20000 [0093.468] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aca8 | out: hHeap=0xd20000) returned 1 [0093.468] GetProcessHeap () returned 0xd20000 [0093.468] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0093.468] GetProcessHeap () returned 0xd20000 [0093.468] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.468] GetProcessHeap () returned 0xd20000 [0093.468] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0093.469] WriteFile (in: hFile=0x230, lpBuffer=0xd4d9c0*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d9c0*, lpNumberOfBytesWritten=0x299d864*=0x388, lpOverlapped=0x0) returned 1 [0093.477] GetProcessHeap () returned 0xd20000 [0093.477] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4d9c0, Size=0x30) returned 0xd4d9c0 [0093.477] GetProcessHeap () returned 0xd20000 [0093.477] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0093.477] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0093.477] GetProcessHeap () returned 0xd20000 [0093.477] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x110c0) returned 0xd4d9f8 [0093.477] ReadFile (in: hFile=0x230, lpBuffer=0xd4d9f8, nNumberOfBytesToRead=0x110c0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4d9f8*, lpNumberOfBytesRead=0x299d7e8*=0x110c0, lpOverlapped=0x0) returned 1 [0093.480] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0093.480] WriteFile (in: hFile=0x230, lpBuffer=0xd4d9f8*, nNumberOfBytesToWrite=0x110c0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4d9f8*, lpNumberOfBytesWritten=0x299d7e4*=0x110c0, lpOverlapped=0x0) returned 1 [0093.483] GetProcessHeap () returned 0xd20000 [0093.483] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4d9f8 | out: hHeap=0xd20000) returned 1 [0093.483] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0093.483] WriteFile (in: hFile=0x230, lpBuffer=0xd4d9c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d9c0*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0093.485] CloseHandle (hObject=0x230) returned 1 [0093.489] GetProcessHeap () returned 0xd20000 [0093.489] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42828 | out: hHeap=0xd20000) returned 1 [0093.489] GetProcessHeap () returned 0xd20000 [0093.489] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bbc0 | out: hHeap=0xd20000) returned 1 [0093.489] GetProcessHeap () returned 0xd20000 [0093.489] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0093.489] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" [0093.489] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm.[ponce.lorena@aol.com]" [0093.489] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-es.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0093.490] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-es.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0093.490] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0093.490] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0093.490] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0093.490] GetProcessHeap () returned 0xd20000 [0093.490] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444e0 | out: hHeap=0xd20000) returned 1 [0093.491] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dc0bd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dc0bd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x110b8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_es-mx.htm", cAlternateFileName="EU6344~1.HTM")) returned 1 [0093.491] lstrcmpiW (lpString1="EULA_es-mx.htm", lpString2=".") returned 1 [0093.491] lstrcmpiW (lpString1="EULA_es-mx.htm", lpString2="..") returned 1 [0093.491] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_es-mx.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" [0093.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_es-mx.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0093.491] GetProcessHeap () returned 0xd20000 [0093.491] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd44408 [0093.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_es-mx.htm", cchWideChar=-1, lpMultiByteStr=0xd44408, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_es-mx.htm", lpUsedDefaultChar=0x0) returned 15 [0093.491] lstrlenA (lpString="EULA_es-mx.htm") returned 14 [0093.491] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0093.491] lstrlenA (lpString="EULA_es-mx.htm") returned 14 [0093.491] lstrlenA (lpString=".dll") returned 4 [0093.491] lstrlenA (lpString=".dll") returned 4 [0093.491] lstrlenA (lpString="EULA_es-mx.htm") returned 14 [0093.491] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0093.491] lstrlenA (lpString="EULA_es-mx.htm") returned 14 [0093.491] lstrlenA (lpString=".ini") returned 4 [0093.491] lstrlenA (lpString=".ini") returned 4 [0093.492] lstrlenA (lpString="EULA_es-mx.htm") returned 14 [0093.492] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0093.492] lstrlenA (lpString="EULA_es-mx.htm") returned 14 [0093.492] lstrlenA (lpString=".inc") returned 4 [0093.492] lstrlenA (lpString=".inc") returned 4 [0093.492] lstrlenA (lpString="EULA_es-mx.htm") returned 14 [0093.492] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0093.492] lstrcmpiW (lpString1="EULA_es-mx.htm", lpString2="HOW_RECOVER.html") returned -1 [0093.492] lstrcmpiW (lpString1="EULA_es-mx.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0093.492] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0093.492] lstrcmpiW (lpString1="EULA_es-mx.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0093.492] GetProcessHeap () returned 0xd20000 [0093.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42580 [0093.492] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0093.493] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=69816) returned 1 [0093.493] GetProcessHeap () returned 0xd20000 [0093.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c0e8 [0093.493] GetProcessHeap () returned 0xd20000 [0093.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0093.493] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm") returned 52 [0093.493] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0093.493] GetProcessHeap () returned 0xd20000 [0093.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0093.493] GetProcessHeap () returned 0xd20000 [0093.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x388) returned 0xd4d9f8 [0093.493] lstrlenA (lpString="rsa_encrypt") returned 11 [0093.493] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0093.496] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0093.496] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0093.496] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0093.496] GetProcessHeap () returned 0xd20000 [0093.496] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0093.496] lstrlenA (lpString="010001") returned 6 [0093.496] GetProcessHeap () returned 0xd20000 [0093.496] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cdb8 [0093.496] GetProcessHeap () returned 0xd20000 [0093.496] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0093.496] GetProcessHeap () returned 0xd20000 [0093.496] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b1b8 [0093.496] GetProcessHeap () returned 0xd20000 [0093.496] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0093.496] GetProcessHeap () returned 0xd20000 [0093.496] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b488 [0093.497] GetProcessHeap () returned 0xd20000 [0093.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44c68 [0093.497] GetProcessHeap () returned 0xd20000 [0093.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc28 [0093.497] GetProcessHeap () returned 0xd20000 [0093.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0093.497] GetProcessHeap () returned 0xd20000 [0093.497] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0093.497] GetProcessHeap () returned 0xd20000 [0093.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0093.497] GetProcessHeap () returned 0xd20000 [0093.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0093.497] GetProcessHeap () returned 0xd20000 [0093.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd45528 [0093.497] GetProcessHeap () returned 0xd20000 [0093.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.497] GetProcessHeap () returned 0xd20000 [0093.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44468 [0093.497] GetProcessHeap () returned 0xd20000 [0093.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b248 [0093.497] GetProcessHeap () returned 0xd20000 [0093.497] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0093.497] GetProcessHeap () returned 0xd20000 [0093.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0093.498] GetProcessHeap () returned 0xd20000 [0093.498] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b248 | out: hHeap=0xd20000) returned 1 [0093.498] GetProcessHeap () returned 0xd20000 [0093.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.498] GetProcessHeap () returned 0xd20000 [0093.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446d8 [0093.498] GetProcessHeap () returned 0xd20000 [0093.498] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.498] GetProcessHeap () returned 0xd20000 [0093.498] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.498] GetProcessHeap () returned 0xd20000 [0093.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.498] GetProcessHeap () returned 0xd20000 [0093.498] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.498] GetProcessHeap () returned 0xd20000 [0093.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.498] GetProcessHeap () returned 0xd20000 [0093.498] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.498] GetProcessHeap () returned 0xd20000 [0093.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b6c8 [0093.499] GetProcessHeap () returned 0xd20000 [0093.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446d8 | out: hHeap=0xd20000) returned 1 [0093.499] GetProcessHeap () returned 0xd20000 [0093.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0093.499] GetProcessHeap () returned 0xd20000 [0093.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b6c8 | out: hHeap=0xd20000) returned 1 [0093.499] GetProcessHeap () returned 0xd20000 [0093.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0093.499] GetProcessHeap () returned 0xd20000 [0093.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0093.499] GetProcessHeap () returned 0xd20000 [0093.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0093.499] GetProcessHeap () returned 0xd20000 [0093.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0093.499] GetProcessHeap () returned 0xd20000 [0093.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.499] GetProcessHeap () returned 0xd20000 [0093.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.499] GetProcessHeap () returned 0xd20000 [0093.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0093.500] GetProcessHeap () returned 0xd20000 [0093.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0093.500] GetProcessHeap () returned 0xd20000 [0093.500] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0093.500] GetProcessHeap () returned 0xd20000 [0093.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0093.500] GetProcessHeap () returned 0xd20000 [0093.500] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.500] GetProcessHeap () returned 0xd20000 [0093.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.500] GetProcessHeap () returned 0xd20000 [0093.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0093.503] GetProcessHeap () returned 0xd20000 [0093.503] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0093.503] GetProcessHeap () returned 0xd20000 [0093.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0093.504] GetProcessHeap () returned 0xd20000 [0093.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0093.504] GetProcessHeap () returned 0xd20000 [0093.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.504] GetProcessHeap () returned 0xd20000 [0093.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.504] GetProcessHeap () returned 0xd20000 [0093.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0093.504] GetProcessHeap () returned 0xd20000 [0093.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0093.504] GetProcessHeap () returned 0xd20000 [0093.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0093.504] GetProcessHeap () returned 0xd20000 [0093.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0093.504] GetProcessHeap () returned 0xd20000 [0093.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0093.504] GetProcessHeap () returned 0xd20000 [0093.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0093.504] GetProcessHeap () returned 0xd20000 [0093.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.505] GetProcessHeap () returned 0xd20000 [0093.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.505] GetProcessHeap () returned 0xd20000 [0093.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0093.505] GetProcessHeap () returned 0xd20000 [0093.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0093.505] GetProcessHeap () returned 0xd20000 [0093.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.505] GetProcessHeap () returned 0xd20000 [0093.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.505] GetProcessHeap () returned 0xd20000 [0093.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0093.505] GetProcessHeap () returned 0xd20000 [0093.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0093.505] GetProcessHeap () returned 0xd20000 [0093.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0093.505] GetProcessHeap () returned 0xd20000 [0093.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0093.506] GetProcessHeap () returned 0xd20000 [0093.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0093.506] GetProcessHeap () returned 0xd20000 [0093.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0093.506] GetProcessHeap () returned 0xd20000 [0093.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0093.506] GetProcessHeap () returned 0xd20000 [0093.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0093.506] GetProcessHeap () returned 0xd20000 [0093.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.506] GetProcessHeap () returned 0xd20000 [0093.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.506] GetProcessHeap () returned 0xd20000 [0093.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0093.506] GetProcessHeap () returned 0xd20000 [0093.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0093.506] GetProcessHeap () returned 0xd20000 [0093.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0093.506] GetProcessHeap () returned 0xd20000 [0093.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0093.506] GetProcessHeap () returned 0xd20000 [0093.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.507] GetProcessHeap () returned 0xd20000 [0093.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.507] GetProcessHeap () returned 0xd20000 [0093.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0093.507] GetProcessHeap () returned 0xd20000 [0093.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0093.507] GetProcessHeap () returned 0xd20000 [0093.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.507] GetProcessHeap () returned 0xd20000 [0093.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.507] GetProcessHeap () returned 0xd20000 [0093.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0093.507] GetProcessHeap () returned 0xd20000 [0093.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0093.507] GetProcessHeap () returned 0xd20000 [0093.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.507] GetProcessHeap () returned 0xd20000 [0093.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.507] GetProcessHeap () returned 0xd20000 [0093.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.508] GetProcessHeap () returned 0xd20000 [0093.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.508] GetProcessHeap () returned 0xd20000 [0093.508] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.508] GetProcessHeap () returned 0xd20000 [0093.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.508] GetProcessHeap () returned 0xd20000 [0093.508] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.508] GetProcessHeap () returned 0xd20000 [0093.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.508] GetProcessHeap () returned 0xd20000 [0093.508] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.508] GetProcessHeap () returned 0xd20000 [0093.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.508] GetProcessHeap () returned 0xd20000 [0093.508] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.508] GetProcessHeap () returned 0xd20000 [0093.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.508] GetProcessHeap () returned 0xd20000 [0093.508] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.508] GetProcessHeap () returned 0xd20000 [0093.509] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.509] GetProcessHeap () returned 0xd20000 [0093.509] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0093.509] GetProcessHeap () returned 0xd20000 [0093.509] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0093.509] GetProcessHeap () returned 0xd20000 [0093.509] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.509] GetProcessHeap () returned 0xd20000 [0093.509] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.509] GetProcessHeap () returned 0xd20000 [0093.509] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.509] GetProcessHeap () returned 0xd20000 [0093.509] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.509] GetProcessHeap () returned 0xd20000 [0093.509] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.509] GetProcessHeap () returned 0xd20000 [0093.509] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.509] GetProcessHeap () returned 0xd20000 [0093.509] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0093.509] GetProcessHeap () returned 0xd20000 [0093.509] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0093.509] GetProcessHeap () returned 0xd20000 [0093.510] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0093.510] GetProcessHeap () returned 0xd20000 [0093.510] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0093.510] GetProcessHeap () returned 0xd20000 [0093.510] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0093.510] GetProcessHeap () returned 0xd20000 [0093.510] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0093.510] GetProcessHeap () returned 0xd20000 [0093.510] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.510] GetProcessHeap () returned 0xd20000 [0093.510] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.510] GetProcessHeap () returned 0xd20000 [0093.510] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.510] GetProcessHeap () returned 0xd20000 [0093.510] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.510] GetProcessHeap () returned 0xd20000 [0093.510] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.510] GetProcessHeap () returned 0xd20000 [0093.510] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.510] GetProcessHeap () returned 0xd20000 [0093.510] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.510] GetProcessHeap () returned 0xd20000 [0093.510] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.511] GetProcessHeap () returned 0xd20000 [0093.511] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0093.511] GetProcessHeap () returned 0xd20000 [0093.511] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0093.511] GetProcessHeap () returned 0xd20000 [0093.511] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0093.511] GetProcessHeap () returned 0xd20000 [0093.511] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0093.511] GetProcessHeap () returned 0xd20000 [0093.511] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0093.511] GetProcessHeap () returned 0xd20000 [0093.511] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0093.511] GetProcessHeap () returned 0xd20000 [0093.511] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0093.511] GetProcessHeap () returned 0xd20000 [0093.511] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0093.511] GetProcessHeap () returned 0xd20000 [0093.511] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.511] GetProcessHeap () returned 0xd20000 [0093.511] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.511] GetProcessHeap () returned 0xd20000 [0093.512] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.512] GetProcessHeap () returned 0xd20000 [0093.512] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.512] GetProcessHeap () returned 0xd20000 [0093.512] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.512] GetProcessHeap () returned 0xd20000 [0093.512] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.512] GetProcessHeap () returned 0xd20000 [0093.512] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.512] GetProcessHeap () returned 0xd20000 [0093.512] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.512] GetProcessHeap () returned 0xd20000 [0093.512] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0093.512] GetProcessHeap () returned 0xd20000 [0093.512] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0093.512] GetProcessHeap () returned 0xd20000 [0093.512] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0093.512] GetProcessHeap () returned 0xd20000 [0093.512] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0093.512] GetProcessHeap () returned 0xd20000 [0093.512] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0093.513] GetProcessHeap () returned 0xd20000 [0093.513] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0093.513] GetProcessHeap () returned 0xd20000 [0093.513] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.513] GetProcessHeap () returned 0xd20000 [0093.513] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.513] GetProcessHeap () returned 0xd20000 [0093.513] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0093.513] GetProcessHeap () returned 0xd20000 [0093.513] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0093.513] GetProcessHeap () returned 0xd20000 [0093.513] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0093.513] GetProcessHeap () returned 0xd20000 [0093.513] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0093.513] GetProcessHeap () returned 0xd20000 [0093.513] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0093.513] GetProcessHeap () returned 0xd20000 [0093.513] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0093.513] GetProcessHeap () returned 0xd20000 [0093.513] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0093.514] GetProcessHeap () returned 0xd20000 [0093.514] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0093.514] GetProcessHeap () returned 0xd20000 [0093.514] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.514] GetProcessHeap () returned 0xd20000 [0093.514] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.514] GetProcessHeap () returned 0xd20000 [0093.514] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0093.514] GetProcessHeap () returned 0xd20000 [0093.514] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0093.514] GetProcessHeap () returned 0xd20000 [0093.514] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0093.514] GetProcessHeap () returned 0xd20000 [0093.514] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0093.514] GetProcessHeap () returned 0xd20000 [0093.514] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.514] GetProcessHeap () returned 0xd20000 [0093.514] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.514] GetProcessHeap () returned 0xd20000 [0093.514] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.515] GetProcessHeap () returned 0xd20000 [0093.515] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.515] GetProcessHeap () returned 0xd20000 [0093.515] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.515] GetProcessHeap () returned 0xd20000 [0093.515] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.515] GetProcessHeap () returned 0xd20000 [0093.515] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0093.515] GetProcessHeap () returned 0xd20000 [0093.515] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0093.515] GetProcessHeap () returned 0xd20000 [0093.515] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.515] GetProcessHeap () returned 0xd20000 [0093.515] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.515] GetProcessHeap () returned 0xd20000 [0093.515] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.515] GetProcessHeap () returned 0xd20000 [0093.515] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.515] GetProcessHeap () returned 0xd20000 [0093.516] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.516] GetProcessHeap () returned 0xd20000 [0093.516] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.516] GetProcessHeap () returned 0xd20000 [0093.516] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0093.516] GetProcessHeap () returned 0xd20000 [0093.516] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0093.516] GetProcessHeap () returned 0xd20000 [0093.516] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.516] GetProcessHeap () returned 0xd20000 [0093.516] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.516] GetProcessHeap () returned 0xd20000 [0093.516] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.516] GetProcessHeap () returned 0xd20000 [0093.516] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.516] GetProcessHeap () returned 0xd20000 [0093.517] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0093.517] GetProcessHeap () returned 0xd20000 [0093.517] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0093.517] GetProcessHeap () returned 0xd20000 [0093.517] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.517] GetProcessHeap () returned 0xd20000 [0093.517] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.517] GetProcessHeap () returned 0xd20000 [0093.517] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.517] GetProcessHeap () returned 0xd20000 [0093.517] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.517] GetProcessHeap () returned 0xd20000 [0093.517] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0093.517] GetProcessHeap () returned 0xd20000 [0093.517] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0093.517] GetProcessHeap () returned 0xd20000 [0093.517] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.517] GetProcessHeap () returned 0xd20000 [0093.518] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.518] GetProcessHeap () returned 0xd20000 [0093.518] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.518] GetProcessHeap () returned 0xd20000 [0093.518] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.518] GetProcessHeap () returned 0xd20000 [0093.518] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.518] GetProcessHeap () returned 0xd20000 [0093.518] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.518] GetProcessHeap () returned 0xd20000 [0093.518] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.518] GetProcessHeap () returned 0xd20000 [0093.518] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.518] GetProcessHeap () returned 0xd20000 [0093.518] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.518] GetProcessHeap () returned 0xd20000 [0093.518] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.518] GetProcessHeap () returned 0xd20000 [0093.518] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.518] GetProcessHeap () returned 0xd20000 [0093.519] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.519] GetProcessHeap () returned 0xd20000 [0093.519] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0093.519] GetProcessHeap () returned 0xd20000 [0093.519] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0093.519] GetProcessHeap () returned 0xd20000 [0093.519] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.519] GetProcessHeap () returned 0xd20000 [0093.519] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.519] GetProcessHeap () returned 0xd20000 [0093.519] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0093.519] GetProcessHeap () returned 0xd20000 [0093.519] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0093.519] GetProcessHeap () returned 0xd20000 [0093.519] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0093.519] GetProcessHeap () returned 0xd20000 [0093.519] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0093.519] GetProcessHeap () returned 0xd20000 [0093.519] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44468 | out: hHeap=0xd20000) returned 1 [0093.519] GetProcessHeap () returned 0xd20000 [0093.520] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b488 | out: hHeap=0xd20000) returned 1 [0093.520] GetProcessHeap () returned 0xd20000 [0093.520] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0093.520] GetProcessHeap () returned 0xd20000 [0093.520] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b1b8 | out: hHeap=0xd20000) returned 1 [0093.520] GetProcessHeap () returned 0xd20000 [0093.520] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0093.520] GetProcessHeap () returned 0xd20000 [0093.520] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.520] GetProcessHeap () returned 0xd20000 [0093.520] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0093.520] WriteFile (in: hFile=0x230, lpBuffer=0xd4d9f8*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d9f8*, lpNumberOfBytesWritten=0x299d864*=0x388, lpOverlapped=0x0) returned 1 [0093.526] GetProcessHeap () returned 0xd20000 [0093.526] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4d9f8, Size=0x30) returned 0xd4d9f8 [0093.526] GetProcessHeap () returned 0xd20000 [0093.526] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0093.526] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0093.526] GetProcessHeap () returned 0xd20000 [0093.526] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x110c0) returned 0xd4da30 [0093.526] ReadFile (in: hFile=0x230, lpBuffer=0xd4da30, nNumberOfBytesToRead=0x110c0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4da30*, lpNumberOfBytesRead=0x299d7e8*=0x110c0, lpOverlapped=0x0) returned 1 [0093.529] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0093.529] WriteFile (in: hFile=0x230, lpBuffer=0xd4da30*, nNumberOfBytesToWrite=0x110c0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4da30*, lpNumberOfBytesWritten=0x299d7e4*=0x110c0, lpOverlapped=0x0) returned 1 [0093.786] GetProcessHeap () returned 0xd20000 [0093.786] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4da30 | out: hHeap=0xd20000) returned 1 [0093.786] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0093.787] WriteFile (in: hFile=0x230, lpBuffer=0xd4d9f8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4d9f8*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0093.788] CloseHandle (hObject=0x230) returned 1 [0093.791] GetProcessHeap () returned 0xd20000 [0093.791] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42580 | out: hHeap=0xd20000) returned 1 [0093.792] GetProcessHeap () returned 0xd20000 [0093.792] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c0e8 | out: hHeap=0xd20000) returned 1 [0093.792] GetProcessHeap () returned 0xd20000 [0093.792] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0093.792] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" [0093.792] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm.[ponce.lorena@aol.com]" [0093.792] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_es-mx.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0093.793] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_es-mx.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0093.793] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0093.793] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0093.793] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0093.793] GetProcessHeap () returned 0xd20000 [0093.793] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44408 | out: hHeap=0xd20000) returned 1 [0093.793] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dd45a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dd45a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xf67d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_et-ee.htm", cAlternateFileName="EU56AC~1.HTM")) returned 1 [0093.793] lstrcmpiW (lpString1="EULA_et-ee.htm", lpString2=".") returned 1 [0093.793] lstrcmpiW (lpString1="EULA_et-ee.htm", lpString2="..") returned 1 [0093.793] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_et-ee.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" [0093.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_et-ee.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0093.793] GetProcessHeap () returned 0xd20000 [0093.793] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd444f8 [0093.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_et-ee.htm", cchWideChar=-1, lpMultiByteStr=0xd444f8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_et-ee.htm", lpUsedDefaultChar=0x0) returned 15 [0093.794] lstrlenA (lpString="EULA_et-ee.htm") returned 14 [0093.794] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0093.794] lstrlenA (lpString="EULA_et-ee.htm") returned 14 [0093.794] lstrlenA (lpString=".dll") returned 4 [0093.794] lstrlenA (lpString=".dll") returned 4 [0093.794] lstrlenA (lpString="EULA_et-ee.htm") returned 14 [0093.794] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0093.794] lstrlenA (lpString="EULA_et-ee.htm") returned 14 [0093.794] lstrlenA (lpString=".ini") returned 4 [0093.794] lstrlenA (lpString=".ini") returned 4 [0093.794] lstrlenA (lpString="EULA_et-ee.htm") returned 14 [0093.794] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0093.794] lstrlenA (lpString="EULA_et-ee.htm") returned 14 [0093.794] lstrlenA (lpString=".inc") returned 4 [0093.794] lstrlenA (lpString=".inc") returned 4 [0093.794] lstrlenA (lpString="EULA_et-ee.htm") returned 14 [0093.794] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0093.794] lstrcmpiW (lpString1="EULA_et-ee.htm", lpString2="HOW_RECOVER.html") returned -1 [0093.794] lstrcmpiW (lpString1="EULA_et-ee.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0093.794] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0093.794] lstrcmpiW (lpString1="EULA_et-ee.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0093.794] GetProcessHeap () returned 0xd20000 [0093.795] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd426c0 [0093.795] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0093.795] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=63101) returned 1 [0093.795] GetProcessHeap () returned 0xd20000 [0093.795] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bb48 [0093.795] GetProcessHeap () returned 0xd20000 [0093.795] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0093.795] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm") returned 52 [0093.795] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0093.795] GetProcessHeap () returned 0xd20000 [0093.796] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0093.796] GetProcessHeap () returned 0xd20000 [0093.796] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4da30 [0093.796] lstrlenA (lpString="rsa_encrypt") returned 11 [0093.796] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0093.798] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0093.798] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0093.798] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0093.798] GetProcessHeap () returned 0xd20000 [0093.798] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0093.798] lstrlenA (lpString="010001") returned 6 [0093.798] GetProcessHeap () returned 0xd20000 [0093.798] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd28 [0093.798] GetProcessHeap () returned 0xd20000 [0093.798] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0093.798] GetProcessHeap () returned 0xd20000 [0093.798] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b758 [0093.798] GetProcessHeap () returned 0xd20000 [0093.798] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0093.798] GetProcessHeap () returned 0xd20000 [0093.798] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b368 [0093.798] GetProcessHeap () returned 0xd20000 [0093.799] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44fb0 [0093.799] GetProcessHeap () returned 0xd20000 [0093.799] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd98 [0093.799] GetProcessHeap () returned 0xd20000 [0093.799] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0093.799] GetProcessHeap () returned 0xd20000 [0093.799] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.799] GetProcessHeap () returned 0xd20000 [0093.799] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0093.799] GetProcessHeap () returned 0xd20000 [0093.799] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0093.799] GetProcessHeap () returned 0xd20000 [0093.799] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44e98 [0093.799] GetProcessHeap () returned 0xd20000 [0093.799] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0093.799] GetProcessHeap () returned 0xd20000 [0093.799] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445b8 [0093.799] GetProcessHeap () returned 0xd20000 [0093.799] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ac18 [0093.799] GetProcessHeap () returned 0xd20000 [0093.799] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0093.799] GetProcessHeap () returned 0xd20000 [0093.799] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0093.799] GetProcessHeap () returned 0xd20000 [0093.800] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ac18 | out: hHeap=0xd20000) returned 1 [0093.800] GetProcessHeap () returned 0xd20000 [0093.800] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.800] GetProcessHeap () returned 0xd20000 [0093.800] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445a0 [0093.800] GetProcessHeap () returned 0xd20000 [0093.800] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0093.800] GetProcessHeap () returned 0xd20000 [0093.800] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.800] GetProcessHeap () returned 0xd20000 [0093.800] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.800] GetProcessHeap () returned 0xd20000 [0093.800] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.800] GetProcessHeap () returned 0xd20000 [0093.800] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0093.800] GetProcessHeap () returned 0xd20000 [0093.800] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0093.800] GetProcessHeap () returned 0xd20000 [0093.800] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4adc8 [0093.800] GetProcessHeap () returned 0xd20000 [0093.800] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445a0 | out: hHeap=0xd20000) returned 1 [0093.800] GetProcessHeap () returned 0xd20000 [0093.801] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0093.801] GetProcessHeap () returned 0xd20000 [0093.801] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4adc8 | out: hHeap=0xd20000) returned 1 [0093.801] GetProcessHeap () returned 0xd20000 [0093.801] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.801] GetProcessHeap () returned 0xd20000 [0093.801] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.801] GetProcessHeap () returned 0xd20000 [0093.801] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.801] GetProcessHeap () returned 0xd20000 [0093.801] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.801] GetProcessHeap () returned 0xd20000 [0093.801] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0093.801] GetProcessHeap () returned 0xd20000 [0093.801] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0093.801] GetProcessHeap () returned 0xd20000 [0093.801] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.801] GetProcessHeap () returned 0xd20000 [0093.801] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.801] GetProcessHeap () returned 0xd20000 [0093.801] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.801] GetProcessHeap () returned 0xd20000 [0093.802] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.802] GetProcessHeap () returned 0xd20000 [0093.802] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0093.802] GetProcessHeap () returned 0xd20000 [0093.802] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0093.802] GetProcessHeap () returned 0xd20000 [0093.802] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0093.802] GetProcessHeap () returned 0xd20000 [0093.802] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0093.802] GetProcessHeap () returned 0xd20000 [0093.802] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.802] GetProcessHeap () returned 0xd20000 [0093.802] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.802] GetProcessHeap () returned 0xd20000 [0093.802] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0093.802] GetProcessHeap () returned 0xd20000 [0093.802] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0093.802] GetProcessHeap () returned 0xd20000 [0093.802] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.802] GetProcessHeap () returned 0xd20000 [0093.802] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.803] GetProcessHeap () returned 0xd20000 [0093.803] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.803] GetProcessHeap () returned 0xd20000 [0093.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.803] GetProcessHeap () returned 0xd20000 [0093.803] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.803] GetProcessHeap () returned 0xd20000 [0093.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.803] GetProcessHeap () returned 0xd20000 [0093.803] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.803] GetProcessHeap () returned 0xd20000 [0093.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.803] GetProcessHeap () returned 0xd20000 [0093.803] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.803] GetProcessHeap () returned 0xd20000 [0093.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.803] GetProcessHeap () returned 0xd20000 [0093.803] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.803] GetProcessHeap () returned 0xd20000 [0093.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.803] GetProcessHeap () returned 0xd20000 [0093.803] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0093.804] GetProcessHeap () returned 0xd20000 [0093.804] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0093.804] GetProcessHeap () returned 0xd20000 [0093.804] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0093.804] GetProcessHeap () returned 0xd20000 [0093.804] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0093.804] GetProcessHeap () returned 0xd20000 [0093.804] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.804] GetProcessHeap () returned 0xd20000 [0093.804] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.804] GetProcessHeap () returned 0xd20000 [0093.804] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0093.804] GetProcessHeap () returned 0xd20000 [0093.804] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0093.804] GetProcessHeap () returned 0xd20000 [0093.804] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0093.804] GetProcessHeap () returned 0xd20000 [0093.804] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0093.804] GetProcessHeap () returned 0xd20000 [0093.804] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.805] GetProcessHeap () returned 0xd20000 [0093.805] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.805] GetProcessHeap () returned 0xd20000 [0093.805] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.805] GetProcessHeap () returned 0xd20000 [0093.805] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.805] GetProcessHeap () returned 0xd20000 [0093.805] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0093.805] GetProcessHeap () returned 0xd20000 [0093.805] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0093.805] GetProcessHeap () returned 0xd20000 [0093.805] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.805] GetProcessHeap () returned 0xd20000 [0093.805] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.805] GetProcessHeap () returned 0xd20000 [0093.805] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0093.805] GetProcessHeap () returned 0xd20000 [0093.805] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0093.805] GetProcessHeap () returned 0xd20000 [0093.805] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.805] GetProcessHeap () returned 0xd20000 [0093.805] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.806] GetProcessHeap () returned 0xd20000 [0093.806] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.806] GetProcessHeap () returned 0xd20000 [0093.806] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.806] GetProcessHeap () returned 0xd20000 [0093.806] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.806] GetProcessHeap () returned 0xd20000 [0093.806] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.806] GetProcessHeap () returned 0xd20000 [0093.806] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.806] GetProcessHeap () returned 0xd20000 [0093.806] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.806] GetProcessHeap () returned 0xd20000 [0093.806] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.806] GetProcessHeap () returned 0xd20000 [0093.806] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.806] GetProcessHeap () returned 0xd20000 [0093.806] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.806] GetProcessHeap () returned 0xd20000 [0093.806] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.807] GetProcessHeap () returned 0xd20000 [0093.807] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.807] GetProcessHeap () returned 0xd20000 [0093.807] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.807] GetProcessHeap () returned 0xd20000 [0093.807] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.807] GetProcessHeap () returned 0xd20000 [0093.807] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.807] GetProcessHeap () returned 0xd20000 [0093.807] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0093.807] GetProcessHeap () returned 0xd20000 [0093.807] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0093.807] GetProcessHeap () returned 0xd20000 [0093.807] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.807] GetProcessHeap () returned 0xd20000 [0093.807] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.807] GetProcessHeap () returned 0xd20000 [0093.807] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0093.807] GetProcessHeap () returned 0xd20000 [0093.808] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0093.808] GetProcessHeap () returned 0xd20000 [0093.808] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.808] GetProcessHeap () returned 0xd20000 [0093.808] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.808] GetProcessHeap () returned 0xd20000 [0093.808] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.808] GetProcessHeap () returned 0xd20000 [0093.808] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.808] GetProcessHeap () returned 0xd20000 [0093.808] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.808] GetProcessHeap () returned 0xd20000 [0093.808] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.808] GetProcessHeap () returned 0xd20000 [0093.808] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0093.808] GetProcessHeap () returned 0xd20000 [0093.808] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0093.808] GetProcessHeap () returned 0xd20000 [0093.808] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0093.808] GetProcessHeap () returned 0xd20000 [0093.809] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0093.809] GetProcessHeap () returned 0xd20000 [0093.809] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.809] GetProcessHeap () returned 0xd20000 [0093.809] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.809] GetProcessHeap () returned 0xd20000 [0093.809] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.809] GetProcessHeap () returned 0xd20000 [0093.809] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.809] GetProcessHeap () returned 0xd20000 [0093.809] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.809] GetProcessHeap () returned 0xd20000 [0093.809] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.809] GetProcessHeap () returned 0xd20000 [0093.809] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.809] GetProcessHeap () returned 0xd20000 [0093.809] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.809] GetProcessHeap () returned 0xd20000 [0093.809] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.809] GetProcessHeap () returned 0xd20000 [0093.809] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.810] GetProcessHeap () returned 0xd20000 [0093.810] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.810] GetProcessHeap () returned 0xd20000 [0093.810] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.810] GetProcessHeap () returned 0xd20000 [0093.810] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0093.810] GetProcessHeap () returned 0xd20000 [0093.810] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0093.810] GetProcessHeap () returned 0xd20000 [0093.810] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.810] GetProcessHeap () returned 0xd20000 [0093.810] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.810] GetProcessHeap () returned 0xd20000 [0093.810] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0093.810] GetProcessHeap () returned 0xd20000 [0093.810] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0093.810] GetProcessHeap () returned 0xd20000 [0093.810] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.810] GetProcessHeap () returned 0xd20000 [0093.810] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.810] GetProcessHeap () returned 0xd20000 [0093.811] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0093.811] GetProcessHeap () returned 0xd20000 [0093.811] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0093.811] GetProcessHeap () returned 0xd20000 [0093.811] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.811] GetProcessHeap () returned 0xd20000 [0093.811] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.811] GetProcessHeap () returned 0xd20000 [0093.811] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0093.811] GetProcessHeap () returned 0xd20000 [0093.811] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0093.811] GetProcessHeap () returned 0xd20000 [0093.811] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0093.811] GetProcessHeap () returned 0xd20000 [0093.811] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0093.811] GetProcessHeap () returned 0xd20000 [0093.811] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0093.811] GetProcessHeap () returned 0xd20000 [0093.811] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0093.812] GetProcessHeap () returned 0xd20000 [0093.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0093.812] GetProcessHeap () returned 0xd20000 [0093.812] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0093.812] GetProcessHeap () returned 0xd20000 [0093.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.812] GetProcessHeap () returned 0xd20000 [0093.812] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.812] GetProcessHeap () returned 0xd20000 [0093.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.812] GetProcessHeap () returned 0xd20000 [0093.812] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.812] GetProcessHeap () returned 0xd20000 [0093.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0093.812] GetProcessHeap () returned 0xd20000 [0093.812] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0093.812] GetProcessHeap () returned 0xd20000 [0093.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.812] GetProcessHeap () returned 0xd20000 [0093.812] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.813] GetProcessHeap () returned 0xd20000 [0093.813] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.814] GetProcessHeap () returned 0xd20000 [0093.814] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.814] GetProcessHeap () returned 0xd20000 [0093.814] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0093.814] GetProcessHeap () returned 0xd20000 [0093.814] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0093.814] GetProcessHeap () returned 0xd20000 [0093.814] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0093.814] GetProcessHeap () returned 0xd20000 [0093.814] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0093.814] GetProcessHeap () returned 0xd20000 [0093.814] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0093.814] GetProcessHeap () returned 0xd20000 [0093.814] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0093.814] GetProcessHeap () returned 0xd20000 [0093.814] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.814] GetProcessHeap () returned 0xd20000 [0093.814] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.814] GetProcessHeap () returned 0xd20000 [0093.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.815] GetProcessHeap () returned 0xd20000 [0093.815] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.815] GetProcessHeap () returned 0xd20000 [0093.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.815] GetProcessHeap () returned 0xd20000 [0093.815] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.815] GetProcessHeap () returned 0xd20000 [0093.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0093.815] GetProcessHeap () returned 0xd20000 [0093.815] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0093.815] GetProcessHeap () returned 0xd20000 [0093.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.815] GetProcessHeap () returned 0xd20000 [0093.815] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.815] GetProcessHeap () returned 0xd20000 [0093.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.815] GetProcessHeap () returned 0xd20000 [0093.815] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.815] GetProcessHeap () returned 0xd20000 [0093.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.816] GetProcessHeap () returned 0xd20000 [0093.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.816] GetProcessHeap () returned 0xd20000 [0093.816] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0093.816] GetProcessHeap () returned 0xd20000 [0093.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0093.816] GetProcessHeap () returned 0xd20000 [0093.816] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0093.816] GetProcessHeap () returned 0xd20000 [0093.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0093.816] GetProcessHeap () returned 0xd20000 [0093.816] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.816] GetProcessHeap () returned 0xd20000 [0093.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.816] GetProcessHeap () returned 0xd20000 [0093.816] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0093.816] GetProcessHeap () returned 0xd20000 [0093.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0093.816] GetProcessHeap () returned 0xd20000 [0093.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.817] GetProcessHeap () returned 0xd20000 [0093.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.817] GetProcessHeap () returned 0xd20000 [0093.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0093.817] GetProcessHeap () returned 0xd20000 [0093.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0093.817] GetProcessHeap () returned 0xd20000 [0093.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.817] GetProcessHeap () returned 0xd20000 [0093.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.817] GetProcessHeap () returned 0xd20000 [0093.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0093.817] GetProcessHeap () returned 0xd20000 [0093.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0093.817] GetProcessHeap () returned 0xd20000 [0093.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.817] GetProcessHeap () returned 0xd20000 [0093.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.818] GetProcessHeap () returned 0xd20000 [0093.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.818] GetProcessHeap () returned 0xd20000 [0093.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.818] GetProcessHeap () returned 0xd20000 [0093.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0093.818] GetProcessHeap () returned 0xd20000 [0093.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0093.818] GetProcessHeap () returned 0xd20000 [0093.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.818] GetProcessHeap () returned 0xd20000 [0093.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.818] GetProcessHeap () returned 0xd20000 [0093.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.818] GetProcessHeap () returned 0xd20000 [0093.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.818] GetProcessHeap () returned 0xd20000 [0093.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0093.818] GetProcessHeap () returned 0xd20000 [0093.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0093.819] GetProcessHeap () returned 0xd20000 [0093.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0093.819] GetProcessHeap () returned 0xd20000 [0093.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0093.819] GetProcessHeap () returned 0xd20000 [0093.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445b8 | out: hHeap=0xd20000) returned 1 [0093.819] GetProcessHeap () returned 0xd20000 [0093.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b368 | out: hHeap=0xd20000) returned 1 [0093.819] GetProcessHeap () returned 0xd20000 [0093.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0093.819] GetProcessHeap () returned 0xd20000 [0093.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b758 | out: hHeap=0xd20000) returned 1 [0093.819] GetProcessHeap () returned 0xd20000 [0093.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0093.819] GetProcessHeap () returned 0xd20000 [0093.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.819] GetProcessHeap () returned 0xd20000 [0093.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0093.820] WriteFile (in: hFile=0x230, lpBuffer=0xd4da30*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4da30*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0093.847] GetProcessHeap () returned 0xd20000 [0093.847] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4da30, Size=0x30) returned 0xd4da30 [0093.847] GetProcessHeap () returned 0xd20000 [0093.847] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0093.847] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0093.847] GetProcessHeap () returned 0xd20000 [0093.847] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf67d) returned 0xd4da68 [0093.848] ReadFile (in: hFile=0x230, lpBuffer=0xd4da68, nNumberOfBytesToRead=0xf67d, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4da68*, lpNumberOfBytesRead=0x299d7e8*=0xf67d, lpOverlapped=0x0) returned 1 [0093.874] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0093.874] WriteFile (in: hFile=0x230, lpBuffer=0xd4da68*, nNumberOfBytesToWrite=0xf67d, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4da68*, lpNumberOfBytesWritten=0x299d7e4*=0xf67d, lpOverlapped=0x0) returned 1 [0093.900] GetProcessHeap () returned 0xd20000 [0093.900] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4da68 | out: hHeap=0xd20000) returned 1 [0093.900] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0093.900] WriteFile (in: hFile=0x230, lpBuffer=0xd4da30*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4da30*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0093.902] CloseHandle (hObject=0x230) returned 1 [0093.911] GetProcessHeap () returned 0xd20000 [0093.911] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd426c0 | out: hHeap=0xd20000) returned 1 [0093.911] GetProcessHeap () returned 0xd20000 [0093.911] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bb48 | out: hHeap=0xd20000) returned 1 [0093.911] GetProcessHeap () returned 0xd20000 [0093.911] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0093.911] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" [0093.911] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm.[ponce.lorena@aol.com]" [0093.911] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_et-ee.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0093.912] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_et-ee.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0093.912] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0093.912] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0093.912] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0093.913] GetProcessHeap () returned 0xd20000 [0093.913] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444f8 | out: hHeap=0xd20000) returned 1 [0093.913] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3dfb2b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3dfb2b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1145a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_fi-fi.htm", cAlternateFileName="EULA_F~1.HTM")) returned 1 [0093.913] lstrcmpiW (lpString1="EULA_fi-fi.htm", lpString2=".") returned 1 [0093.913] lstrcmpiW (lpString1="EULA_fi-fi.htm", lpString2="..") returned 1 [0093.913] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_fi-fi.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" [0093.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_fi-fi.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0093.913] GetProcessHeap () returned 0xd20000 [0093.913] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd446c0 [0093.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_fi-fi.htm", cchWideChar=-1, lpMultiByteStr=0xd446c0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_fi-fi.htm", lpUsedDefaultChar=0x0) returned 15 [0093.913] lstrlenA (lpString="EULA_fi-fi.htm") returned 14 [0093.913] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0093.913] lstrlenA (lpString="EULA_fi-fi.htm") returned 14 [0093.913] lstrlenA (lpString=".dll") returned 4 [0093.913] lstrlenA (lpString=".dll") returned 4 [0093.913] lstrlenA (lpString="EULA_fi-fi.htm") returned 14 [0093.914] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0093.914] lstrlenA (lpString="EULA_fi-fi.htm") returned 14 [0093.914] lstrlenA (lpString=".ini") returned 4 [0093.914] lstrlenA (lpString=".ini") returned 4 [0093.914] lstrlenA (lpString="EULA_fi-fi.htm") returned 14 [0093.914] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0093.914] lstrlenA (lpString="EULA_fi-fi.htm") returned 14 [0093.914] lstrlenA (lpString=".inc") returned 4 [0093.914] lstrlenA (lpString=".inc") returned 4 [0093.914] lstrlenA (lpString="EULA_fi-fi.htm") returned 14 [0093.914] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0093.914] lstrcmpiW (lpString1="EULA_fi-fi.htm", lpString2="HOW_RECOVER.html") returned -1 [0093.914] lstrcmpiW (lpString1="EULA_fi-fi.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0093.914] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0093.914] lstrcmpiW (lpString1="EULA_fi-fi.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0093.914] GetProcessHeap () returned 0xd20000 [0093.914] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd428c8 [0093.914] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0093.917] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=70746) returned 1 [0093.917] GetProcessHeap () returned 0xd20000 [0093.917] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c1d8 [0093.917] GetProcessHeap () returned 0xd20000 [0093.917] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0093.917] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm") returned 52 [0093.917] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0093.917] GetProcessHeap () returned 0xd20000 [0093.917] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0093.918] GetProcessHeap () returned 0xd20000 [0093.918] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x386) returned 0xd4da68 [0093.918] lstrlenA (lpString="rsa_encrypt") returned 11 [0093.918] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0093.920] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0093.920] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0093.920] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0093.920] GetProcessHeap () returned 0xd20000 [0093.920] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0093.920] lstrlenA (lpString="010001") returned 6 [0093.920] GetProcessHeap () returned 0xd20000 [0093.920] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc98 [0093.921] GetProcessHeap () returned 0xd20000 [0093.921] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0093.921] GetProcessHeap () returned 0xd20000 [0093.921] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b638 [0093.921] GetProcessHeap () returned 0xd20000 [0093.921] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0093.921] GetProcessHeap () returned 0xd20000 [0093.921] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b6c8 [0093.921] GetProcessHeap () returned 0xd20000 [0093.921] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44920 [0093.921] GetProcessHeap () returned 0xd20000 [0093.921] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc38 [0093.921] GetProcessHeap () returned 0xd20000 [0093.921] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0093.921] GetProcessHeap () returned 0xd20000 [0093.921] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0093.921] GetProcessHeap () returned 0xd20000 [0093.921] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0093.921] GetProcessHeap () returned 0xd20000 [0093.921] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0093.922] GetProcessHeap () returned 0xd20000 [0093.922] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44808 [0093.922] GetProcessHeap () returned 0xd20000 [0093.922] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0093.922] GetProcessHeap () returned 0xd20000 [0093.922] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44558 [0093.922] GetProcessHeap () returned 0xd20000 [0093.922] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4adc8 [0093.922] GetProcessHeap () returned 0xd20000 [0093.922] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0093.922] GetProcessHeap () returned 0xd20000 [0093.922] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0093.922] GetProcessHeap () returned 0xd20000 [0093.922] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4adc8 | out: hHeap=0xd20000) returned 1 [0093.922] GetProcessHeap () returned 0xd20000 [0093.922] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.923] GetProcessHeap () returned 0xd20000 [0093.923] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446d8 [0093.923] GetProcessHeap () returned 0xd20000 [0093.923] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0093.923] GetProcessHeap () returned 0xd20000 [0093.923] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.923] GetProcessHeap () returned 0xd20000 [0093.923] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0093.923] GetProcessHeap () returned 0xd20000 [0093.923] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0093.923] GetProcessHeap () returned 0xd20000 [0093.923] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0093.923] GetProcessHeap () returned 0xd20000 [0093.923] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0093.923] GetProcessHeap () returned 0xd20000 [0093.923] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b008 [0093.923] GetProcessHeap () returned 0xd20000 [0093.923] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446d8 | out: hHeap=0xd20000) returned 1 [0093.924] GetProcessHeap () returned 0xd20000 [0093.924] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0093.924] GetProcessHeap () returned 0xd20000 [0093.924] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b008 | out: hHeap=0xd20000) returned 1 [0093.924] GetProcessHeap () returned 0xd20000 [0093.924] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.924] GetProcessHeap () returned 0xd20000 [0093.924] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.924] GetProcessHeap () returned 0xd20000 [0093.924] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.924] GetProcessHeap () returned 0xd20000 [0093.924] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.924] GetProcessHeap () returned 0xd20000 [0093.924] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.924] GetProcessHeap () returned 0xd20000 [0093.924] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.924] GetProcessHeap () returned 0xd20000 [0093.924] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0093.925] GetProcessHeap () returned 0xd20000 [0093.925] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0093.925] GetProcessHeap () returned 0xd20000 [0093.925] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0093.925] GetProcessHeap () returned 0xd20000 [0093.925] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0093.925] GetProcessHeap () returned 0xd20000 [0093.925] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.925] GetProcessHeap () returned 0xd20000 [0093.925] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.925] GetProcessHeap () returned 0xd20000 [0093.925] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0093.925] GetProcessHeap () returned 0xd20000 [0093.925] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0093.925] GetProcessHeap () returned 0xd20000 [0093.925] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0093.925] GetProcessHeap () returned 0xd20000 [0093.925] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0093.925] GetProcessHeap () returned 0xd20000 [0093.926] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.926] GetProcessHeap () returned 0xd20000 [0093.926] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.926] GetProcessHeap () returned 0xd20000 [0093.926] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0093.926] GetProcessHeap () returned 0xd20000 [0093.926] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0093.926] GetProcessHeap () returned 0xd20000 [0093.926] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.926] GetProcessHeap () returned 0xd20000 [0093.926] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.926] GetProcessHeap () returned 0xd20000 [0093.926] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0093.926] GetProcessHeap () returned 0xd20000 [0093.926] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0093.926] GetProcessHeap () returned 0xd20000 [0093.926] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.926] GetProcessHeap () returned 0xd20000 [0093.926] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.927] GetProcessHeap () returned 0xd20000 [0093.927] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.927] GetProcessHeap () returned 0xd20000 [0093.927] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.927] GetProcessHeap () returned 0xd20000 [0093.927] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.927] GetProcessHeap () returned 0xd20000 [0093.927] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.927] GetProcessHeap () returned 0xd20000 [0093.927] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.927] GetProcessHeap () returned 0xd20000 [0093.927] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.927] GetProcessHeap () returned 0xd20000 [0093.927] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.927] GetProcessHeap () returned 0xd20000 [0093.927] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.927] GetProcessHeap () returned 0xd20000 [0093.927] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.928] GetProcessHeap () returned 0xd20000 [0093.928] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.928] GetProcessHeap () returned 0xd20000 [0093.928] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.928] GetProcessHeap () returned 0xd20000 [0093.928] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.928] GetProcessHeap () returned 0xd20000 [0093.928] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0093.928] GetProcessHeap () returned 0xd20000 [0093.928] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0093.928] GetProcessHeap () returned 0xd20000 [0093.928] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.928] GetProcessHeap () returned 0xd20000 [0093.928] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.928] GetProcessHeap () returned 0xd20000 [0093.928] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.928] GetProcessHeap () returned 0xd20000 [0093.928] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.928] GetProcessHeap () returned 0xd20000 [0093.928] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.929] GetProcessHeap () returned 0xd20000 [0093.929] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.929] GetProcessHeap () returned 0xd20000 [0093.929] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0093.929] GetProcessHeap () returned 0xd20000 [0093.929] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0093.929] GetProcessHeap () returned 0xd20000 [0093.929] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.929] GetProcessHeap () returned 0xd20000 [0093.929] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.929] GetProcessHeap () returned 0xd20000 [0093.929] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0093.929] GetProcessHeap () returned 0xd20000 [0093.929] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0093.929] GetProcessHeap () returned 0xd20000 [0093.929] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.929] GetProcessHeap () returned 0xd20000 [0093.929] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.929] GetProcessHeap () returned 0xd20000 [0093.929] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.930] GetProcessHeap () returned 0xd20000 [0093.930] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.930] GetProcessHeap () returned 0xd20000 [0093.930] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.930] GetProcessHeap () returned 0xd20000 [0093.930] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.930] GetProcessHeap () returned 0xd20000 [0093.930] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.930] GetProcessHeap () returned 0xd20000 [0093.930] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.930] GetProcessHeap () returned 0xd20000 [0093.930] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0093.930] GetProcessHeap () returned 0xd20000 [0093.930] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0093.930] GetProcessHeap () returned 0xd20000 [0093.930] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0093.930] GetProcessHeap () returned 0xd20000 [0093.930] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0093.930] GetProcessHeap () returned 0xd20000 [0093.931] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.931] GetProcessHeap () returned 0xd20000 [0093.931] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.931] GetProcessHeap () returned 0xd20000 [0093.931] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0093.931] GetProcessHeap () returned 0xd20000 [0093.931] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0093.931] GetProcessHeap () returned 0xd20000 [0093.931] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.931] GetProcessHeap () returned 0xd20000 [0093.931] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.931] GetProcessHeap () returned 0xd20000 [0093.931] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.931] GetProcessHeap () returned 0xd20000 [0093.931] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.931] GetProcessHeap () returned 0xd20000 [0093.931] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.931] GetProcessHeap () returned 0xd20000 [0093.931] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.931] GetProcessHeap () returned 0xd20000 [0093.931] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.932] GetProcessHeap () returned 0xd20000 [0093.932] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.932] GetProcessHeap () returned 0xd20000 [0093.932] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0093.932] GetProcessHeap () returned 0xd20000 [0093.932] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0093.932] GetProcessHeap () returned 0xd20000 [0093.932] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0093.932] GetProcessHeap () returned 0xd20000 [0093.932] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0093.932] GetProcessHeap () returned 0xd20000 [0093.932] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0093.932] GetProcessHeap () returned 0xd20000 [0093.932] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0093.932] GetProcessHeap () returned 0xd20000 [0093.932] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.932] GetProcessHeap () returned 0xd20000 [0093.932] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.932] GetProcessHeap () returned 0xd20000 [0093.932] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0093.933] GetProcessHeap () returned 0xd20000 [0093.933] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0093.933] GetProcessHeap () returned 0xd20000 [0093.933] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.933] GetProcessHeap () returned 0xd20000 [0093.933] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.933] GetProcessHeap () returned 0xd20000 [0093.933] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0093.933] GetProcessHeap () returned 0xd20000 [0093.933] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0093.933] GetProcessHeap () returned 0xd20000 [0093.933] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0093.933] GetProcessHeap () returned 0xd20000 [0093.933] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0093.933] GetProcessHeap () returned 0xd20000 [0093.933] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.933] GetProcessHeap () returned 0xd20000 [0093.933] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.933] GetProcessHeap () returned 0xd20000 [0093.933] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0093.934] GetProcessHeap () returned 0xd20000 [0093.934] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0093.934] GetProcessHeap () returned 0xd20000 [0093.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0093.934] GetProcessHeap () returned 0xd20000 [0093.934] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0093.934] GetProcessHeap () returned 0xd20000 [0093.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.934] GetProcessHeap () returned 0xd20000 [0093.934] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.934] GetProcessHeap () returned 0xd20000 [0093.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.934] GetProcessHeap () returned 0xd20000 [0093.934] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.934] GetProcessHeap () returned 0xd20000 [0093.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.934] GetProcessHeap () returned 0xd20000 [0093.935] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.935] GetProcessHeap () returned 0xd20000 [0093.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0093.935] GetProcessHeap () returned 0xd20000 [0093.935] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0093.935] GetProcessHeap () returned 0xd20000 [0093.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.935] GetProcessHeap () returned 0xd20000 [0093.935] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.935] GetProcessHeap () returned 0xd20000 [0093.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.935] GetProcessHeap () returned 0xd20000 [0093.935] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.935] GetProcessHeap () returned 0xd20000 [0093.936] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.936] GetProcessHeap () returned 0xd20000 [0093.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.936] GetProcessHeap () returned 0xd20000 [0093.936] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0093.936] GetProcessHeap () returned 0xd20000 [0093.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0093.936] GetProcessHeap () returned 0xd20000 [0093.936] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.936] GetProcessHeap () returned 0xd20000 [0093.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.936] GetProcessHeap () returned 0xd20000 [0093.936] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.936] GetProcessHeap () returned 0xd20000 [0093.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.937] GetProcessHeap () returned 0xd20000 [0093.937] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0093.937] GetProcessHeap () returned 0xd20000 [0093.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0093.937] GetProcessHeap () returned 0xd20000 [0093.937] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.937] GetProcessHeap () returned 0xd20000 [0093.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.937] GetProcessHeap () returned 0xd20000 [0093.937] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.937] GetProcessHeap () returned 0xd20000 [0093.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.937] GetProcessHeap () returned 0xd20000 [0093.937] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0093.938] GetProcessHeap () returned 0xd20000 [0093.940] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0093.940] GetProcessHeap () returned 0xd20000 [0093.940] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.940] GetProcessHeap () returned 0xd20000 [0093.940] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.940] GetProcessHeap () returned 0xd20000 [0093.940] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.940] GetProcessHeap () returned 0xd20000 [0093.940] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.940] GetProcessHeap () returned 0xd20000 [0093.940] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.940] GetProcessHeap () returned 0xd20000 [0093.940] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.940] GetProcessHeap () returned 0xd20000 [0093.940] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.940] GetProcessHeap () returned 0xd20000 [0093.941] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.941] GetProcessHeap () returned 0xd20000 [0093.941] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.941] GetProcessHeap () returned 0xd20000 [0093.941] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.941] GetProcessHeap () returned 0xd20000 [0093.941] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.941] GetProcessHeap () returned 0xd20000 [0093.941] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.941] GetProcessHeap () returned 0xd20000 [0093.941] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0093.941] GetProcessHeap () returned 0xd20000 [0093.941] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0093.941] GetProcessHeap () returned 0xd20000 [0093.941] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.941] GetProcessHeap () returned 0xd20000 [0093.941] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.942] GetProcessHeap () returned 0xd20000 [0093.942] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.942] GetProcessHeap () returned 0xd20000 [0093.942] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.942] GetProcessHeap () returned 0xd20000 [0093.942] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.942] GetProcessHeap () returned 0xd20000 [0093.942] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.942] GetProcessHeap () returned 0xd20000 [0093.942] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.942] GetProcessHeap () returned 0xd20000 [0093.942] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.942] GetProcessHeap () returned 0xd20000 [0093.942] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.942] GetProcessHeap () returned 0xd20000 [0093.942] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.942] GetProcessHeap () returned 0xd20000 [0093.942] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.943] GetProcessHeap () returned 0xd20000 [0093.943] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.943] GetProcessHeap () returned 0xd20000 [0093.943] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0093.943] GetProcessHeap () returned 0xd20000 [0093.943] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0093.943] GetProcessHeap () returned 0xd20000 [0093.943] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.943] GetProcessHeap () returned 0xd20000 [0093.943] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.943] GetProcessHeap () returned 0xd20000 [0093.943] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.943] GetProcessHeap () returned 0xd20000 [0093.943] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.943] GetProcessHeap () returned 0xd20000 [0093.943] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.943] GetProcessHeap () returned 0xd20000 [0093.943] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.943] GetProcessHeap () returned 0xd20000 [0093.943] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0093.943] GetProcessHeap () returned 0xd20000 [0093.944] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0093.944] GetProcessHeap () returned 0xd20000 [0093.944] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.944] GetProcessHeap () returned 0xd20000 [0093.944] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.944] GetProcessHeap () returned 0xd20000 [0093.944] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0093.944] GetProcessHeap () returned 0xd20000 [0093.944] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.944] GetProcessHeap () returned 0xd20000 [0093.944] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.944] GetProcessHeap () returned 0xd20000 [0093.944] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.944] GetProcessHeap () returned 0xd20000 [0093.944] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0093.944] GetProcessHeap () returned 0xd20000 [0093.944] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0093.944] GetProcessHeap () returned 0xd20000 [0093.944] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0093.944] GetProcessHeap () returned 0xd20000 [0093.944] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0093.944] GetProcessHeap () returned 0xd20000 [0093.945] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0093.945] GetProcessHeap () returned 0xd20000 [0093.945] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0093.945] GetProcessHeap () returned 0xd20000 [0093.945] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44558 | out: hHeap=0xd20000) returned 1 [0093.945] GetProcessHeap () returned 0xd20000 [0093.945] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b6c8 | out: hHeap=0xd20000) returned 1 [0093.945] GetProcessHeap () returned 0xd20000 [0093.945] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0093.945] GetProcessHeap () returned 0xd20000 [0093.945] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b638 | out: hHeap=0xd20000) returned 1 [0093.945] GetProcessHeap () returned 0xd20000 [0093.945] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0093.945] GetProcessHeap () returned 0xd20000 [0093.945] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.945] GetProcessHeap () returned 0xd20000 [0093.945] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0093.945] WriteFile (in: hFile=0x230, lpBuffer=0xd4da68*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4da68*, lpNumberOfBytesWritten=0x299d864*=0x386, lpOverlapped=0x0) returned 1 [0093.951] GetProcessHeap () returned 0xd20000 [0093.951] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4da68, Size=0x30) returned 0xd4da68 [0093.951] GetProcessHeap () returned 0xd20000 [0093.951] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0093.951] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0093.952] GetProcessHeap () returned 0xd20000 [0093.952] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x11460) returned 0xd4daa0 [0093.952] ReadFile (in: hFile=0x230, lpBuffer=0xd4daa0, nNumberOfBytesToRead=0x11460, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4daa0*, lpNumberOfBytesRead=0x299d7e8*=0x11460, lpOverlapped=0x0) returned 1 [0093.957] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0093.957] WriteFile (in: hFile=0x230, lpBuffer=0xd4daa0*, nNumberOfBytesToWrite=0x11460, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4daa0*, lpNumberOfBytesWritten=0x299d7e4*=0x11460, lpOverlapped=0x0) returned 1 [0093.959] GetProcessHeap () returned 0xd20000 [0093.959] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4daa0 | out: hHeap=0xd20000) returned 1 [0093.960] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0093.960] WriteFile (in: hFile=0x230, lpBuffer=0xd4da68*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4da68*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0093.961] CloseHandle (hObject=0x230) returned 1 [0093.969] GetProcessHeap () returned 0xd20000 [0093.969] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd428c8 | out: hHeap=0xd20000) returned 1 [0093.969] GetProcessHeap () returned 0xd20000 [0093.969] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c1d8 | out: hHeap=0xd20000) returned 1 [0093.969] GetProcessHeap () returned 0xd20000 [0093.969] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0093.969] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" [0093.969] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm.[ponce.lorena@aol.com]" [0093.969] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fi-fi.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0093.970] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fi-fi.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0093.970] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0093.970] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0093.971] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0093.971] GetProcessHeap () returned 0xd20000 [0093.971] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446c0 | out: hHeap=0xd20000) returned 1 [0093.971] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e0ee6, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e0ee6, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10f0a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_fr-ca.htm", cAlternateFileName="EULA_F~2.HTM")) returned 1 [0093.971] lstrcmpiW (lpString1="EULA_fr-ca.htm", lpString2=".") returned 1 [0093.971] lstrcmpiW (lpString1="EULA_fr-ca.htm", lpString2="..") returned 1 [0093.971] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_fr-ca.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" [0093.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_fr-ca.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0093.971] GetProcessHeap () returned 0xd20000 [0093.971] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd44648 [0093.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_fr-ca.htm", cchWideChar=-1, lpMultiByteStr=0xd44648, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_fr-ca.htm", lpUsedDefaultChar=0x0) returned 15 [0093.971] lstrlenA (lpString="EULA_fr-ca.htm") returned 14 [0093.971] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0093.971] lstrlenA (lpString="EULA_fr-ca.htm") returned 14 [0093.971] lstrlenA (lpString=".dll") returned 4 [0093.971] lstrlenA (lpString=".dll") returned 4 [0093.971] lstrlenA (lpString="EULA_fr-ca.htm") returned 14 [0093.972] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0093.972] lstrlenA (lpString="EULA_fr-ca.htm") returned 14 [0093.972] lstrlenA (lpString=".ini") returned 4 [0093.972] lstrlenA (lpString=".ini") returned 4 [0093.972] lstrlenA (lpString="EULA_fr-ca.htm") returned 14 [0093.972] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0093.972] lstrlenA (lpString="EULA_fr-ca.htm") returned 14 [0093.972] lstrlenA (lpString=".inc") returned 4 [0093.972] lstrlenA (lpString=".inc") returned 4 [0093.972] lstrlenA (lpString="EULA_fr-ca.htm") returned 14 [0093.972] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0093.972] lstrcmpiW (lpString1="EULA_fr-ca.htm", lpString2="HOW_RECOVER.html") returned -1 [0093.972] lstrcmpiW (lpString1="EULA_fr-ca.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0093.972] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0093.972] lstrcmpiW (lpString1="EULA_fr-ca.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0093.972] GetProcessHeap () returned 0xd20000 [0093.972] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42530 [0093.972] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0093.973] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=69386) returned 1 [0093.973] GetProcessHeap () returned 0xd20000 [0093.973] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bcb0 [0093.973] GetProcessHeap () returned 0xd20000 [0093.973] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0093.973] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm") returned 52 [0093.973] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0093.973] GetProcessHeap () returned 0xd20000 [0093.973] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0093.973] GetProcessHeap () returned 0xd20000 [0093.973] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x386) returned 0xd4daa0 [0093.974] lstrlenA (lpString="rsa_encrypt") returned 11 [0093.974] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0093.976] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0093.976] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0093.976] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0093.976] GetProcessHeap () returned 0xd20000 [0093.976] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0093.976] lstrlenA (lpString="010001") returned 6 [0093.976] GetProcessHeap () returned 0xd20000 [0093.976] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0093.976] GetProcessHeap () returned 0xd20000 [0093.976] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0093.976] GetProcessHeap () returned 0xd20000 [0093.976] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aa68 [0093.976] GetProcessHeap () returned 0xd20000 [0093.977] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0093.977] GetProcessHeap () returned 0xd20000 [0093.977] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4adc8 [0093.977] GetProcessHeap () returned 0xd20000 [0093.977] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44d80 [0093.977] GetProcessHeap () returned 0xd20000 [0093.977] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc98 [0093.977] GetProcessHeap () returned 0xd20000 [0093.977] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0093.977] GetProcessHeap () returned 0xd20000 [0093.977] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.977] GetProcessHeap () returned 0xd20000 [0093.977] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0093.977] GetProcessHeap () returned 0xd20000 [0093.977] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0093.977] GetProcessHeap () returned 0xd20000 [0093.977] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd45640 [0093.977] GetProcessHeap () returned 0xd20000 [0093.977] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.977] GetProcessHeap () returned 0xd20000 [0093.977] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44630 [0093.978] GetProcessHeap () returned 0xd20000 [0093.978] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ac18 [0093.978] GetProcessHeap () returned 0xd20000 [0093.978] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0093.978] GetProcessHeap () returned 0xd20000 [0093.978] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0093.978] GetProcessHeap () returned 0xd20000 [0093.978] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ac18 | out: hHeap=0xd20000) returned 1 [0093.978] GetProcessHeap () returned 0xd20000 [0093.978] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0093.978] GetProcessHeap () returned 0xd20000 [0093.978] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446a8 [0093.978] GetProcessHeap () returned 0xd20000 [0093.978] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.978] GetProcessHeap () returned 0xd20000 [0093.978] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0093.978] GetProcessHeap () returned 0xd20000 [0093.978] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.978] GetProcessHeap () returned 0xd20000 [0093.979] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.979] GetProcessHeap () returned 0xd20000 [0093.979] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.979] GetProcessHeap () returned 0xd20000 [0093.979] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.979] GetProcessHeap () returned 0xd20000 [0093.979] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b248 [0093.979] GetProcessHeap () returned 0xd20000 [0093.979] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446a8 | out: hHeap=0xd20000) returned 1 [0093.979] GetProcessHeap () returned 0xd20000 [0093.979] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0093.979] GetProcessHeap () returned 0xd20000 [0093.979] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b248 | out: hHeap=0xd20000) returned 1 [0093.979] GetProcessHeap () returned 0xd20000 [0093.979] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.979] GetProcessHeap () returned 0xd20000 [0093.979] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.979] GetProcessHeap () returned 0xd20000 [0093.979] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0093.979] GetProcessHeap () returned 0xd20000 [0093.980] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0093.980] GetProcessHeap () returned 0xd20000 [0093.980] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0093.980] GetProcessHeap () returned 0xd20000 [0093.980] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0093.980] GetProcessHeap () returned 0xd20000 [0093.980] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.980] GetProcessHeap () returned 0xd20000 [0093.980] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.980] GetProcessHeap () returned 0xd20000 [0093.980] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0093.980] GetProcessHeap () returned 0xd20000 [0093.980] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0093.980] GetProcessHeap () returned 0xd20000 [0093.980] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0093.980] GetProcessHeap () returned 0xd20000 [0093.980] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0093.980] GetProcessHeap () returned 0xd20000 [0093.980] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.980] GetProcessHeap () returned 0xd20000 [0093.981] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.981] GetProcessHeap () returned 0xd20000 [0093.981] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.981] GetProcessHeap () returned 0xd20000 [0093.981] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.981] GetProcessHeap () returned 0xd20000 [0093.981] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0093.981] GetProcessHeap () returned 0xd20000 [0093.981] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0093.981] GetProcessHeap () returned 0xd20000 [0093.981] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.981] GetProcessHeap () returned 0xd20000 [0093.981] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.981] GetProcessHeap () returned 0xd20000 [0093.981] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0093.981] GetProcessHeap () returned 0xd20000 [0093.981] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0093.981] GetProcessHeap () returned 0xd20000 [0093.981] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.981] GetProcessHeap () returned 0xd20000 [0093.981] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.982] GetProcessHeap () returned 0xd20000 [0093.982] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.982] GetProcessHeap () returned 0xd20000 [0093.982] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.982] GetProcessHeap () returned 0xd20000 [0093.982] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.982] GetProcessHeap () returned 0xd20000 [0093.982] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.982] GetProcessHeap () returned 0xd20000 [0093.982] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.982] GetProcessHeap () returned 0xd20000 [0093.982] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.982] GetProcessHeap () returned 0xd20000 [0093.982] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.982] GetProcessHeap () returned 0xd20000 [0093.982] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.982] GetProcessHeap () returned 0xd20000 [0093.982] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.982] GetProcessHeap () returned 0xd20000 [0093.982] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.982] GetProcessHeap () returned 0xd20000 [0093.982] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.982] GetProcessHeap () returned 0xd20000 [0093.983] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.983] GetProcessHeap () returned 0xd20000 [0093.983] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.983] GetProcessHeap () returned 0xd20000 [0093.983] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.983] GetProcessHeap () returned 0xd20000 [0093.983] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0093.983] GetProcessHeap () returned 0xd20000 [0093.983] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0093.983] GetProcessHeap () returned 0xd20000 [0093.983] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.983] GetProcessHeap () returned 0xd20000 [0093.983] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.983] GetProcessHeap () returned 0xd20000 [0093.983] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0093.983] GetProcessHeap () returned 0xd20000 [0093.983] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0093.983] GetProcessHeap () returned 0xd20000 [0093.983] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.983] GetProcessHeap () returned 0xd20000 [0093.983] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.983] GetProcessHeap () returned 0xd20000 [0093.983] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.984] GetProcessHeap () returned 0xd20000 [0093.984] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.984] GetProcessHeap () returned 0xd20000 [0093.984] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.984] GetProcessHeap () returned 0xd20000 [0093.984] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.984] GetProcessHeap () returned 0xd20000 [0093.984] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0093.984] GetProcessHeap () returned 0xd20000 [0093.984] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0093.984] GetProcessHeap () returned 0xd20000 [0093.984] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0093.984] GetProcessHeap () returned 0xd20000 [0093.984] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0093.984] GetProcessHeap () returned 0xd20000 [0093.984] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.984] GetProcessHeap () returned 0xd20000 [0093.984] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.984] GetProcessHeap () returned 0xd20000 [0093.985] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.985] GetProcessHeap () returned 0xd20000 [0093.985] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.985] GetProcessHeap () returned 0xd20000 [0093.985] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.985] GetProcessHeap () returned 0xd20000 [0093.985] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.985] GetProcessHeap () returned 0xd20000 [0093.985] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.985] GetProcessHeap () returned 0xd20000 [0093.985] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.985] GetProcessHeap () returned 0xd20000 [0093.986] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.986] GetProcessHeap () returned 0xd20000 [0093.986] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.986] GetProcessHeap () returned 0xd20000 [0093.986] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.986] GetProcessHeap () returned 0xd20000 [0093.986] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.986] GetProcessHeap () returned 0xd20000 [0093.986] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0093.986] GetProcessHeap () returned 0xd20000 [0093.986] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0093.986] GetProcessHeap () returned 0xd20000 [0093.986] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.986] GetProcessHeap () returned 0xd20000 [0093.986] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.986] GetProcessHeap () returned 0xd20000 [0093.986] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0093.986] GetProcessHeap () returned 0xd20000 [0093.986] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0093.986] GetProcessHeap () returned 0xd20000 [0093.987] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.987] GetProcessHeap () returned 0xd20000 [0093.987] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.987] GetProcessHeap () returned 0xd20000 [0093.987] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.987] GetProcessHeap () returned 0xd20000 [0093.987] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.987] GetProcessHeap () returned 0xd20000 [0093.987] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.987] GetProcessHeap () returned 0xd20000 [0093.987] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.987] GetProcessHeap () returned 0xd20000 [0093.987] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.987] GetProcessHeap () returned 0xd20000 [0093.987] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.987] GetProcessHeap () returned 0xd20000 [0093.987] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0093.987] GetProcessHeap () returned 0xd20000 [0093.987] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0093.987] GetProcessHeap () returned 0xd20000 [0093.987] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0093.987] GetProcessHeap () returned 0xd20000 [0093.988] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0093.988] GetProcessHeap () returned 0xd20000 [0093.988] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0093.988] GetProcessHeap () returned 0xd20000 [0093.988] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0093.988] GetProcessHeap () returned 0xd20000 [0093.988] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.988] GetProcessHeap () returned 0xd20000 [0093.988] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.988] GetProcessHeap () returned 0xd20000 [0093.988] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.988] GetProcessHeap () returned 0xd20000 [0093.988] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.988] GetProcessHeap () returned 0xd20000 [0093.988] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0093.988] GetProcessHeap () returned 0xd20000 [0093.988] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0093.988] GetProcessHeap () returned 0xd20000 [0093.988] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.988] GetProcessHeap () returned 0xd20000 [0093.989] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.989] GetProcessHeap () returned 0xd20000 [0093.989] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.989] GetProcessHeap () returned 0xd20000 [0093.989] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.989] GetProcessHeap () returned 0xd20000 [0093.989] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0093.989] GetProcessHeap () returned 0xd20000 [0093.989] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0093.989] GetProcessHeap () returned 0xd20000 [0093.989] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.989] GetProcessHeap () returned 0xd20000 [0093.989] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.989] GetProcessHeap () returned 0xd20000 [0093.989] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0093.989] GetProcessHeap () returned 0xd20000 [0093.989] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0093.989] GetProcessHeap () returned 0xd20000 [0093.989] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.989] GetProcessHeap () returned 0xd20000 [0093.989] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.990] GetProcessHeap () returned 0xd20000 [0093.990] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.990] GetProcessHeap () returned 0xd20000 [0093.990] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.990] GetProcessHeap () returned 0xd20000 [0093.990] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.990] GetProcessHeap () returned 0xd20000 [0093.990] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.990] GetProcessHeap () returned 0xd20000 [0093.990] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.990] GetProcessHeap () returned 0xd20000 [0093.990] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.990] GetProcessHeap () returned 0xd20000 [0093.990] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.990] GetProcessHeap () returned 0xd20000 [0093.990] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.990] GetProcessHeap () returned 0xd20000 [0093.990] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.990] GetProcessHeap () returned 0xd20000 [0093.990] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.990] GetProcessHeap () returned 0xd20000 [0093.990] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.990] GetProcessHeap () returned 0xd20000 [0093.991] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.991] GetProcessHeap () returned 0xd20000 [0093.991] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.991] GetProcessHeap () returned 0xd20000 [0093.991] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.991] GetProcessHeap () returned 0xd20000 [0093.991] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0093.991] GetProcessHeap () returned 0xd20000 [0093.991] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0093.991] GetProcessHeap () returned 0xd20000 [0093.991] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.991] GetProcessHeap () returned 0xd20000 [0093.991] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.991] GetProcessHeap () returned 0xd20000 [0093.991] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0093.991] GetProcessHeap () returned 0xd20000 [0093.991] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0093.991] GetProcessHeap () returned 0xd20000 [0093.991] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.991] GetProcessHeap () returned 0xd20000 [0093.991] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.991] GetProcessHeap () returned 0xd20000 [0093.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.992] GetProcessHeap () returned 0xd20000 [0093.992] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.992] GetProcessHeap () returned 0xd20000 [0093.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.992] GetProcessHeap () returned 0xd20000 [0093.992] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.992] GetProcessHeap () returned 0xd20000 [0093.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0093.992] GetProcessHeap () returned 0xd20000 [0093.992] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0093.992] GetProcessHeap () returned 0xd20000 [0093.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.992] GetProcessHeap () returned 0xd20000 [0093.992] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.992] GetProcessHeap () returned 0xd20000 [0093.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.992] GetProcessHeap () returned 0xd20000 [0093.992] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.992] GetProcessHeap () returned 0xd20000 [0093.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.992] GetProcessHeap () returned 0xd20000 [0093.993] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.993] GetProcessHeap () returned 0xd20000 [0093.993] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.993] GetProcessHeap () returned 0xd20000 [0093.993] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.993] GetProcessHeap () returned 0xd20000 [0093.993] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.993] GetProcessHeap () returned 0xd20000 [0093.993] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.993] GetProcessHeap () returned 0xd20000 [0093.993] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.993] GetProcessHeap () returned 0xd20000 [0093.993] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.993] GetProcessHeap () returned 0xd20000 [0093.993] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.993] GetProcessHeap () returned 0xd20000 [0093.993] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.993] GetProcessHeap () returned 0xd20000 [0093.993] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.993] GetProcessHeap () returned 0xd20000 [0093.994] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.994] GetProcessHeap () returned 0xd20000 [0093.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.994] GetProcessHeap () returned 0xd20000 [0093.994] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.994] GetProcessHeap () returned 0xd20000 [0093.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.994] GetProcessHeap () returned 0xd20000 [0093.994] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.994] GetProcessHeap () returned 0xd20000 [0093.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.994] GetProcessHeap () returned 0xd20000 [0093.994] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.994] GetProcessHeap () returned 0xd20000 [0093.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0093.994] GetProcessHeap () returned 0xd20000 [0093.994] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0093.994] GetProcessHeap () returned 0xd20000 [0093.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.994] GetProcessHeap () returned 0xd20000 [0093.994] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.994] GetProcessHeap () returned 0xd20000 [0093.995] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0093.995] GetProcessHeap () returned 0xd20000 [0093.995] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0093.995] GetProcessHeap () returned 0xd20000 [0093.995] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.995] GetProcessHeap () returned 0xd20000 [0093.995] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.995] GetProcessHeap () returned 0xd20000 [0093.995] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0093.995] GetProcessHeap () returned 0xd20000 [0093.995] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0093.995] GetProcessHeap () returned 0xd20000 [0093.995] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.995] GetProcessHeap () returned 0xd20000 [0093.995] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.995] GetProcessHeap () returned 0xd20000 [0093.995] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0093.995] GetProcessHeap () returned 0xd20000 [0093.996] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0093.996] GetProcessHeap () returned 0xd20000 [0093.996] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0093.996] GetProcessHeap () returned 0xd20000 [0093.996] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0093.996] GetProcessHeap () returned 0xd20000 [0093.996] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0093.996] GetProcessHeap () returned 0xd20000 [0093.996] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0093.996] GetProcessHeap () returned 0xd20000 [0093.996] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0093.996] GetProcessHeap () returned 0xd20000 [0093.996] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0093.996] GetProcessHeap () returned 0xd20000 [0093.996] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44630 | out: hHeap=0xd20000) returned 1 [0093.996] GetProcessHeap () returned 0xd20000 [0093.996] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4adc8 | out: hHeap=0xd20000) returned 1 [0093.996] GetProcessHeap () returned 0xd20000 [0093.996] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0093.996] GetProcessHeap () returned 0xd20000 [0093.997] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aa68 | out: hHeap=0xd20000) returned 1 [0093.997] GetProcessHeap () returned 0xd20000 [0093.997] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0093.997] GetProcessHeap () returned 0xd20000 [0093.997] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0093.997] GetProcessHeap () returned 0xd20000 [0093.997] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0093.997] WriteFile (in: hFile=0x230, lpBuffer=0xd4daa0*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4daa0*, lpNumberOfBytesWritten=0x299d864*=0x386, lpOverlapped=0x0) returned 1 [0094.003] GetProcessHeap () returned 0xd20000 [0094.003] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4daa0, Size=0x30) returned 0xd4daa0 [0094.003] GetProcessHeap () returned 0xd20000 [0094.003] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0094.003] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0094.003] GetProcessHeap () returned 0xd20000 [0094.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10f10) returned 0xd4dad8 [0094.005] ReadFile (in: hFile=0x230, lpBuffer=0xd4dad8, nNumberOfBytesToRead=0x10f10, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4dad8*, lpNumberOfBytesRead=0x299d7e8*=0x10f10, lpOverlapped=0x0) returned 1 [0094.009] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0094.009] WriteFile (in: hFile=0x230, lpBuffer=0xd4dad8*, nNumberOfBytesToWrite=0x10f10, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4dad8*, lpNumberOfBytesWritten=0x299d7e4*=0x10f10, lpOverlapped=0x0) returned 1 [0094.186] GetProcessHeap () returned 0xd20000 [0094.186] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4dad8 | out: hHeap=0xd20000) returned 1 [0094.186] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0094.186] WriteFile (in: hFile=0x230, lpBuffer=0xd4daa0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4daa0*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0094.199] CloseHandle (hObject=0x230) returned 1 [0094.205] GetProcessHeap () returned 0xd20000 [0094.205] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42530 | out: hHeap=0xd20000) returned 1 [0094.205] GetProcessHeap () returned 0xd20000 [0094.205] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bcb0 | out: hHeap=0xd20000) returned 1 [0094.206] GetProcessHeap () returned 0xd20000 [0094.206] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0094.206] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" [0094.206] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm.[ponce.lorena@aol.com]" [0094.206] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-ca.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0094.207] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-ca.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0094.207] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0094.207] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0094.207] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0094.207] GetProcessHeap () returned 0xd20000 [0094.207] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44648 | out: hHeap=0xd20000) returned 1 [0094.207] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e2266, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e2266, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10f0a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_fr-fr.htm", cAlternateFileName="EULA_F~3.HTM")) returned 1 [0094.207] lstrcmpiW (lpString1="EULA_fr-fr.htm", lpString2=".") returned 1 [0094.207] lstrcmpiW (lpString1="EULA_fr-fr.htm", lpString2="..") returned 1 [0094.207] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_fr-fr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" [0094.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_fr-fr.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0094.207] GetProcessHeap () returned 0xd20000 [0094.207] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd44408 [0094.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_fr-fr.htm", cchWideChar=-1, lpMultiByteStr=0xd44408, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_fr-fr.htm", lpUsedDefaultChar=0x0) returned 15 [0094.207] lstrlenA (lpString="EULA_fr-fr.htm") returned 14 [0094.208] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0094.208] lstrlenA (lpString="EULA_fr-fr.htm") returned 14 [0094.208] lstrlenA (lpString=".dll") returned 4 [0094.208] lstrlenA (lpString=".dll") returned 4 [0094.208] lstrlenA (lpString="EULA_fr-fr.htm") returned 14 [0094.208] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0094.208] lstrlenA (lpString="EULA_fr-fr.htm") returned 14 [0094.208] lstrlenA (lpString=".ini") returned 4 [0094.208] lstrlenA (lpString=".ini") returned 4 [0094.208] lstrlenA (lpString="EULA_fr-fr.htm") returned 14 [0094.208] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0094.208] lstrlenA (lpString="EULA_fr-fr.htm") returned 14 [0094.208] lstrlenA (lpString=".inc") returned 4 [0094.208] lstrlenA (lpString=".inc") returned 4 [0094.208] lstrlenA (lpString="EULA_fr-fr.htm") returned 14 [0094.208] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0094.208] lstrcmpiW (lpString1="EULA_fr-fr.htm", lpString2="HOW_RECOVER.html") returned -1 [0094.208] lstrcmpiW (lpString1="EULA_fr-fr.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0094.208] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0094.208] lstrcmpiW (lpString1="EULA_fr-fr.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0094.209] GetProcessHeap () returned 0xd20000 [0094.209] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42530 [0094.209] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0094.209] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=69386) returned 1 [0094.209] GetProcessHeap () returned 0xd20000 [0094.209] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bf80 [0094.209] GetProcessHeap () returned 0xd20000 [0094.209] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0094.209] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm") returned 52 [0094.209] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0094.210] GetProcessHeap () returned 0xd20000 [0094.210] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0094.210] GetProcessHeap () returned 0xd20000 [0094.210] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x386) returned 0xd4dad8 [0094.210] lstrlenA (lpString="rsa_encrypt") returned 11 [0094.210] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0094.217] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0094.217] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0094.217] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0094.217] GetProcessHeap () returned 0xd20000 [0094.217] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0094.217] lstrlenA (lpString="010001") returned 6 [0094.217] GetProcessHeap () returned 0xd20000 [0094.217] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cbf8 [0094.217] GetProcessHeap () returned 0xd20000 [0094.217] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0094.217] GetProcessHeap () returned 0xd20000 [0094.217] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ac18 [0094.218] GetProcessHeap () returned 0xd20000 [0094.218] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0094.218] GetProcessHeap () returned 0xd20000 [0094.218] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b008 [0094.218] GetProcessHeap () returned 0xd20000 [0094.218] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44b50 [0094.218] GetProcessHeap () returned 0xd20000 [0094.218] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd98 [0094.218] GetProcessHeap () returned 0xd20000 [0094.218] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0094.218] GetProcessHeap () returned 0xd20000 [0094.218] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.218] GetProcessHeap () returned 0xd20000 [0094.218] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0094.218] GetProcessHeap () returned 0xd20000 [0094.218] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0094.218] GetProcessHeap () returned 0xd20000 [0094.218] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44c68 [0094.218] GetProcessHeap () returned 0xd20000 [0094.218] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0094.218] GetProcessHeap () returned 0xd20000 [0094.218] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44648 [0094.219] GetProcessHeap () returned 0xd20000 [0094.219] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aaf8 [0094.219] GetProcessHeap () returned 0xd20000 [0094.219] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0094.219] GetProcessHeap () returned 0xd20000 [0094.219] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0094.219] GetProcessHeap () returned 0xd20000 [0094.219] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aaf8 | out: hHeap=0xd20000) returned 1 [0094.220] GetProcessHeap () returned 0xd20000 [0094.220] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.220] GetProcessHeap () returned 0xd20000 [0094.220] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44468 [0094.220] GetProcessHeap () returned 0xd20000 [0094.220] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0094.220] GetProcessHeap () returned 0xd20000 [0094.220] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.220] GetProcessHeap () returned 0xd20000 [0094.220] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0094.220] GetProcessHeap () returned 0xd20000 [0094.220] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0094.220] GetProcessHeap () returned 0xd20000 [0094.220] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0094.220] GetProcessHeap () returned 0xd20000 [0094.220] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0094.220] GetProcessHeap () returned 0xd20000 [0094.220] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b098 [0094.220] GetProcessHeap () returned 0xd20000 [0094.220] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44468 | out: hHeap=0xd20000) returned 1 [0094.220] GetProcessHeap () returned 0xd20000 [0094.220] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0094.221] GetProcessHeap () returned 0xd20000 [0094.221] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b098 | out: hHeap=0xd20000) returned 1 [0094.221] GetProcessHeap () returned 0xd20000 [0094.221] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.221] GetProcessHeap () returned 0xd20000 [0094.221] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.221] GetProcessHeap () returned 0xd20000 [0094.221] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.221] GetProcessHeap () returned 0xd20000 [0094.221] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.221] GetProcessHeap () returned 0xd20000 [0094.221] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.221] GetProcessHeap () returned 0xd20000 [0094.221] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.221] GetProcessHeap () returned 0xd20000 [0094.221] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.221] GetProcessHeap () returned 0xd20000 [0094.221] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.221] GetProcessHeap () returned 0xd20000 [0094.221] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.221] GetProcessHeap () returned 0xd20000 [0094.222] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.222] GetProcessHeap () returned 0xd20000 [0094.222] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0094.222] GetProcessHeap () returned 0xd20000 [0094.222] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0094.222] GetProcessHeap () returned 0xd20000 [0094.222] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.222] GetProcessHeap () returned 0xd20000 [0094.222] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.222] GetProcessHeap () returned 0xd20000 [0094.222] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.222] GetProcessHeap () returned 0xd20000 [0094.222] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.222] GetProcessHeap () returned 0xd20000 [0094.222] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.222] GetProcessHeap () returned 0xd20000 [0094.222] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.222] GetProcessHeap () returned 0xd20000 [0094.222] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0094.222] GetProcessHeap () returned 0xd20000 [0094.222] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0094.223] GetProcessHeap () returned 0xd20000 [0094.223] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.223] GetProcessHeap () returned 0xd20000 [0094.223] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.223] GetProcessHeap () returned 0xd20000 [0094.223] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0094.223] GetProcessHeap () returned 0xd20000 [0094.223] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0094.223] GetProcessHeap () returned 0xd20000 [0094.223] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.223] GetProcessHeap () returned 0xd20000 [0094.223] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.223] GetProcessHeap () returned 0xd20000 [0094.223] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.223] GetProcessHeap () returned 0xd20000 [0094.223] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.223] GetProcessHeap () returned 0xd20000 [0094.223] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.223] GetProcessHeap () returned 0xd20000 [0094.224] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.224] GetProcessHeap () returned 0xd20000 [0094.224] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.224] GetProcessHeap () returned 0xd20000 [0094.224] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.224] GetProcessHeap () returned 0xd20000 [0094.224] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0094.224] GetProcessHeap () returned 0xd20000 [0094.224] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0094.224] GetProcessHeap () returned 0xd20000 [0094.224] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0094.224] GetProcessHeap () returned 0xd20000 [0094.224] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0094.224] GetProcessHeap () returned 0xd20000 [0094.224] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.224] GetProcessHeap () returned 0xd20000 [0094.224] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.224] GetProcessHeap () returned 0xd20000 [0094.224] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0094.224] GetProcessHeap () returned 0xd20000 [0094.224] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0094.225] GetProcessHeap () returned 0xd20000 [0094.225] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.225] GetProcessHeap () returned 0xd20000 [0094.225] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.225] GetProcessHeap () returned 0xd20000 [0094.225] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0094.225] GetProcessHeap () returned 0xd20000 [0094.225] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0094.225] GetProcessHeap () returned 0xd20000 [0094.225] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0094.225] GetProcessHeap () returned 0xd20000 [0094.225] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0094.225] GetProcessHeap () returned 0xd20000 [0094.225] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.225] GetProcessHeap () returned 0xd20000 [0094.225] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.225] GetProcessHeap () returned 0xd20000 [0094.225] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0094.225] GetProcessHeap () returned 0xd20000 [0094.225] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0094.225] GetProcessHeap () returned 0xd20000 [0094.225] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0094.226] GetProcessHeap () returned 0xd20000 [0094.226] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0094.226] GetProcessHeap () returned 0xd20000 [0094.226] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0094.226] GetProcessHeap () returned 0xd20000 [0094.226] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0094.226] GetProcessHeap () returned 0xd20000 [0094.226] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.226] GetProcessHeap () returned 0xd20000 [0094.226] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.226] GetProcessHeap () returned 0xd20000 [0094.226] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0094.226] GetProcessHeap () returned 0xd20000 [0094.226] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0094.226] GetProcessHeap () returned 0xd20000 [0094.226] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.226] GetProcessHeap () returned 0xd20000 [0094.226] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.226] GetProcessHeap () returned 0xd20000 [0094.226] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0094.227] GetProcessHeap () returned 0xd20000 [0094.227] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0094.227] GetProcessHeap () returned 0xd20000 [0094.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0094.227] GetProcessHeap () returned 0xd20000 [0094.227] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0094.227] GetProcessHeap () returned 0xd20000 [0094.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.227] GetProcessHeap () returned 0xd20000 [0094.227] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.227] GetProcessHeap () returned 0xd20000 [0094.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0094.227] GetProcessHeap () returned 0xd20000 [0094.227] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0094.227] GetProcessHeap () returned 0xd20000 [0094.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0094.227] GetProcessHeap () returned 0xd20000 [0094.227] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0094.227] GetProcessHeap () returned 0xd20000 [0094.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0094.227] GetProcessHeap () returned 0xd20000 [0094.228] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0094.228] GetProcessHeap () returned 0xd20000 [0094.228] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.228] GetProcessHeap () returned 0xd20000 [0094.228] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.228] GetProcessHeap () returned 0xd20000 [0094.228] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.228] GetProcessHeap () returned 0xd20000 [0094.228] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.228] GetProcessHeap () returned 0xd20000 [0094.228] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0094.228] GetProcessHeap () returned 0xd20000 [0094.228] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0094.228] GetProcessHeap () returned 0xd20000 [0094.228] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.228] GetProcessHeap () returned 0xd20000 [0094.228] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.228] GetProcessHeap () returned 0xd20000 [0094.228] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.228] GetProcessHeap () returned 0xd20000 [0094.229] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.229] GetProcessHeap () returned 0xd20000 [0094.229] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.229] GetProcessHeap () returned 0xd20000 [0094.229] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.229] GetProcessHeap () returned 0xd20000 [0094.229] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0094.229] GetProcessHeap () returned 0xd20000 [0094.229] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0094.229] GetProcessHeap () returned 0xd20000 [0094.229] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.229] GetProcessHeap () returned 0xd20000 [0094.229] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.229] GetProcessHeap () returned 0xd20000 [0094.229] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.229] GetProcessHeap () returned 0xd20000 [0094.229] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.229] GetProcessHeap () returned 0xd20000 [0094.229] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0094.229] GetProcessHeap () returned 0xd20000 [0094.229] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0094.230] GetProcessHeap () returned 0xd20000 [0094.230] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.230] GetProcessHeap () returned 0xd20000 [0094.230] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.230] GetProcessHeap () returned 0xd20000 [0094.230] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.230] GetProcessHeap () returned 0xd20000 [0094.230] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.230] GetProcessHeap () returned 0xd20000 [0094.230] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0094.230] GetProcessHeap () returned 0xd20000 [0094.230] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0094.230] GetProcessHeap () returned 0xd20000 [0094.230] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.230] GetProcessHeap () returned 0xd20000 [0094.230] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.230] GetProcessHeap () returned 0xd20000 [0094.230] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.230] GetProcessHeap () returned 0xd20000 [0094.230] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.230] GetProcessHeap () returned 0xd20000 [0094.231] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.231] GetProcessHeap () returned 0xd20000 [0094.231] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.231] GetProcessHeap () returned 0xd20000 [0094.231] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.231] GetProcessHeap () returned 0xd20000 [0094.231] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.231] GetProcessHeap () returned 0xd20000 [0094.231] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.231] GetProcessHeap () returned 0xd20000 [0094.231] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.231] GetProcessHeap () returned 0xd20000 [0094.231] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.231] GetProcessHeap () returned 0xd20000 [0094.231] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.231] GetProcessHeap () returned 0xd20000 [0094.231] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0094.231] GetProcessHeap () returned 0xd20000 [0094.231] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0094.231] GetProcessHeap () returned 0xd20000 [0094.231] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.232] GetProcessHeap () returned 0xd20000 [0094.232] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.232] GetProcessHeap () returned 0xd20000 [0094.232] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.232] GetProcessHeap () returned 0xd20000 [0094.232] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.232] GetProcessHeap () returned 0xd20000 [0094.232] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.232] GetProcessHeap () returned 0xd20000 [0094.232] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.232] GetProcessHeap () returned 0xd20000 [0094.232] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.232] GetProcessHeap () returned 0xd20000 [0094.232] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.232] GetProcessHeap () returned 0xd20000 [0094.232] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.232] GetProcessHeap () returned 0xd20000 [0094.232] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.232] GetProcessHeap () returned 0xd20000 [0094.232] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.232] GetProcessHeap () returned 0xd20000 [0094.233] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.233] GetProcessHeap () returned 0xd20000 [0094.233] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0094.233] GetProcessHeap () returned 0xd20000 [0094.233] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0094.233] GetProcessHeap () returned 0xd20000 [0094.233] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.233] GetProcessHeap () returned 0xd20000 [0094.233] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.233] GetProcessHeap () returned 0xd20000 [0094.233] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.233] GetProcessHeap () returned 0xd20000 [0094.233] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.233] GetProcessHeap () returned 0xd20000 [0094.233] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.233] GetProcessHeap () returned 0xd20000 [0094.233] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.233] GetProcessHeap () returned 0xd20000 [0094.233] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0094.233] GetProcessHeap () returned 0xd20000 [0094.233] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0094.233] GetProcessHeap () returned 0xd20000 [0094.233] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.234] GetProcessHeap () returned 0xd20000 [0094.234] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.234] GetProcessHeap () returned 0xd20000 [0094.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.234] GetProcessHeap () returned 0xd20000 [0094.234] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.234] GetProcessHeap () returned 0xd20000 [0094.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.234] GetProcessHeap () returned 0xd20000 [0094.234] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.234] GetProcessHeap () returned 0xd20000 [0094.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0094.234] GetProcessHeap () returned 0xd20000 [0094.234] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0094.234] GetProcessHeap () returned 0xd20000 [0094.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.234] GetProcessHeap () returned 0xd20000 [0094.234] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.234] GetProcessHeap () returned 0xd20000 [0094.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.235] GetProcessHeap () returned 0xd20000 [0094.235] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.235] GetProcessHeap () returned 0xd20000 [0094.235] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.235] GetProcessHeap () returned 0xd20000 [0094.235] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.235] GetProcessHeap () returned 0xd20000 [0094.235] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0094.235] GetProcessHeap () returned 0xd20000 [0094.235] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0094.235] GetProcessHeap () returned 0xd20000 [0094.235] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.235] GetProcessHeap () returned 0xd20000 [0094.235] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.235] GetProcessHeap () returned 0xd20000 [0094.235] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0094.235] GetProcessHeap () returned 0xd20000 [0094.235] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0094.235] GetProcessHeap () returned 0xd20000 [0094.235] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0094.235] GetProcessHeap () returned 0xd20000 [0094.235] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0094.236] GetProcessHeap () returned 0xd20000 [0094.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.236] GetProcessHeap () returned 0xd20000 [0094.236] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.236] GetProcessHeap () returned 0xd20000 [0094.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0094.236] GetProcessHeap () returned 0xd20000 [0094.236] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0094.236] GetProcessHeap () returned 0xd20000 [0094.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.236] GetProcessHeap () returned 0xd20000 [0094.236] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.236] GetProcessHeap () returned 0xd20000 [0094.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0094.236] GetProcessHeap () returned 0xd20000 [0094.236] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0094.236] GetProcessHeap () returned 0xd20000 [0094.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.236] GetProcessHeap () returned 0xd20000 [0094.236] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.236] GetProcessHeap () returned 0xd20000 [0094.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.236] GetProcessHeap () returned 0xd20000 [0094.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.237] GetProcessHeap () returned 0xd20000 [0094.237] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.237] GetProcessHeap () returned 0xd20000 [0094.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.237] GetProcessHeap () returned 0xd20000 [0094.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0094.237] GetProcessHeap () returned 0xd20000 [0094.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0094.237] GetProcessHeap () returned 0xd20000 [0094.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0094.237] GetProcessHeap () returned 0xd20000 [0094.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0094.237] GetProcessHeap () returned 0xd20000 [0094.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44648 | out: hHeap=0xd20000) returned 1 [0094.237] GetProcessHeap () returned 0xd20000 [0094.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b008 | out: hHeap=0xd20000) returned 1 [0094.237] GetProcessHeap () returned 0xd20000 [0094.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0094.237] GetProcessHeap () returned 0xd20000 [0094.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ac18 | out: hHeap=0xd20000) returned 1 [0094.237] GetProcessHeap () returned 0xd20000 [0094.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0094.237] GetProcessHeap () returned 0xd20000 [0094.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0094.238] GetProcessHeap () returned 0xd20000 [0094.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0094.238] WriteFile (in: hFile=0x230, lpBuffer=0xd4dad8*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4dad8*, lpNumberOfBytesWritten=0x299d864*=0x386, lpOverlapped=0x0) returned 1 [0094.247] GetProcessHeap () returned 0xd20000 [0094.247] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4dad8, Size=0x30) returned 0xd4dad8 [0094.247] GetProcessHeap () returned 0xd20000 [0094.247] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0094.247] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0094.247] GetProcessHeap () returned 0xd20000 [0094.247] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10f10) returned 0xd4db10 [0094.247] ReadFile (in: hFile=0x230, lpBuffer=0xd4db10, nNumberOfBytesToRead=0x10f10, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4db10*, lpNumberOfBytesRead=0x299d7e8*=0x10f10, lpOverlapped=0x0) returned 1 [0094.250] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0094.251] WriteFile (in: hFile=0x230, lpBuffer=0xd4db10*, nNumberOfBytesToWrite=0x10f10, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4db10*, lpNumberOfBytesWritten=0x299d7e4*=0x10f10, lpOverlapped=0x0) returned 1 [0094.253] GetProcessHeap () returned 0xd20000 [0094.253] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4db10 | out: hHeap=0xd20000) returned 1 [0094.253] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0094.253] WriteFile (in: hFile=0x230, lpBuffer=0xd4dad8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4dad8*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0094.255] CloseHandle (hObject=0x230) returned 1 [0094.258] GetProcessHeap () returned 0xd20000 [0094.259] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42530 | out: hHeap=0xd20000) returned 1 [0094.259] GetProcessHeap () returned 0xd20000 [0094.259] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bf80 | out: hHeap=0xd20000) returned 1 [0094.259] GetProcessHeap () returned 0xd20000 [0094.259] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0094.259] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" [0094.259] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm.[ponce.lorena@aol.com]" [0094.259] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_fr-fr.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0094.260] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_fr-fr.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0094.260] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0094.260] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0094.260] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0094.260] GetProcessHeap () returned 0xd20000 [0094.260] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44408 | out: hHeap=0xd20000) returned 1 [0094.260] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e35dd, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e35dd, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xd3187, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_he-il.htm", cAlternateFileName="EULA_H~1.HTM")) returned 1 [0094.260] lstrcmpiW (lpString1="EULA_he-il.htm", lpString2=".") returned 1 [0094.260] lstrcmpiW (lpString1="EULA_he-il.htm", lpString2="..") returned 1 [0094.260] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_he-il.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" [0094.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_he-il.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0094.261] GetProcessHeap () returned 0xd20000 [0094.261] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd44528 [0094.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_he-il.htm", cchWideChar=-1, lpMultiByteStr=0xd44528, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_he-il.htm", lpUsedDefaultChar=0x0) returned 15 [0094.261] lstrlenA (lpString="EULA_he-il.htm") returned 14 [0094.261] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0094.261] lstrlenA (lpString="EULA_he-il.htm") returned 14 [0094.261] lstrlenA (lpString=".dll") returned 4 [0094.261] lstrlenA (lpString=".dll") returned 4 [0094.261] lstrlenA (lpString="EULA_he-il.htm") returned 14 [0094.261] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0094.261] lstrlenA (lpString="EULA_he-il.htm") returned 14 [0094.261] lstrlenA (lpString=".ini") returned 4 [0094.261] lstrlenA (lpString=".ini") returned 4 [0094.261] lstrlenA (lpString="EULA_he-il.htm") returned 14 [0094.261] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0094.261] lstrlenA (lpString="EULA_he-il.htm") returned 14 [0094.261] lstrlenA (lpString=".inc") returned 4 [0094.261] lstrlenA (lpString=".inc") returned 4 [0094.262] lstrlenA (lpString="EULA_he-il.htm") returned 14 [0094.262] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0094.262] lstrcmpiW (lpString1="EULA_he-il.htm", lpString2="HOW_RECOVER.html") returned -1 [0094.262] lstrcmpiW (lpString1="EULA_he-il.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0094.262] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0094.262] lstrcmpiW (lpString1="EULA_he-il.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0094.262] GetProcessHeap () returned 0xd20000 [0094.262] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42850 [0094.262] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0094.262] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=864647) returned 1 [0094.263] GetProcessHeap () returned 0xd20000 [0094.263] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c1d8 [0094.263] GetProcessHeap () returned 0xd20000 [0094.263] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0094.263] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm") returned 52 [0094.263] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0094.263] GetProcessHeap () returned 0xd20000 [0094.263] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0094.263] GetProcessHeap () returned 0xd20000 [0094.263] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4db10 [0094.263] lstrlenA (lpString="rsa_encrypt") returned 11 [0094.264] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0094.265] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0094.265] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0094.266] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0094.266] GetProcessHeap () returned 0xd20000 [0094.266] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0094.266] lstrlenA (lpString="010001") returned 6 [0094.266] GetProcessHeap () returned 0xd20000 [0094.266] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd98 [0094.266] GetProcessHeap () returned 0xd20000 [0094.266] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0094.266] GetProcessHeap () returned 0xd20000 [0094.266] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b128 [0094.266] GetProcessHeap () returned 0xd20000 [0094.266] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0094.266] GetProcessHeap () returned 0xd20000 [0094.266] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b248 [0094.266] GetProcessHeap () returned 0xd20000 [0094.266] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44e98 [0094.267] GetProcessHeap () returned 0xd20000 [0094.267] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cdb8 [0094.267] GetProcessHeap () returned 0xd20000 [0094.267] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0094.267] GetProcessHeap () returned 0xd20000 [0094.267] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.267] GetProcessHeap () returned 0xd20000 [0094.267] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0094.267] GetProcessHeap () returned 0xd20000 [0094.267] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0094.267] GetProcessHeap () returned 0xd20000 [0094.267] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44fb0 [0094.267] GetProcessHeap () returned 0xd20000 [0094.267] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0094.267] GetProcessHeap () returned 0xd20000 [0094.267] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444c8 [0094.267] GetProcessHeap () returned 0xd20000 [0094.267] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b878 [0094.267] GetProcessHeap () returned 0xd20000 [0094.267] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0094.268] GetProcessHeap () returned 0xd20000 [0094.268] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0094.268] GetProcessHeap () returned 0xd20000 [0094.268] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b878 | out: hHeap=0xd20000) returned 1 [0094.268] GetProcessHeap () returned 0xd20000 [0094.268] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0094.268] GetProcessHeap () returned 0xd20000 [0094.268] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446c0 [0094.268] GetProcessHeap () returned 0xd20000 [0094.268] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0094.268] GetProcessHeap () returned 0xd20000 [0094.268] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0094.268] GetProcessHeap () returned 0xd20000 [0094.268] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0094.268] GetProcessHeap () returned 0xd20000 [0094.268] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0094.268] GetProcessHeap () returned 0xd20000 [0094.268] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.268] GetProcessHeap () returned 0xd20000 [0094.268] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.269] GetProcessHeap () returned 0xd20000 [0094.269] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b1b8 [0094.269] GetProcessHeap () returned 0xd20000 [0094.269] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446c0 | out: hHeap=0xd20000) returned 1 [0094.269] GetProcessHeap () returned 0xd20000 [0094.269] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0094.269] GetProcessHeap () returned 0xd20000 [0094.269] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b1b8 | out: hHeap=0xd20000) returned 1 [0094.269] GetProcessHeap () returned 0xd20000 [0094.269] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.269] GetProcessHeap () returned 0xd20000 [0094.269] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.269] GetProcessHeap () returned 0xd20000 [0094.269] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.269] GetProcessHeap () returned 0xd20000 [0094.269] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.269] GetProcessHeap () returned 0xd20000 [0094.269] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.269] GetProcessHeap () returned 0xd20000 [0094.269] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.269] GetProcessHeap () returned 0xd20000 [0094.270] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.270] GetProcessHeap () returned 0xd20000 [0094.270] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.270] GetProcessHeap () returned 0xd20000 [0094.270] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.270] GetProcessHeap () returned 0xd20000 [0094.270] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.270] GetProcessHeap () returned 0xd20000 [0094.270] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0094.270] GetProcessHeap () returned 0xd20000 [0094.270] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0094.270] GetProcessHeap () returned 0xd20000 [0094.270] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.270] GetProcessHeap () returned 0xd20000 [0094.270] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.270] GetProcessHeap () returned 0xd20000 [0094.270] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0094.270] GetProcessHeap () returned 0xd20000 [0094.270] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0094.270] GetProcessHeap () returned 0xd20000 [0094.271] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.271] GetProcessHeap () returned 0xd20000 [0094.271] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.271] GetProcessHeap () returned 0xd20000 [0094.271] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.271] GetProcessHeap () returned 0xd20000 [0094.271] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.271] GetProcessHeap () returned 0xd20000 [0094.271] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.271] GetProcessHeap () returned 0xd20000 [0094.271] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.271] GetProcessHeap () returned 0xd20000 [0094.271] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0094.271] GetProcessHeap () returned 0xd20000 [0094.271] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0094.271] GetProcessHeap () returned 0xd20000 [0094.271] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0094.271] GetProcessHeap () returned 0xd20000 [0094.271] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0094.271] GetProcessHeap () returned 0xd20000 [0094.272] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.272] GetProcessHeap () returned 0xd20000 [0094.272] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.272] GetProcessHeap () returned 0xd20000 [0094.272] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.272] GetProcessHeap () returned 0xd20000 [0094.272] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.272] GetProcessHeap () returned 0xd20000 [0094.272] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.272] GetProcessHeap () returned 0xd20000 [0094.272] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.272] GetProcessHeap () returned 0xd20000 [0094.272] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.272] GetProcessHeap () returned 0xd20000 [0094.272] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.272] GetProcessHeap () returned 0xd20000 [0094.272] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.272] GetProcessHeap () returned 0xd20000 [0094.272] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.272] GetProcessHeap () returned 0xd20000 [0094.272] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.272] GetProcessHeap () returned 0xd20000 [0094.272] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.273] GetProcessHeap () returned 0xd20000 [0094.273] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0094.273] GetProcessHeap () returned 0xd20000 [0094.273] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0094.273] GetProcessHeap () returned 0xd20000 [0094.273] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.273] GetProcessHeap () returned 0xd20000 [0094.273] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.273] GetProcessHeap () returned 0xd20000 [0094.273] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0094.273] GetProcessHeap () returned 0xd20000 [0094.273] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0094.273] GetProcessHeap () returned 0xd20000 [0094.273] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.273] GetProcessHeap () returned 0xd20000 [0094.273] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.273] GetProcessHeap () returned 0xd20000 [0094.273] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0094.273] GetProcessHeap () returned 0xd20000 [0094.273] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0094.273] GetProcessHeap () returned 0xd20000 [0094.274] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.274] GetProcessHeap () returned 0xd20000 [0094.274] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.274] GetProcessHeap () returned 0xd20000 [0094.274] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0094.274] GetProcessHeap () returned 0xd20000 [0094.274] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0094.274] GetProcessHeap () returned 0xd20000 [0094.274] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0094.274] GetProcessHeap () returned 0xd20000 [0094.274] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0094.274] GetProcessHeap () returned 0xd20000 [0094.274] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0094.274] GetProcessHeap () returned 0xd20000 [0094.274] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0094.274] GetProcessHeap () returned 0xd20000 [0094.274] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0094.274] GetProcessHeap () returned 0xd20000 [0094.274] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0094.274] GetProcessHeap () returned 0xd20000 [0094.275] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.275] GetProcessHeap () returned 0xd20000 [0094.275] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.275] GetProcessHeap () returned 0xd20000 [0094.275] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.275] GetProcessHeap () returned 0xd20000 [0094.275] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.275] GetProcessHeap () returned 0xd20000 [0094.275] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0094.275] GetProcessHeap () returned 0xd20000 [0094.275] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0094.275] GetProcessHeap () returned 0xd20000 [0094.275] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.275] GetProcessHeap () returned 0xd20000 [0094.275] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.275] GetProcessHeap () returned 0xd20000 [0094.275] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.275] GetProcessHeap () returned 0xd20000 [0094.275] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.275] GetProcessHeap () returned 0xd20000 [0094.276] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0094.276] GetProcessHeap () returned 0xd20000 [0094.276] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0094.276] GetProcessHeap () returned 0xd20000 [0094.276] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0094.276] GetProcessHeap () returned 0xd20000 [0094.276] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0094.276] GetProcessHeap () returned 0xd20000 [0094.276] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0094.276] GetProcessHeap () returned 0xd20000 [0094.276] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0094.276] GetProcessHeap () returned 0xd20000 [0094.276] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.276] GetProcessHeap () returned 0xd20000 [0094.276] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.276] GetProcessHeap () returned 0xd20000 [0094.276] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.276] GetProcessHeap () returned 0xd20000 [0094.276] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.276] GetProcessHeap () returned 0xd20000 [0094.277] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.277] GetProcessHeap () returned 0xd20000 [0094.277] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.277] GetProcessHeap () returned 0xd20000 [0094.277] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0094.277] GetProcessHeap () returned 0xd20000 [0094.277] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0094.277] GetProcessHeap () returned 0xd20000 [0094.277] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.277] GetProcessHeap () returned 0xd20000 [0094.277] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.277] GetProcessHeap () returned 0xd20000 [0094.277] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.277] GetProcessHeap () returned 0xd20000 [0094.277] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.277] GetProcessHeap () returned 0xd20000 [0094.277] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.277] GetProcessHeap () returned 0xd20000 [0094.277] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.277] GetProcessHeap () returned 0xd20000 [0094.278] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0094.278] GetProcessHeap () returned 0xd20000 [0094.278] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0094.278] GetProcessHeap () returned 0xd20000 [0094.278] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0094.278] GetProcessHeap () returned 0xd20000 [0094.278] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0094.278] GetProcessHeap () returned 0xd20000 [0094.278] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.278] GetProcessHeap () returned 0xd20000 [0094.278] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.278] GetProcessHeap () returned 0xd20000 [0094.278] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0094.278] GetProcessHeap () returned 0xd20000 [0094.278] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0094.278] GetProcessHeap () returned 0xd20000 [0094.278] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.278] GetProcessHeap () returned 0xd20000 [0094.278] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.279] GetProcessHeap () returned 0xd20000 [0094.279] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0094.279] GetProcessHeap () returned 0xd20000 [0094.279] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0094.279] GetProcessHeap () returned 0xd20000 [0094.279] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.279] GetProcessHeap () returned 0xd20000 [0094.279] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.279] GetProcessHeap () returned 0xd20000 [0094.279] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0094.279] GetProcessHeap () returned 0xd20000 [0094.279] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0094.279] GetProcessHeap () returned 0xd20000 [0094.279] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.279] GetProcessHeap () returned 0xd20000 [0094.279] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.279] GetProcessHeap () returned 0xd20000 [0094.279] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.279] GetProcessHeap () returned 0xd20000 [0094.280] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.280] GetProcessHeap () returned 0xd20000 [0094.280] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0094.280] GetProcessHeap () returned 0xd20000 [0094.280] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0094.280] GetProcessHeap () returned 0xd20000 [0094.280] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.280] GetProcessHeap () returned 0xd20000 [0094.280] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.280] GetProcessHeap () returned 0xd20000 [0094.280] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.280] GetProcessHeap () returned 0xd20000 [0094.280] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.280] GetProcessHeap () returned 0xd20000 [0094.280] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.280] GetProcessHeap () returned 0xd20000 [0094.280] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.280] GetProcessHeap () returned 0xd20000 [0094.280] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.280] GetProcessHeap () returned 0xd20000 [0094.281] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.281] GetProcessHeap () returned 0xd20000 [0094.281] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.281] GetProcessHeap () returned 0xd20000 [0094.281] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.281] GetProcessHeap () returned 0xd20000 [0094.281] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.281] GetProcessHeap () returned 0xd20000 [0094.281] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.281] GetProcessHeap () returned 0xd20000 [0094.281] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.281] GetProcessHeap () returned 0xd20000 [0094.281] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.281] GetProcessHeap () returned 0xd20000 [0094.281] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.281] GetProcessHeap () returned 0xd20000 [0094.293] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.293] GetProcessHeap () returned 0xd20000 [0094.293] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.293] GetProcessHeap () returned 0xd20000 [0094.293] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.293] GetProcessHeap () returned 0xd20000 [0094.293] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.293] GetProcessHeap () returned 0xd20000 [0094.293] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.293] GetProcessHeap () returned 0xd20000 [0094.294] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0094.294] GetProcessHeap () returned 0xd20000 [0094.294] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0094.294] GetProcessHeap () returned 0xd20000 [0094.294] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.294] GetProcessHeap () returned 0xd20000 [0094.294] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.294] GetProcessHeap () returned 0xd20000 [0094.294] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.294] GetProcessHeap () returned 0xd20000 [0094.294] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.294] GetProcessHeap () returned 0xd20000 [0094.294] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.294] GetProcessHeap () returned 0xd20000 [0094.294] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.294] GetProcessHeap () returned 0xd20000 [0094.294] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.294] GetProcessHeap () returned 0xd20000 [0094.294] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.294] GetProcessHeap () returned 0xd20000 [0094.294] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.295] GetProcessHeap () returned 0xd20000 [0094.295] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.295] GetProcessHeap () returned 0xd20000 [0094.295] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.295] GetProcessHeap () returned 0xd20000 [0094.295] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.295] GetProcessHeap () returned 0xd20000 [0094.295] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.295] GetProcessHeap () returned 0xd20000 [0094.295] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.295] GetProcessHeap () returned 0xd20000 [0094.295] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0094.295] GetProcessHeap () returned 0xd20000 [0094.295] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0094.295] GetProcessHeap () returned 0xd20000 [0094.295] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0094.295] GetProcessHeap () returned 0xd20000 [0094.295] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0094.295] GetProcessHeap () returned 0xd20000 [0094.295] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.303] GetProcessHeap () returned 0xd20000 [0094.303] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.303] GetProcessHeap () returned 0xd20000 [0094.303] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.303] GetProcessHeap () returned 0xd20000 [0094.303] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.307] GetProcessHeap () returned 0xd20000 [0094.307] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0094.511] GetProcessHeap () returned 0xd20000 [0094.511] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0094.511] GetProcessHeap () returned 0xd20000 [0094.511] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.511] GetProcessHeap () returned 0xd20000 [0094.511] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.511] GetProcessHeap () returned 0xd20000 [0094.511] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0094.511] GetProcessHeap () returned 0xd20000 [0094.511] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0094.511] GetProcessHeap () returned 0xd20000 [0094.511] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.511] GetProcessHeap () returned 0xd20000 [0094.511] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.511] GetProcessHeap () returned 0xd20000 [0094.511] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0094.512] GetProcessHeap () returned 0xd20000 [0094.512] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0094.512] GetProcessHeap () returned 0xd20000 [0094.512] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.512] GetProcessHeap () returned 0xd20000 [0094.512] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.512] GetProcessHeap () returned 0xd20000 [0094.512] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.512] GetProcessHeap () returned 0xd20000 [0094.512] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.512] GetProcessHeap () returned 0xd20000 [0094.512] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0094.512] GetProcessHeap () returned 0xd20000 [0094.512] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0094.512] GetProcessHeap () returned 0xd20000 [0094.512] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0094.512] GetProcessHeap () returned 0xd20000 [0094.512] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0094.512] GetProcessHeap () returned 0xd20000 [0094.512] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0094.513] GetProcessHeap () returned 0xd20000 [0094.513] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0094.513] GetProcessHeap () returned 0xd20000 [0094.513] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444c8 | out: hHeap=0xd20000) returned 1 [0094.513] GetProcessHeap () returned 0xd20000 [0094.513] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b248 | out: hHeap=0xd20000) returned 1 [0094.513] GetProcessHeap () returned 0xd20000 [0094.513] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0094.513] GetProcessHeap () returned 0xd20000 [0094.513] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b128 | out: hHeap=0xd20000) returned 1 [0094.513] GetProcessHeap () returned 0xd20000 [0094.513] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0094.513] GetProcessHeap () returned 0xd20000 [0094.513] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.513] GetProcessHeap () returned 0xd20000 [0094.513] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0094.513] WriteFile (in: hFile=0x230, lpBuffer=0xd4db10*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4db10*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0094.526] GetProcessHeap () returned 0xd20000 [0094.526] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4db10, Size=0x30) returned 0xd4db10 [0094.526] GetProcessHeap () returned 0xd20000 [0094.526] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0094.526] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0094.526] GetProcessHeap () returned 0xd20000 [0094.526] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xd3187) returned 0x2d5e020 [0094.553] ReadFile (in: hFile=0x230, lpBuffer=0x2d5e020, nNumberOfBytesToRead=0xd3187, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x2d5e020*, lpNumberOfBytesRead=0x299d7e8*=0xd3187, lpOverlapped=0x0) returned 1 [0094.662] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0094.662] WriteFile (in: hFile=0x230, lpBuffer=0x2d5e020*, nNumberOfBytesToWrite=0xd3187, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0x2d5e020*, lpNumberOfBytesWritten=0x299d7e4*=0xd3187, lpOverlapped=0x0) returned 1 [0094.675] GetProcessHeap () returned 0xd20000 [0094.675] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0x2d5e020 | out: hHeap=0xd20000) returned 1 [0094.675] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0094.675] WriteFile (in: hFile=0x230, lpBuffer=0xd4db10*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4db10*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0094.677] CloseHandle (hObject=0x230) returned 1 [0094.717] GetProcessHeap () returned 0xd20000 [0094.717] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42850 | out: hHeap=0xd20000) returned 1 [0094.717] GetProcessHeap () returned 0xd20000 [0094.717] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c1d8 | out: hHeap=0xd20000) returned 1 [0094.717] GetProcessHeap () returned 0xd20000 [0094.717] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0094.717] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" [0094.717] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm.[ponce.lorena@aol.com]" [0094.717] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_he-il.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0094.719] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_he-il.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0094.720] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0094.720] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0094.720] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0094.720] GetProcessHeap () returned 0xd20000 [0094.720] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44528 | out: hHeap=0xd20000) returned 1 [0094.720] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3e977f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3e977f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xfd68, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_hr-hr.htm", cAlternateFileName="EULA_H~2.HTM")) returned 1 [0094.720] lstrcmpiW (lpString1="EULA_hr-hr.htm", lpString2=".") returned 1 [0094.720] lstrcmpiW (lpString1="EULA_hr-hr.htm", lpString2="..") returned 1 [0094.720] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_hr-hr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" [0094.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_hr-hr.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0094.721] GetProcessHeap () returned 0xd20000 [0094.721] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd445b8 [0094.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_hr-hr.htm", cchWideChar=-1, lpMultiByteStr=0xd445b8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_hr-hr.htm", lpUsedDefaultChar=0x0) returned 15 [0094.721] lstrlenA (lpString="EULA_hr-hr.htm") returned 14 [0094.721] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0094.721] lstrlenA (lpString="EULA_hr-hr.htm") returned 14 [0094.721] lstrlenA (lpString=".dll") returned 4 [0094.721] lstrlenA (lpString=".dll") returned 4 [0094.721] lstrlenA (lpString="EULA_hr-hr.htm") returned 14 [0094.721] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0094.721] lstrlenA (lpString="EULA_hr-hr.htm") returned 14 [0094.721] lstrlenA (lpString=".ini") returned 4 [0094.721] lstrlenA (lpString=".ini") returned 4 [0094.721] lstrlenA (lpString="EULA_hr-hr.htm") returned 14 [0094.721] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0094.721] lstrlenA (lpString="EULA_hr-hr.htm") returned 14 [0094.721] lstrlenA (lpString=".inc") returned 4 [0094.722] lstrlenA (lpString=".inc") returned 4 [0094.722] lstrlenA (lpString="EULA_hr-hr.htm") returned 14 [0094.722] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0094.722] lstrcmpiW (lpString1="EULA_hr-hr.htm", lpString2="HOW_RECOVER.html") returned -1 [0094.722] lstrcmpiW (lpString1="EULA_hr-hr.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0094.722] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0094.722] lstrcmpiW (lpString1="EULA_hr-hr.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0094.722] GetProcessHeap () returned 0xd20000 [0094.722] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd428a0 [0094.722] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0094.732] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=64872) returned 1 [0094.732] GetProcessHeap () returned 0xd20000 [0094.732] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c160 [0094.732] GetProcessHeap () returned 0xd20000 [0094.732] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0094.732] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm") returned 52 [0094.732] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0094.732] GetProcessHeap () returned 0xd20000 [0094.732] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0094.732] GetProcessHeap () returned 0xd20000 [0094.732] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4db48 [0094.732] lstrlenA (lpString="rsa_encrypt") returned 11 [0094.732] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0094.736] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0094.737] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0094.737] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0094.737] GetProcessHeap () returned 0xd20000 [0094.737] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0094.737] lstrlenA (lpString="010001") returned 6 [0094.737] GetProcessHeap () returned 0xd20000 [0094.737] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd28 [0094.737] GetProcessHeap () returned 0xd20000 [0094.737] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0094.737] GetProcessHeap () returned 0xd20000 [0094.737] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ab88 [0094.737] GetProcessHeap () returned 0xd20000 [0094.737] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0094.737] GetProcessHeap () returned 0xd20000 [0094.737] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b008 [0094.737] GetProcessHeap () returned 0xd20000 [0094.738] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44fb0 [0094.738] GetProcessHeap () returned 0xd20000 [0094.738] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0094.738] GetProcessHeap () returned 0xd20000 [0094.738] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0094.738] GetProcessHeap () returned 0xd20000 [0094.738] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.738] GetProcessHeap () returned 0xd20000 [0094.738] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0094.738] GetProcessHeap () returned 0xd20000 [0094.738] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0094.738] GetProcessHeap () returned 0xd20000 [0094.738] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd45640 [0094.738] GetProcessHeap () returned 0xd20000 [0094.738] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.738] GetProcessHeap () returned 0xd20000 [0094.738] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44420 [0094.738] GetProcessHeap () returned 0xd20000 [0094.738] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b1b8 [0094.738] GetProcessHeap () returned 0xd20000 [0094.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0094.739] GetProcessHeap () returned 0xd20000 [0094.739] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0094.739] GetProcessHeap () returned 0xd20000 [0094.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b1b8 | out: hHeap=0xd20000) returned 1 [0094.739] GetProcessHeap () returned 0xd20000 [0094.739] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.739] GetProcessHeap () returned 0xd20000 [0094.739] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44468 [0094.739] GetProcessHeap () returned 0xd20000 [0094.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.739] GetProcessHeap () returned 0xd20000 [0094.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.739] GetProcessHeap () returned 0xd20000 [0094.739] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.739] GetProcessHeap () returned 0xd20000 [0094.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.739] GetProcessHeap () returned 0xd20000 [0094.739] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0094.740] GetProcessHeap () returned 0xd20000 [0094.740] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0094.740] GetProcessHeap () returned 0xd20000 [0094.740] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b518 [0094.740] GetProcessHeap () returned 0xd20000 [0094.740] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44468 | out: hHeap=0xd20000) returned 1 [0094.740] GetProcessHeap () returned 0xd20000 [0094.740] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0094.740] GetProcessHeap () returned 0xd20000 [0094.740] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0094.740] GetProcessHeap () returned 0xd20000 [0094.740] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.740] GetProcessHeap () returned 0xd20000 [0094.740] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.740] GetProcessHeap () returned 0xd20000 [0094.740] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.740] GetProcessHeap () returned 0xd20000 [0094.740] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.740] GetProcessHeap () returned 0xd20000 [0094.741] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0094.741] GetProcessHeap () returned 0xd20000 [0094.741] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0094.741] GetProcessHeap () returned 0xd20000 [0094.741] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0094.741] GetProcessHeap () returned 0xd20000 [0094.741] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0094.741] GetProcessHeap () returned 0xd20000 [0094.741] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.741] GetProcessHeap () returned 0xd20000 [0094.741] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.741] GetProcessHeap () returned 0xd20000 [0094.741] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0094.741] GetProcessHeap () returned 0xd20000 [0094.741] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0094.741] GetProcessHeap () returned 0xd20000 [0094.741] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.741] GetProcessHeap () returned 0xd20000 [0094.741] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.742] GetProcessHeap () returned 0xd20000 [0094.742] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0094.742] GetProcessHeap () returned 0xd20000 [0094.742] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0094.742] GetProcessHeap () returned 0xd20000 [0094.742] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0094.742] GetProcessHeap () returned 0xd20000 [0094.742] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0094.742] GetProcessHeap () returned 0xd20000 [0094.742] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.742] GetProcessHeap () returned 0xd20000 [0094.742] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.742] GetProcessHeap () returned 0xd20000 [0094.742] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0094.742] GetProcessHeap () returned 0xd20000 [0094.742] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0094.742] GetProcessHeap () returned 0xd20000 [0094.742] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0094.742] GetProcessHeap () returned 0xd20000 [0094.742] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0094.743] GetProcessHeap () returned 0xd20000 [0094.743] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0094.743] GetProcessHeap () returned 0xd20000 [0094.743] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0094.743] GetProcessHeap () returned 0xd20000 [0094.743] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.743] GetProcessHeap () returned 0xd20000 [0094.743] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.743] GetProcessHeap () returned 0xd20000 [0094.743] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0094.743] GetProcessHeap () returned 0xd20000 [0094.743] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0094.743] GetProcessHeap () returned 0xd20000 [0094.743] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.743] GetProcessHeap () returned 0xd20000 [0094.743] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.743] GetProcessHeap () returned 0xd20000 [0094.743] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0094.743] GetProcessHeap () returned 0xd20000 [0094.743] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0094.744] GetProcessHeap () returned 0xd20000 [0094.744] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0094.744] GetProcessHeap () returned 0xd20000 [0094.744] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0094.744] GetProcessHeap () returned 0xd20000 [0094.744] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.744] GetProcessHeap () returned 0xd20000 [0094.744] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.744] GetProcessHeap () returned 0xd20000 [0094.744] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0094.744] GetProcessHeap () returned 0xd20000 [0094.744] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0094.744] GetProcessHeap () returned 0xd20000 [0094.744] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0094.744] GetProcessHeap () returned 0xd20000 [0094.744] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0094.744] GetProcessHeap () returned 0xd20000 [0094.744] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0094.745] GetProcessHeap () returned 0xd20000 [0094.745] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0094.745] GetProcessHeap () returned 0xd20000 [0094.745] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.745] GetProcessHeap () returned 0xd20000 [0094.745] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.745] GetProcessHeap () returned 0xd20000 [0094.745] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.745] GetProcessHeap () returned 0xd20000 [0094.745] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.745] GetProcessHeap () returned 0xd20000 [0094.745] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0094.745] GetProcessHeap () returned 0xd20000 [0094.745] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0094.745] GetProcessHeap () returned 0xd20000 [0094.745] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.745] GetProcessHeap () returned 0xd20000 [0094.745] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.745] GetProcessHeap () returned 0xd20000 [0094.745] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.745] GetProcessHeap () returned 0xd20000 [0094.746] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.746] GetProcessHeap () returned 0xd20000 [0094.746] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.746] GetProcessHeap () returned 0xd20000 [0094.746] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.746] GetProcessHeap () returned 0xd20000 [0094.746] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0094.746] GetProcessHeap () returned 0xd20000 [0094.746] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0094.746] GetProcessHeap () returned 0xd20000 [0094.746] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.746] GetProcessHeap () returned 0xd20000 [0094.746] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.746] GetProcessHeap () returned 0xd20000 [0094.746] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.746] GetProcessHeap () returned 0xd20000 [0094.746] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.746] GetProcessHeap () returned 0xd20000 [0094.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0094.747] GetProcessHeap () returned 0xd20000 [0094.747] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0094.747] GetProcessHeap () returned 0xd20000 [0094.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.747] GetProcessHeap () returned 0xd20000 [0094.747] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.747] GetProcessHeap () returned 0xd20000 [0094.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.747] GetProcessHeap () returned 0xd20000 [0094.747] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.747] GetProcessHeap () returned 0xd20000 [0094.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0094.747] GetProcessHeap () returned 0xd20000 [0094.747] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0094.747] GetProcessHeap () returned 0xd20000 [0094.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.747] GetProcessHeap () returned 0xd20000 [0094.747] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.748] GetProcessHeap () returned 0xd20000 [0094.748] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.748] GetProcessHeap () returned 0xd20000 [0094.748] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.748] GetProcessHeap () returned 0xd20000 [0094.748] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.748] GetProcessHeap () returned 0xd20000 [0094.748] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.748] GetProcessHeap () returned 0xd20000 [0094.748] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.748] GetProcessHeap () returned 0xd20000 [0094.748] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.748] GetProcessHeap () returned 0xd20000 [0094.748] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.748] GetProcessHeap () returned 0xd20000 [0094.748] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.748] GetProcessHeap () returned 0xd20000 [0094.748] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.748] GetProcessHeap () returned 0xd20000 [0094.749] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.749] GetProcessHeap () returned 0xd20000 [0094.749] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0094.749] GetProcessHeap () returned 0xd20000 [0094.749] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0094.749] GetProcessHeap () returned 0xd20000 [0094.749] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.749] GetProcessHeap () returned 0xd20000 [0094.749] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.749] GetProcessHeap () returned 0xd20000 [0094.749] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.749] GetProcessHeap () returned 0xd20000 [0094.749] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.749] GetProcessHeap () returned 0xd20000 [0094.749] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.749] GetProcessHeap () returned 0xd20000 [0094.749] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.749] GetProcessHeap () returned 0xd20000 [0094.749] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.749] GetProcessHeap () returned 0xd20000 [0094.749] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.750] GetProcessHeap () returned 0xd20000 [0094.750] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.750] GetProcessHeap () returned 0xd20000 [0094.750] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.750] GetProcessHeap () returned 0xd20000 [0094.750] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.750] GetProcessHeap () returned 0xd20000 [0094.750] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.750] GetProcessHeap () returned 0xd20000 [0094.750] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0094.812] GetProcessHeap () returned 0xd20000 [0094.812] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0094.813] GetProcessHeap () returned 0xd20000 [0094.813] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.813] GetProcessHeap () returned 0xd20000 [0094.813] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.813] GetProcessHeap () returned 0xd20000 [0094.813] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.813] GetProcessHeap () returned 0xd20000 [0094.813] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.813] GetProcessHeap () returned 0xd20000 [0094.813] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.813] GetProcessHeap () returned 0xd20000 [0094.813] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.813] GetProcessHeap () returned 0xd20000 [0094.814] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0094.814] GetProcessHeap () returned 0xd20000 [0094.814] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0094.814] GetProcessHeap () returned 0xd20000 [0094.814] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.814] GetProcessHeap () returned 0xd20000 [0094.814] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.814] GetProcessHeap () returned 0xd20000 [0094.814] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.814] GetProcessHeap () returned 0xd20000 [0094.814] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.814] GetProcessHeap () returned 0xd20000 [0094.814] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.814] GetProcessHeap () returned 0xd20000 [0094.814] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.814] GetProcessHeap () returned 0xd20000 [0094.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0094.815] GetProcessHeap () returned 0xd20000 [0094.815] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0094.815] GetProcessHeap () returned 0xd20000 [0094.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.815] GetProcessHeap () returned 0xd20000 [0094.815] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.815] GetProcessHeap () returned 0xd20000 [0094.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.815] GetProcessHeap () returned 0xd20000 [0094.815] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.815] GetProcessHeap () returned 0xd20000 [0094.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.815] GetProcessHeap () returned 0xd20000 [0094.815] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.815] GetProcessHeap () returned 0xd20000 [0094.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0094.816] GetProcessHeap () returned 0xd20000 [0094.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0094.816] GetProcessHeap () returned 0xd20000 [0094.816] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.816] GetProcessHeap () returned 0xd20000 [0094.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.816] GetProcessHeap () returned 0xd20000 [0094.816] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0094.816] GetProcessHeap () returned 0xd20000 [0094.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0094.816] GetProcessHeap () returned 0xd20000 [0094.816] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0094.816] GetProcessHeap () returned 0xd20000 [0094.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0094.816] GetProcessHeap () returned 0xd20000 [0094.816] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.816] GetProcessHeap () returned 0xd20000 [0094.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.817] GetProcessHeap () returned 0xd20000 [0094.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0094.817] GetProcessHeap () returned 0xd20000 [0094.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0094.817] GetProcessHeap () returned 0xd20000 [0094.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.817] GetProcessHeap () returned 0xd20000 [0094.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.817] GetProcessHeap () returned 0xd20000 [0094.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0094.817] GetProcessHeap () returned 0xd20000 [0094.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0094.817] GetProcessHeap () returned 0xd20000 [0094.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.817] GetProcessHeap () returned 0xd20000 [0094.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.818] GetProcessHeap () returned 0xd20000 [0094.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.818] GetProcessHeap () returned 0xd20000 [0094.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.818] GetProcessHeap () returned 0xd20000 [0094.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.818] GetProcessHeap () returned 0xd20000 [0094.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.818] GetProcessHeap () returned 0xd20000 [0094.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0094.818] GetProcessHeap () returned 0xd20000 [0094.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0094.819] GetProcessHeap () returned 0xd20000 [0094.819] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0094.819] GetProcessHeap () returned 0xd20000 [0094.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0094.819] GetProcessHeap () returned 0xd20000 [0094.819] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.819] GetProcessHeap () returned 0xd20000 [0094.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.819] GetProcessHeap () returned 0xd20000 [0094.819] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.819] GetProcessHeap () returned 0xd20000 [0094.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.819] GetProcessHeap () returned 0xd20000 [0094.819] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0094.820] GetProcessHeap () returned 0xd20000 [0094.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0094.820] GetProcessHeap () returned 0xd20000 [0094.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.820] GetProcessHeap () returned 0xd20000 [0094.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.820] GetProcessHeap () returned 0xd20000 [0094.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0094.820] GetProcessHeap () returned 0xd20000 [0094.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0094.820] GetProcessHeap () returned 0xd20000 [0094.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.820] GetProcessHeap () returned 0xd20000 [0094.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.820] GetProcessHeap () returned 0xd20000 [0094.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.820] GetProcessHeap () returned 0xd20000 [0094.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.821] GetProcessHeap () returned 0xd20000 [0094.821] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.821] GetProcessHeap () returned 0xd20000 [0094.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.821] GetProcessHeap () returned 0xd20000 [0094.821] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.821] GetProcessHeap () returned 0xd20000 [0094.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.821] GetProcessHeap () returned 0xd20000 [0094.821] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.821] GetProcessHeap () returned 0xd20000 [0094.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.821] GetProcessHeap () returned 0xd20000 [0094.821] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0094.821] GetProcessHeap () returned 0xd20000 [0094.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0094.821] GetProcessHeap () returned 0xd20000 [0094.821] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.822] GetProcessHeap () returned 0xd20000 [0094.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.822] GetProcessHeap () returned 0xd20000 [0094.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0094.822] GetProcessHeap () returned 0xd20000 [0094.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0094.822] GetProcessHeap () returned 0xd20000 [0094.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0094.822] GetProcessHeap () returned 0xd20000 [0094.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0094.822] GetProcessHeap () returned 0xd20000 [0094.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44420 | out: hHeap=0xd20000) returned 1 [0094.822] GetProcessHeap () returned 0xd20000 [0094.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b008 | out: hHeap=0xd20000) returned 1 [0094.822] GetProcessHeap () returned 0xd20000 [0094.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0094.823] GetProcessHeap () returned 0xd20000 [0094.823] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ab88 | out: hHeap=0xd20000) returned 1 [0094.823] GetProcessHeap () returned 0xd20000 [0094.823] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0094.823] GetProcessHeap () returned 0xd20000 [0094.823] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0094.823] GetProcessHeap () returned 0xd20000 [0094.823] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0094.823] WriteFile (in: hFile=0x230, lpBuffer=0xd4db48*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4db48*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0094.832] GetProcessHeap () returned 0xd20000 [0094.832] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4db48, Size=0x30) returned 0xd4db48 [0094.832] GetProcessHeap () returned 0xd20000 [0094.832] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0094.832] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0094.832] GetProcessHeap () returned 0xd20000 [0094.832] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xfd68) returned 0xd4db80 [0094.834] ReadFile (in: hFile=0x230, lpBuffer=0xd4db80, nNumberOfBytesToRead=0xfd68, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4db80*, lpNumberOfBytesRead=0x299d7e8*=0xfd68, lpOverlapped=0x0) returned 1 [0094.837] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0094.837] WriteFile (in: hFile=0x230, lpBuffer=0xd4db80*, nNumberOfBytesToWrite=0xfd68, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4db80*, lpNumberOfBytesWritten=0x299d7e4*=0xfd68, lpOverlapped=0x0) returned 1 [0094.840] GetProcessHeap () returned 0xd20000 [0094.840] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4db80 | out: hHeap=0xd20000) returned 1 [0094.840] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0094.841] WriteFile (in: hFile=0x230, lpBuffer=0xd4db48*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4db48*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0094.842] CloseHandle (hObject=0x230) returned 1 [0094.847] GetProcessHeap () returned 0xd20000 [0094.847] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd428a0 | out: hHeap=0xd20000) returned 1 [0094.847] GetProcessHeap () returned 0xd20000 [0094.847] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c160 | out: hHeap=0xd20000) returned 1 [0094.847] GetProcessHeap () returned 0xd20000 [0094.847] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0094.847] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" [0094.847] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm.[ponce.lorena@aol.com]" [0094.847] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hr-hr.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0094.849] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hr-hr.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0094.849] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0094.849] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0094.849] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0094.849] GetProcessHeap () returned 0xd20000 [0094.849] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445b8 | out: hHeap=0xd20000) returned 1 [0094.849] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ebeab, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ebeab, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x14a5a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_hu-hu.htm", cAlternateFileName="EULA_H~3.HTM")) returned 1 [0094.849] lstrcmpiW (lpString1="EULA_hu-hu.htm", lpString2=".") returned 1 [0094.849] lstrcmpiW (lpString1="EULA_hu-hu.htm", lpString2="..") returned 1 [0094.849] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_hu-hu.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" [0094.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_hu-hu.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0094.850] GetProcessHeap () returned 0xd20000 [0094.850] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd446d8 [0094.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_hu-hu.htm", cchWideChar=-1, lpMultiByteStr=0xd446d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_hu-hu.htm", lpUsedDefaultChar=0x0) returned 15 [0094.850] lstrlenA (lpString="EULA_hu-hu.htm") returned 14 [0094.850] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0094.850] lstrlenA (lpString="EULA_hu-hu.htm") returned 14 [0094.850] lstrlenA (lpString=".dll") returned 4 [0094.850] lstrlenA (lpString=".dll") returned 4 [0094.850] lstrlenA (lpString="EULA_hu-hu.htm") returned 14 [0094.850] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0094.850] lstrlenA (lpString="EULA_hu-hu.htm") returned 14 [0094.850] lstrlenA (lpString=".ini") returned 4 [0094.850] lstrlenA (lpString=".ini") returned 4 [0094.850] lstrlenA (lpString="EULA_hu-hu.htm") returned 14 [0094.850] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0094.850] lstrlenA (lpString="EULA_hu-hu.htm") returned 14 [0094.850] lstrlenA (lpString=".inc") returned 4 [0094.851] lstrlenA (lpString=".inc") returned 4 [0094.851] lstrlenA (lpString="EULA_hu-hu.htm") returned 14 [0094.851] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0094.851] lstrcmpiW (lpString1="EULA_hu-hu.htm", lpString2="HOW_RECOVER.html") returned -1 [0094.851] lstrcmpiW (lpString1="EULA_hu-hu.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0094.851] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0094.851] lstrcmpiW (lpString1="EULA_hu-hu.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0094.851] GetProcessHeap () returned 0xd20000 [0094.851] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd426c0 [0094.851] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0094.852] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=84570) returned 1 [0094.852] GetProcessHeap () returned 0xd20000 [0094.852] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bbc0 [0094.852] GetProcessHeap () returned 0xd20000 [0094.852] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0094.852] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm") returned 52 [0094.852] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0094.852] GetProcessHeap () returned 0xd20000 [0094.852] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0094.852] GetProcessHeap () returned 0xd20000 [0094.853] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x386) returned 0xd4db80 [0094.853] lstrlenA (lpString="rsa_encrypt") returned 11 [0094.853] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0094.855] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0094.855] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0094.855] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0094.855] GetProcessHeap () returned 0xd20000 [0094.855] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0094.855] lstrlenA (lpString="010001") returned 6 [0094.856] GetProcessHeap () returned 0xd20000 [0094.856] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cbe8 [0094.856] GetProcessHeap () returned 0xd20000 [0094.856] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0094.856] GetProcessHeap () returned 0xd20000 [0094.856] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ae58 [0094.856] GetProcessHeap () returned 0xd20000 [0094.856] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0094.856] GetProcessHeap () returned 0xd20000 [0094.856] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b1b8 [0094.856] GetProcessHeap () returned 0xd20000 [0094.856] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44c68 [0094.856] GetProcessHeap () returned 0xd20000 [0094.856] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0094.856] GetProcessHeap () returned 0xd20000 [0094.856] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0094.856] GetProcessHeap () returned 0xd20000 [0094.857] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.857] GetProcessHeap () returned 0xd20000 [0094.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0094.857] GetProcessHeap () returned 0xd20000 [0094.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0094.857] GetProcessHeap () returned 0xd20000 [0094.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44808 [0094.857] GetProcessHeap () returned 0xd20000 [0094.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.857] GetProcessHeap () returned 0xd20000 [0094.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44468 [0094.857] GetProcessHeap () returned 0xd20000 [0094.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b248 [0094.857] GetProcessHeap () returned 0xd20000 [0094.857] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0094.857] GetProcessHeap () returned 0xd20000 [0094.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0094.858] GetProcessHeap () returned 0xd20000 [0094.858] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b248 | out: hHeap=0xd20000) returned 1 [0094.858] GetProcessHeap () returned 0xd20000 [0094.858] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.858] GetProcessHeap () returned 0xd20000 [0094.858] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446f0 [0094.858] GetProcessHeap () returned 0xd20000 [0094.858] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.858] GetProcessHeap () returned 0xd20000 [0094.858] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.858] GetProcessHeap () returned 0xd20000 [0094.858] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.858] GetProcessHeap () returned 0xd20000 [0094.858] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.858] GetProcessHeap () returned 0xd20000 [0094.858] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0094.858] GetProcessHeap () returned 0xd20000 [0094.858] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0094.859] GetProcessHeap () returned 0xd20000 [0094.859] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4ad38 [0094.859] GetProcessHeap () returned 0xd20000 [0094.859] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446f0 | out: hHeap=0xd20000) returned 1 [0094.859] GetProcessHeap () returned 0xd20000 [0094.859] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0094.859] GetProcessHeap () returned 0xd20000 [0094.859] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ad38 | out: hHeap=0xd20000) returned 1 [0094.859] GetProcessHeap () returned 0xd20000 [0094.859] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.859] GetProcessHeap () returned 0xd20000 [0094.859] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.859] GetProcessHeap () returned 0xd20000 [0094.859] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.859] GetProcessHeap () returned 0xd20000 [0094.860] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.860] GetProcessHeap () returned 0xd20000 [0094.860] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.860] GetProcessHeap () returned 0xd20000 [0094.860] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.860] GetProcessHeap () returned 0xd20000 [0094.860] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.860] GetProcessHeap () returned 0xd20000 [0094.860] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.860] GetProcessHeap () returned 0xd20000 [0094.861] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.861] GetProcessHeap () returned 0xd20000 [0094.861] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.861] GetProcessHeap () returned 0xd20000 [0094.861] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0094.861] GetProcessHeap () returned 0xd20000 [0094.861] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0094.861] GetProcessHeap () returned 0xd20000 [0094.861] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.861] GetProcessHeap () returned 0xd20000 [0094.861] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.861] GetProcessHeap () returned 0xd20000 [0094.861] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0094.861] GetProcessHeap () returned 0xd20000 [0094.861] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0094.861] GetProcessHeap () returned 0xd20000 [0094.861] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.861] GetProcessHeap () returned 0xd20000 [0094.862] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.862] GetProcessHeap () returned 0xd20000 [0094.862] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0094.862] GetProcessHeap () returned 0xd20000 [0094.862] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0094.862] GetProcessHeap () returned 0xd20000 [0094.862] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.862] GetProcessHeap () returned 0xd20000 [0094.862] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.862] GetProcessHeap () returned 0xd20000 [0094.862] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0094.862] GetProcessHeap () returned 0xd20000 [0094.862] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0094.862] GetProcessHeap () returned 0xd20000 [0094.862] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0094.862] GetProcessHeap () returned 0xd20000 [0094.862] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0094.863] GetProcessHeap () returned 0xd20000 [0094.863] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0094.863] GetProcessHeap () returned 0xd20000 [0094.863] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0094.863] GetProcessHeap () returned 0xd20000 [0094.863] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0094.863] GetProcessHeap () returned 0xd20000 [0094.863] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0094.863] GetProcessHeap () returned 0xd20000 [0094.863] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.863] GetProcessHeap () returned 0xd20000 [0094.863] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.863] GetProcessHeap () returned 0xd20000 [0094.863] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.863] GetProcessHeap () returned 0xd20000 [0094.863] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.863] GetProcessHeap () returned 0xd20000 [0094.864] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0094.864] GetProcessHeap () returned 0xd20000 [0094.864] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0094.864] GetProcessHeap () returned 0xd20000 [0094.864] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.864] GetProcessHeap () returned 0xd20000 [0094.864] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.864] GetProcessHeap () returned 0xd20000 [0094.864] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.864] GetProcessHeap () returned 0xd20000 [0094.864] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.864] GetProcessHeap () returned 0xd20000 [0094.864] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0094.864] GetProcessHeap () returned 0xd20000 [0094.864] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0094.864] GetProcessHeap () returned 0xd20000 [0094.864] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0094.864] GetProcessHeap () returned 0xd20000 [0094.864] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0094.865] GetProcessHeap () returned 0xd20000 [0094.865] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0094.865] GetProcessHeap () returned 0xd20000 [0094.865] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0094.865] GetProcessHeap () returned 0xd20000 [0094.865] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.865] GetProcessHeap () returned 0xd20000 [0094.865] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.865] GetProcessHeap () returned 0xd20000 [0094.865] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.865] GetProcessHeap () returned 0xd20000 [0094.865] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.865] GetProcessHeap () returned 0xd20000 [0094.865] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.865] GetProcessHeap () returned 0xd20000 [0094.865] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.865] GetProcessHeap () returned 0xd20000 [0094.865] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0094.866] GetProcessHeap () returned 0xd20000 [0094.866] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0094.866] GetProcessHeap () returned 0xd20000 [0094.866] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.866] GetProcessHeap () returned 0xd20000 [0094.866] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.866] GetProcessHeap () returned 0xd20000 [0094.866] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.866] GetProcessHeap () returned 0xd20000 [0094.866] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.866] GetProcessHeap () returned 0xd20000 [0094.866] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.866] GetProcessHeap () returned 0xd20000 [0094.866] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.866] GetProcessHeap () returned 0xd20000 [0094.866] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0094.866] GetProcessHeap () returned 0xd20000 [0094.867] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0094.867] GetProcessHeap () returned 0xd20000 [0094.867] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0094.867] GetProcessHeap () returned 0xd20000 [0094.867] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0094.867] GetProcessHeap () returned 0xd20000 [0094.867] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.867] GetProcessHeap () returned 0xd20000 [0094.867] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.867] GetProcessHeap () returned 0xd20000 [0094.867] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0094.867] GetProcessHeap () returned 0xd20000 [0094.867] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0094.867] GetProcessHeap () returned 0xd20000 [0094.867] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.867] GetProcessHeap () returned 0xd20000 [0094.867] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.867] GetProcessHeap () returned 0xd20000 [0094.868] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0094.868] GetProcessHeap () returned 0xd20000 [0094.868] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0094.868] GetProcessHeap () returned 0xd20000 [0094.868] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.868] GetProcessHeap () returned 0xd20000 [0094.868] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.868] GetProcessHeap () returned 0xd20000 [0094.868] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0094.868] GetProcessHeap () returned 0xd20000 [0094.868] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0094.868] GetProcessHeap () returned 0xd20000 [0094.868] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.868] GetProcessHeap () returned 0xd20000 [0094.868] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.868] GetProcessHeap () returned 0xd20000 [0094.868] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.868] GetProcessHeap () returned 0xd20000 [0094.868] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.869] GetProcessHeap () returned 0xd20000 [0094.869] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0094.869] GetProcessHeap () returned 0xd20000 [0094.869] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0094.869] GetProcessHeap () returned 0xd20000 [0094.869] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.869] GetProcessHeap () returned 0xd20000 [0094.869] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.869] GetProcessHeap () returned 0xd20000 [0094.869] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.869] GetProcessHeap () returned 0xd20000 [0094.869] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.869] GetProcessHeap () returned 0xd20000 [0094.869] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.869] GetProcessHeap () returned 0xd20000 [0094.869] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.869] GetProcessHeap () returned 0xd20000 [0094.869] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.869] GetProcessHeap () returned 0xd20000 [0094.870] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.870] GetProcessHeap () returned 0xd20000 [0094.870] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.870] GetProcessHeap () returned 0xd20000 [0094.870] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.870] GetProcessHeap () returned 0xd20000 [0094.870] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.870] GetProcessHeap () returned 0xd20000 [0094.870] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.870] GetProcessHeap () returned 0xd20000 [0094.870] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.870] GetProcessHeap () returned 0xd20000 [0094.870] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.870] GetProcessHeap () returned 0xd20000 [0094.870] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.870] GetProcessHeap () returned 0xd20000 [0094.870] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.870] GetProcessHeap () returned 0xd20000 [0094.871] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.871] GetProcessHeap () returned 0xd20000 [0094.871] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.871] GetProcessHeap () returned 0xd20000 [0094.871] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.871] GetProcessHeap () returned 0xd20000 [0094.871] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.871] GetProcessHeap () returned 0xd20000 [0094.871] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0094.871] GetProcessHeap () returned 0xd20000 [0094.871] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0094.871] GetProcessHeap () returned 0xd20000 [0094.871] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.871] GetProcessHeap () returned 0xd20000 [0094.871] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.871] GetProcessHeap () returned 0xd20000 [0094.871] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.872] GetProcessHeap () returned 0xd20000 [0094.872] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.872] GetProcessHeap () returned 0xd20000 [0094.872] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.872] GetProcessHeap () returned 0xd20000 [0094.872] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.872] GetProcessHeap () returned 0xd20000 [0094.872] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.872] GetProcessHeap () returned 0xd20000 [0094.872] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.872] GetProcessHeap () returned 0xd20000 [0094.872] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.872] GetProcessHeap () returned 0xd20000 [0094.872] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.872] GetProcessHeap () returned 0xd20000 [0094.872] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.872] GetProcessHeap () returned 0xd20000 [0094.872] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.873] GetProcessHeap () returned 0xd20000 [0094.873] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.873] GetProcessHeap () returned 0xd20000 [0094.873] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.873] GetProcessHeap () returned 0xd20000 [0094.873] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0094.873] GetProcessHeap () returned 0xd20000 [0094.873] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0094.873] GetProcessHeap () returned 0xd20000 [0094.873] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0094.873] GetProcessHeap () returned 0xd20000 [0094.873] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0094.873] GetProcessHeap () returned 0xd20000 [0094.873] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.873] GetProcessHeap () returned 0xd20000 [0094.873] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.873] GetProcessHeap () returned 0xd20000 [0094.873] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.874] GetProcessHeap () returned 0xd20000 [0094.874] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.874] GetProcessHeap () returned 0xd20000 [0094.874] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0094.874] GetProcessHeap () returned 0xd20000 [0094.874] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0094.874] GetProcessHeap () returned 0xd20000 [0094.874] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.874] GetProcessHeap () returned 0xd20000 [0094.874] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.874] GetProcessHeap () returned 0xd20000 [0094.874] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0094.874] GetProcessHeap () returned 0xd20000 [0094.874] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0094.874] GetProcessHeap () returned 0xd20000 [0094.874] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.874] GetProcessHeap () returned 0xd20000 [0094.874] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.874] GetProcessHeap () returned 0xd20000 [0094.875] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0094.875] GetProcessHeap () returned 0xd20000 [0094.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0094.875] GetProcessHeap () returned 0xd20000 [0094.875] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.875] GetProcessHeap () returned 0xd20000 [0094.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.875] GetProcessHeap () returned 0xd20000 [0094.875] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.875] GetProcessHeap () returned 0xd20000 [0094.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.875] GetProcessHeap () returned 0xd20000 [0094.875] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0094.875] GetProcessHeap () returned 0xd20000 [0094.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0094.875] GetProcessHeap () returned 0xd20000 [0094.876] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.876] GetProcessHeap () returned 0xd20000 [0094.876] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.876] GetProcessHeap () returned 0xd20000 [0094.876] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.876] GetProcessHeap () returned 0xd20000 [0094.876] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.876] GetProcessHeap () returned 0xd20000 [0094.876] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.876] GetProcessHeap () returned 0xd20000 [0094.876] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.876] GetProcessHeap () returned 0xd20000 [0094.876] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0094.876] GetProcessHeap () returned 0xd20000 [0094.876] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0094.877] GetProcessHeap () returned 0xd20000 [0094.877] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.877] GetProcessHeap () returned 0xd20000 [0094.877] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.877] GetProcessHeap () returned 0xd20000 [0094.877] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.877] GetProcessHeap () returned 0xd20000 [0094.877] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.877] GetProcessHeap () returned 0xd20000 [0094.877] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.877] GetProcessHeap () returned 0xd20000 [0094.877] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.877] GetProcessHeap () returned 0xd20000 [0094.877] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0094.877] GetProcessHeap () returned 0xd20000 [0094.878] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0094.878] GetProcessHeap () returned 0xd20000 [0094.878] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0094.878] GetProcessHeap () returned 0xd20000 [0094.878] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0094.878] GetProcessHeap () returned 0xd20000 [0094.878] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0094.878] GetProcessHeap () returned 0xd20000 [0094.878] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0094.878] GetProcessHeap () returned 0xd20000 [0094.878] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.878] GetProcessHeap () returned 0xd20000 [0094.878] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.878] GetProcessHeap () returned 0xd20000 [0094.878] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0094.878] GetProcessHeap () returned 0xd20000 [0094.879] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0094.879] GetProcessHeap () returned 0xd20000 [0094.879] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0094.879] GetProcessHeap () returned 0xd20000 [0094.879] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0094.879] GetProcessHeap () returned 0xd20000 [0094.879] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.879] GetProcessHeap () returned 0xd20000 [0094.879] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.879] GetProcessHeap () returned 0xd20000 [0094.879] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0094.879] GetProcessHeap () returned 0xd20000 [0094.879] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0094.879] GetProcessHeap () returned 0xd20000 [0094.879] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0094.879] GetProcessHeap () returned 0xd20000 [0094.879] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0094.879] GetProcessHeap () returned 0xd20000 [0094.880] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44468 | out: hHeap=0xd20000) returned 1 [0094.880] GetProcessHeap () returned 0xd20000 [0094.880] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b1b8 | out: hHeap=0xd20000) returned 1 [0094.880] GetProcessHeap () returned 0xd20000 [0094.880] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0094.880] GetProcessHeap () returned 0xd20000 [0094.880] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ae58 | out: hHeap=0xd20000) returned 1 [0094.880] GetProcessHeap () returned 0xd20000 [0094.880] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0094.880] GetProcessHeap () returned 0xd20000 [0094.880] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0094.880] GetProcessHeap () returned 0xd20000 [0094.880] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0094.880] WriteFile (in: hFile=0x230, lpBuffer=0xd4db80*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4db80*, lpNumberOfBytesWritten=0x299d864*=0x386, lpOverlapped=0x0) returned 1 [0094.887] GetProcessHeap () returned 0xd20000 [0094.887] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4db80, Size=0x30) returned 0xd4db80 [0094.887] GetProcessHeap () returned 0xd20000 [0094.887] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0094.887] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0094.887] GetProcessHeap () returned 0xd20000 [0094.887] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x14a60) returned 0xd4dbb8 [0094.888] ReadFile (in: hFile=0x230, lpBuffer=0xd4dbb8, nNumberOfBytesToRead=0x14a60, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4dbb8*, lpNumberOfBytesRead=0x299d7e8*=0x14a60, lpOverlapped=0x0) returned 1 [0094.891] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0094.891] WriteFile (in: hFile=0x230, lpBuffer=0xd4dbb8*, nNumberOfBytesToWrite=0x14a60, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4dbb8*, lpNumberOfBytesWritten=0x299d7e4*=0x14a60, lpOverlapped=0x0) returned 1 [0094.894] GetProcessHeap () returned 0xd20000 [0094.894] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4dbb8 | out: hHeap=0xd20000) returned 1 [0094.894] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0094.894] WriteFile (in: hFile=0x230, lpBuffer=0xd4db80*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4db80*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0094.896] CloseHandle (hObject=0x230) returned 1 [0094.901] GetProcessHeap () returned 0xd20000 [0094.901] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd426c0 | out: hHeap=0xd20000) returned 1 [0094.901] GetProcessHeap () returned 0xd20000 [0094.901] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bbc0 | out: hHeap=0xd20000) returned 1 [0094.901] GetProcessHeap () returned 0xd20000 [0094.901] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0094.901] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" [0094.901] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm.[ponce.lorena@aol.com]" [0094.901] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_hu-hu.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0094.908] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_hu-hu.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0094.909] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0094.909] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0094.909] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0094.909] GetProcessHeap () returned 0xd20000 [0094.909] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446d8 | out: hHeap=0xd20000) returned 1 [0094.909] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ed234, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ed234, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10f6d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_it-it.htm", cAlternateFileName="EULA_I~1.HTM")) returned 1 [0094.909] lstrcmpiW (lpString1="EULA_it-it.htm", lpString2=".") returned 1 [0094.909] lstrcmpiW (lpString1="EULA_it-it.htm", lpString2="..") returned 1 [0094.909] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_it-it.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" [0094.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_it-it.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0094.909] GetProcessHeap () returned 0xd20000 [0094.909] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd44678 [0094.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_it-it.htm", cchWideChar=-1, lpMultiByteStr=0xd44678, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_it-it.htm", lpUsedDefaultChar=0x0) returned 15 [0094.909] lstrlenA (lpString="EULA_it-it.htm") returned 14 [0094.909] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0094.910] lstrlenA (lpString="EULA_it-it.htm") returned 14 [0094.910] lstrlenA (lpString=".dll") returned 4 [0094.910] lstrlenA (lpString=".dll") returned 4 [0094.910] lstrlenA (lpString="EULA_it-it.htm") returned 14 [0094.910] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0094.910] lstrlenA (lpString="EULA_it-it.htm") returned 14 [0094.910] lstrlenA (lpString=".ini") returned 4 [0094.910] lstrlenA (lpString=".ini") returned 4 [0094.910] lstrlenA (lpString="EULA_it-it.htm") returned 14 [0094.910] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0094.910] lstrlenA (lpString="EULA_it-it.htm") returned 14 [0094.910] lstrlenA (lpString=".inc") returned 4 [0094.910] lstrlenA (lpString=".inc") returned 4 [0094.910] lstrlenA (lpString="EULA_it-it.htm") returned 14 [0094.910] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0094.910] lstrcmpiW (lpString1="EULA_it-it.htm", lpString2="HOW_RECOVER.html") returned -1 [0094.910] lstrcmpiW (lpString1="EULA_it-it.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0094.910] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0094.911] lstrcmpiW (lpString1="EULA_it-it.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0094.911] GetProcessHeap () returned 0xd20000 [0094.911] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd428a0 [0094.911] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0094.911] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=69485) returned 1 [0094.911] GetProcessHeap () returned 0xd20000 [0094.911] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bcb0 [0094.912] GetProcessHeap () returned 0xd20000 [0094.912] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0094.912] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm") returned 52 [0094.912] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0094.912] GetProcessHeap () returned 0xd20000 [0094.912] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0094.912] GetProcessHeap () returned 0xd20000 [0094.912] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x383) returned 0xd4dbb8 [0094.912] lstrlenA (lpString="rsa_encrypt") returned 11 [0094.912] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0094.914] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0094.915] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0094.915] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0094.915] GetProcessHeap () returned 0xd20000 [0094.915] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0094.915] lstrlenA (lpString="010001") returned 6 [0094.915] GetProcessHeap () returned 0xd20000 [0094.915] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cdb8 [0094.915] GetProcessHeap () returned 0xd20000 [0094.915] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0094.915] GetProcessHeap () returned 0xd20000 [0094.915] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aca8 [0094.915] GetProcessHeap () returned 0xd20000 [0094.915] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0094.915] GetProcessHeap () returned 0xd20000 [0094.915] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0094.915] GetProcessHeap () returned 0xd20000 [0094.915] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44e98 [0094.916] GetProcessHeap () returned 0xd20000 [0094.916] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd98 [0094.916] GetProcessHeap () returned 0xd20000 [0094.916] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0094.916] GetProcessHeap () returned 0xd20000 [0094.916] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.916] GetProcessHeap () returned 0xd20000 [0094.916] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0094.916] GetProcessHeap () returned 0xd20000 [0094.916] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0094.916] GetProcessHeap () returned 0xd20000 [0094.916] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44808 [0094.916] GetProcessHeap () returned 0xd20000 [0094.916] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0094.916] GetProcessHeap () returned 0xd20000 [0094.916] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44408 [0094.916] GetProcessHeap () returned 0xd20000 [0094.916] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b098 [0094.916] GetProcessHeap () returned 0xd20000 [0094.917] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0094.917] GetProcessHeap () returned 0xd20000 [0094.917] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0094.917] GetProcessHeap () returned 0xd20000 [0094.917] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b098 | out: hHeap=0xd20000) returned 1 [0094.917] GetProcessHeap () returned 0xd20000 [0094.917] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0094.917] GetProcessHeap () returned 0xd20000 [0094.917] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445d0 [0094.917] GetProcessHeap () returned 0xd20000 [0094.917] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0094.917] GetProcessHeap () returned 0xd20000 [0094.917] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0094.917] GetProcessHeap () returned 0xd20000 [0094.917] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0094.917] GetProcessHeap () returned 0xd20000 [0094.917] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0094.917] GetProcessHeap () returned 0xd20000 [0094.917] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0094.918] GetProcessHeap () returned 0xd20000 [0094.918] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0094.918] GetProcessHeap () returned 0xd20000 [0094.918] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4ac18 [0094.918] GetProcessHeap () returned 0xd20000 [0094.918] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445d0 | out: hHeap=0xd20000) returned 1 [0094.918] GetProcessHeap () returned 0xd20000 [0094.918] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0094.918] GetProcessHeap () returned 0xd20000 [0094.918] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ac18 | out: hHeap=0xd20000) returned 1 [0094.918] GetProcessHeap () returned 0xd20000 [0094.918] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0094.918] GetProcessHeap () returned 0xd20000 [0094.918] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0094.918] GetProcessHeap () returned 0xd20000 [0094.918] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0094.918] GetProcessHeap () returned 0xd20000 [0094.918] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0094.918] GetProcessHeap () returned 0xd20000 [0094.919] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0094.919] GetProcessHeap () returned 0xd20000 [0094.919] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0094.919] GetProcessHeap () returned 0xd20000 [0094.919] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0094.919] GetProcessHeap () returned 0xd20000 [0094.919] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0094.919] GetProcessHeap () returned 0xd20000 [0094.919] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.919] GetProcessHeap () returned 0xd20000 [0094.919] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.919] GetProcessHeap () returned 0xd20000 [0094.919] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0094.919] GetProcessHeap () returned 0xd20000 [0094.919] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0094.919] GetProcessHeap () returned 0xd20000 [0094.919] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0094.919] GetProcessHeap () returned 0xd20000 [0094.919] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0094.919] GetProcessHeap () returned 0xd20000 [0094.920] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0094.920] GetProcessHeap () returned 0xd20000 [0094.920] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0094.920] GetProcessHeap () returned 0xd20000 [0094.920] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.920] GetProcessHeap () returned 0xd20000 [0094.920] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.920] GetProcessHeap () returned 0xd20000 [0094.920] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.920] GetProcessHeap () returned 0xd20000 [0094.920] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.920] GetProcessHeap () returned 0xd20000 [0094.920] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0094.920] GetProcessHeap () returned 0xd20000 [0094.920] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0094.920] GetProcessHeap () returned 0xd20000 [0094.920] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.920] GetProcessHeap () returned 0xd20000 [0094.921] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.921] GetProcessHeap () returned 0xd20000 [0094.921] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.921] GetProcessHeap () returned 0xd20000 [0094.921] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.921] GetProcessHeap () returned 0xd20000 [0094.921] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.921] GetProcessHeap () returned 0xd20000 [0094.921] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.921] GetProcessHeap () returned 0xd20000 [0094.921] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0094.921] GetProcessHeap () returned 0xd20000 [0094.921] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0094.921] GetProcessHeap () returned 0xd20000 [0094.921] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.921] GetProcessHeap () returned 0xd20000 [0094.921] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.921] GetProcessHeap () returned 0xd20000 [0094.921] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.922] GetProcessHeap () returned 0xd20000 [0094.922] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.922] GetProcessHeap () returned 0xd20000 [0094.922] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0094.922] GetProcessHeap () returned 0xd20000 [0094.922] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0094.922] GetProcessHeap () returned 0xd20000 [0094.927] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.927] GetProcessHeap () returned 0xd20000 [0094.927] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.927] GetProcessHeap () returned 0xd20000 [0094.927] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.927] GetProcessHeap () returned 0xd20000 [0094.927] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.927] GetProcessHeap () returned 0xd20000 [0094.927] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0094.927] GetProcessHeap () returned 0xd20000 [0094.927] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0094.927] GetProcessHeap () returned 0xd20000 [0094.927] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.927] GetProcessHeap () returned 0xd20000 [0094.927] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.927] GetProcessHeap () returned 0xd20000 [0094.927] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.927] GetProcessHeap () returned 0xd20000 [0094.928] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.928] GetProcessHeap () returned 0xd20000 [0094.928] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.928] GetProcessHeap () returned 0xd20000 [0094.928] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.928] GetProcessHeap () returned 0xd20000 [0094.928] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.928] GetProcessHeap () returned 0xd20000 [0094.928] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.928] GetProcessHeap () returned 0xd20000 [0094.928] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.928] GetProcessHeap () returned 0xd20000 [0094.928] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.928] GetProcessHeap () returned 0xd20000 [0094.928] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.928] GetProcessHeap () returned 0xd20000 [0094.928] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.928] GetProcessHeap () returned 0xd20000 [0094.928] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0094.929] GetProcessHeap () returned 0xd20000 [0094.929] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0094.929] GetProcessHeap () returned 0xd20000 [0094.929] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.929] GetProcessHeap () returned 0xd20000 [0094.929] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.929] GetProcessHeap () returned 0xd20000 [0094.929] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.929] GetProcessHeap () returned 0xd20000 [0094.929] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.929] GetProcessHeap () returned 0xd20000 [0094.929] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.929] GetProcessHeap () returned 0xd20000 [0094.929] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.929] GetProcessHeap () returned 0xd20000 [0094.929] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.929] GetProcessHeap () returned 0xd20000 [0094.930] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.930] GetProcessHeap () returned 0xd20000 [0094.930] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.930] GetProcessHeap () returned 0xd20000 [0094.930] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.930] GetProcessHeap () returned 0xd20000 [0094.930] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.930] GetProcessHeap () returned 0xd20000 [0094.930] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.930] GetProcessHeap () returned 0xd20000 [0094.930] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0094.930] GetProcessHeap () returned 0xd20000 [0094.930] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0094.930] GetProcessHeap () returned 0xd20000 [0094.930] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.930] GetProcessHeap () returned 0xd20000 [0094.930] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.930] GetProcessHeap () returned 0xd20000 [0094.931] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.931] GetProcessHeap () returned 0xd20000 [0094.931] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.931] GetProcessHeap () returned 0xd20000 [0094.931] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.931] GetProcessHeap () returned 0xd20000 [0094.931] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.931] GetProcessHeap () returned 0xd20000 [0094.931] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0094.931] GetProcessHeap () returned 0xd20000 [0094.931] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0094.931] GetProcessHeap () returned 0xd20000 [0094.931] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.931] GetProcessHeap () returned 0xd20000 [0094.931] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.931] GetProcessHeap () returned 0xd20000 [0094.931] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.931] GetProcessHeap () returned 0xd20000 [0094.932] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.932] GetProcessHeap () returned 0xd20000 [0094.932] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.932] GetProcessHeap () returned 0xd20000 [0094.932] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.932] GetProcessHeap () returned 0xd20000 [0094.932] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0094.932] GetProcessHeap () returned 0xd20000 [0094.932] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0094.932] GetProcessHeap () returned 0xd20000 [0094.932] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0094.932] GetProcessHeap () returned 0xd20000 [0094.932] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0094.932] GetProcessHeap () returned 0xd20000 [0094.932] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.932] GetProcessHeap () returned 0xd20000 [0094.932] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.932] GetProcessHeap () returned 0xd20000 [0094.933] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.933] GetProcessHeap () returned 0xd20000 [0094.933] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.933] GetProcessHeap () returned 0xd20000 [0094.933] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0094.933] GetProcessHeap () returned 0xd20000 [0094.933] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0094.933] GetProcessHeap () returned 0xd20000 [0094.933] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.933] GetProcessHeap () returned 0xd20000 [0094.933] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.933] GetProcessHeap () returned 0xd20000 [0094.933] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0094.933] GetProcessHeap () returned 0xd20000 [0094.933] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0094.933] GetProcessHeap () returned 0xd20000 [0094.933] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0094.933] GetProcessHeap () returned 0xd20000 [0094.933] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0094.933] GetProcessHeap () returned 0xd20000 [0094.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.934] GetProcessHeap () returned 0xd20000 [0094.934] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.934] GetProcessHeap () returned 0xd20000 [0094.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0094.934] GetProcessHeap () returned 0xd20000 [0094.934] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0094.934] GetProcessHeap () returned 0xd20000 [0094.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.934] GetProcessHeap () returned 0xd20000 [0094.934] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.934] GetProcessHeap () returned 0xd20000 [0094.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0094.934] GetProcessHeap () returned 0xd20000 [0094.934] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0094.934] GetProcessHeap () returned 0xd20000 [0094.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.934] GetProcessHeap () returned 0xd20000 [0094.934] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.935] GetProcessHeap () returned 0xd20000 [0094.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.935] GetProcessHeap () returned 0xd20000 [0094.935] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.935] GetProcessHeap () returned 0xd20000 [0094.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.935] GetProcessHeap () returned 0xd20000 [0094.935] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.935] GetProcessHeap () returned 0xd20000 [0094.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0094.935] GetProcessHeap () returned 0xd20000 [0094.935] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0094.935] GetProcessHeap () returned 0xd20000 [0094.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0094.935] GetProcessHeap () returned 0xd20000 [0094.935] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0094.935] GetProcessHeap () returned 0xd20000 [0094.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0094.935] GetProcessHeap () returned 0xd20000 [0094.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0094.936] GetProcessHeap () returned 0xd20000 [0094.936] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.936] GetProcessHeap () returned 0xd20000 [0094.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.936] GetProcessHeap () returned 0xd20000 [0094.936] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0094.936] GetProcessHeap () returned 0xd20000 [0094.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0094.936] GetProcessHeap () returned 0xd20000 [0094.936] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.936] GetProcessHeap () returned 0xd20000 [0094.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.936] GetProcessHeap () returned 0xd20000 [0094.936] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0094.936] GetProcessHeap () returned 0xd20000 [0094.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0094.936] GetProcessHeap () returned 0xd20000 [0094.936] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.937] GetProcessHeap () returned 0xd20000 [0094.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.937] GetProcessHeap () returned 0xd20000 [0094.937] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.937] GetProcessHeap () returned 0xd20000 [0094.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.937] GetProcessHeap () returned 0xd20000 [0094.937] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0094.937] GetProcessHeap () returned 0xd20000 [0094.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0094.937] GetProcessHeap () returned 0xd20000 [0094.937] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.937] GetProcessHeap () returned 0xd20000 [0094.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0094.937] GetProcessHeap () returned 0xd20000 [0094.937] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0094.937] GetProcessHeap () returned 0xd20000 [0094.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.009] GetProcessHeap () returned 0xd20000 [0095.009] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.009] GetProcessHeap () returned 0xd20000 [0095.009] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.009] GetProcessHeap () returned 0xd20000 [0095.009] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.009] GetProcessHeap () returned 0xd20000 [0095.009] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.009] GetProcessHeap () returned 0xd20000 [0095.009] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.009] GetProcessHeap () returned 0xd20000 [0095.009] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.009] GetProcessHeap () returned 0xd20000 [0095.009] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.009] GetProcessHeap () returned 0xd20000 [0095.009] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.010] GetProcessHeap () returned 0xd20000 [0095.010] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.010] GetProcessHeap () returned 0xd20000 [0095.011] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.011] GetProcessHeap () returned 0xd20000 [0095.011] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.012] GetProcessHeap () returned 0xd20000 [0095.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.012] GetProcessHeap () returned 0xd20000 [0095.012] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.012] GetProcessHeap () returned 0xd20000 [0095.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.012] GetProcessHeap () returned 0xd20000 [0095.012] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.012] GetProcessHeap () returned 0xd20000 [0095.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.012] GetProcessHeap () returned 0xd20000 [0095.012] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.012] GetProcessHeap () returned 0xd20000 [0095.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.012] GetProcessHeap () returned 0xd20000 [0095.012] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.012] GetProcessHeap () returned 0xd20000 [0095.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.013] GetProcessHeap () returned 0xd20000 [0095.013] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.013] GetProcessHeap () returned 0xd20000 [0095.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.013] GetProcessHeap () returned 0xd20000 [0095.013] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.013] GetProcessHeap () returned 0xd20000 [0095.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.013] GetProcessHeap () returned 0xd20000 [0095.013] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.013] GetProcessHeap () returned 0xd20000 [0095.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.013] GetProcessHeap () returned 0xd20000 [0095.013] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.013] GetProcessHeap () returned 0xd20000 [0095.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.013] GetProcessHeap () returned 0xd20000 [0095.013] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.014] GetProcessHeap () returned 0xd20000 [0095.014] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.014] GetProcessHeap () returned 0xd20000 [0095.014] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.014] GetProcessHeap () returned 0xd20000 [0095.014] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.014] GetProcessHeap () returned 0xd20000 [0095.014] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0095.014] GetProcessHeap () returned 0xd20000 [0095.014] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0095.014] GetProcessHeap () returned 0xd20000 [0095.014] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0095.014] GetProcessHeap () returned 0xd20000 [0095.014] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0095.014] GetProcessHeap () returned 0xd20000 [0095.014] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44408 | out: hHeap=0xd20000) returned 1 [0095.014] GetProcessHeap () returned 0xd20000 [0095.015] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0095.015] GetProcessHeap () returned 0xd20000 [0095.015] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0095.015] GetProcessHeap () returned 0xd20000 [0095.015] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aca8 | out: hHeap=0xd20000) returned 1 [0095.015] GetProcessHeap () returned 0xd20000 [0095.015] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0095.015] GetProcessHeap () returned 0xd20000 [0095.015] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.015] GetProcessHeap () returned 0xd20000 [0095.015] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0095.015] WriteFile (in: hFile=0x230, lpBuffer=0xd4dbb8*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4dbb8*, lpNumberOfBytesWritten=0x299d864*=0x383, lpOverlapped=0x0) returned 1 [0095.022] GetProcessHeap () returned 0xd20000 [0095.022] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4dbb8, Size=0x30) returned 0xd4dbb8 [0095.022] GetProcessHeap () returned 0xd20000 [0095.022] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0095.022] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0095.023] GetProcessHeap () returned 0xd20000 [0095.023] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10f70) returned 0xd4dbf0 [0095.023] ReadFile (in: hFile=0x230, lpBuffer=0xd4dbf0, nNumberOfBytesToRead=0x10f70, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4dbf0*, lpNumberOfBytesRead=0x299d7e8*=0x10f70, lpOverlapped=0x0) returned 1 [0095.025] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0095.025] WriteFile (in: hFile=0x230, lpBuffer=0xd4dbf0*, nNumberOfBytesToWrite=0x10f70, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4dbf0*, lpNumberOfBytesWritten=0x299d7e4*=0x10f70, lpOverlapped=0x0) returned 1 [0095.028] GetProcessHeap () returned 0xd20000 [0095.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4dbf0 | out: hHeap=0xd20000) returned 1 [0095.029] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0095.029] WriteFile (in: hFile=0x230, lpBuffer=0xd4dbb8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4dbb8*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0095.030] CloseHandle (hObject=0x230) returned 1 [0095.037] GetProcessHeap () returned 0xd20000 [0095.037] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd428a0 | out: hHeap=0xd20000) returned 1 [0095.038] GetProcessHeap () returned 0xd20000 [0095.038] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bcb0 | out: hHeap=0xd20000) returned 1 [0095.038] GetProcessHeap () returned 0xd20000 [0095.038] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0095.038] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" [0095.038] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm.[ponce.lorena@aol.com]" [0095.038] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_it-it.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0095.039] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_it-it.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0095.039] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0095.039] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0095.039] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0095.039] GetProcessHeap () returned 0xd20000 [0095.039] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44678 | out: hHeap=0xd20000) returned 1 [0095.039] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ef94a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ef94a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x3354e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_ja-jp.htm", cAlternateFileName="EULA_J~1.HTM")) returned 1 [0095.039] lstrcmpiW (lpString1="EULA_ja-jp.htm", lpString2=".") returned 1 [0095.040] lstrcmpiW (lpString1="EULA_ja-jp.htm", lpString2="..") returned 1 [0095.040] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_ja-jp.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" [0095.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_ja-jp.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0095.040] GetProcessHeap () returned 0xd20000 [0095.040] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd44420 [0095.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_ja-jp.htm", cchWideChar=-1, lpMultiByteStr=0xd44420, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_ja-jp.htm", lpUsedDefaultChar=0x0) returned 15 [0095.040] lstrlenA (lpString="EULA_ja-jp.htm") returned 14 [0095.040] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0095.040] lstrlenA (lpString="EULA_ja-jp.htm") returned 14 [0095.040] lstrlenA (lpString=".dll") returned 4 [0095.040] lstrlenA (lpString=".dll") returned 4 [0095.040] lstrlenA (lpString="EULA_ja-jp.htm") returned 14 [0095.040] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0095.040] lstrlenA (lpString="EULA_ja-jp.htm") returned 14 [0095.040] lstrlenA (lpString=".ini") returned 4 [0095.040] lstrlenA (lpString=".ini") returned 4 [0095.040] lstrlenA (lpString="EULA_ja-jp.htm") returned 14 [0095.041] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0095.041] lstrlenA (lpString="EULA_ja-jp.htm") returned 14 [0095.041] lstrlenA (lpString=".inc") returned 4 [0095.041] lstrlenA (lpString=".inc") returned 4 [0095.041] lstrlenA (lpString="EULA_ja-jp.htm") returned 14 [0095.041] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0095.041] lstrcmpiW (lpString1="EULA_ja-jp.htm", lpString2="HOW_RECOVER.html") returned -1 [0095.041] lstrcmpiW (lpString1="EULA_ja-jp.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0095.041] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0095.041] lstrcmpiW (lpString1="EULA_ja-jp.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0095.041] GetProcessHeap () returned 0xd20000 [0095.041] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42850 [0095.041] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0095.042] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=210254) returned 1 [0095.042] GetProcessHeap () returned 0xd20000 [0095.042] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bf08 [0095.042] GetProcessHeap () returned 0xd20000 [0095.042] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0095.042] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm") returned 52 [0095.042] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0095.042] GetProcessHeap () returned 0xd20000 [0095.042] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0095.043] GetProcessHeap () returned 0xd20000 [0095.043] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4dbf0 [0095.043] lstrlenA (lpString="rsa_encrypt") returned 11 [0095.043] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0095.046] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0095.046] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0095.046] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0095.046] GetProcessHeap () returned 0xd20000 [0095.046] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0095.047] lstrlenA (lpString="010001") returned 6 [0095.047] GetProcessHeap () returned 0xd20000 [0095.047] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0095.047] GetProcessHeap () returned 0xd20000 [0095.047] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0095.047] GetProcessHeap () returned 0xd20000 [0095.047] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ad38 [0095.049] GetProcessHeap () returned 0xd20000 [0095.049] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0095.049] GetProcessHeap () returned 0xd20000 [0095.049] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4adc8 [0095.049] GetProcessHeap () returned 0xd20000 [0095.049] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45528 [0095.049] GetProcessHeap () returned 0xd20000 [0095.049] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd98 [0095.049] GetProcessHeap () returned 0xd20000 [0095.049] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0095.049] GetProcessHeap () returned 0xd20000 [0095.049] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.049] GetProcessHeap () returned 0xd20000 [0095.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0095.050] GetProcessHeap () returned 0xd20000 [0095.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0095.050] GetProcessHeap () returned 0xd20000 [0095.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd450c8 [0095.050] GetProcessHeap () returned 0xd20000 [0095.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.050] GetProcessHeap () returned 0xd20000 [0095.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444e0 [0095.050] GetProcessHeap () returned 0xd20000 [0095.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b128 [0095.050] GetProcessHeap () returned 0xd20000 [0095.050] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0095.050] GetProcessHeap () returned 0xd20000 [0095.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44c68 [0095.050] GetProcessHeap () returned 0xd20000 [0095.050] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b128 | out: hHeap=0xd20000) returned 1 [0095.050] GetProcessHeap () returned 0xd20000 [0095.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.051] GetProcessHeap () returned 0xd20000 [0095.051] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44600 [0095.051] GetProcessHeap () returned 0xd20000 [0095.051] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.051] GetProcessHeap () returned 0xd20000 [0095.051] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.051] GetProcessHeap () returned 0xd20000 [0095.051] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.051] GetProcessHeap () returned 0xd20000 [0095.051] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.051] GetProcessHeap () returned 0xd20000 [0095.051] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.051] GetProcessHeap () returned 0xd20000 [0095.051] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.051] GetProcessHeap () returned 0xd20000 [0095.051] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4aaf8 [0095.051] GetProcessHeap () returned 0xd20000 [0095.051] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44600 | out: hHeap=0xd20000) returned 1 [0095.051] GetProcessHeap () returned 0xd20000 [0095.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0095.052] GetProcessHeap () returned 0xd20000 [0095.052] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aaf8 | out: hHeap=0xd20000) returned 1 [0095.052] GetProcessHeap () returned 0xd20000 [0095.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.052] GetProcessHeap () returned 0xd20000 [0095.052] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.052] GetProcessHeap () returned 0xd20000 [0095.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.052] GetProcessHeap () returned 0xd20000 [0095.052] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.052] GetProcessHeap () returned 0xd20000 [0095.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.052] GetProcessHeap () returned 0xd20000 [0095.052] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.052] GetProcessHeap () returned 0xd20000 [0095.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0095.052] GetProcessHeap () returned 0xd20000 [0095.052] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0095.053] GetProcessHeap () returned 0xd20000 [0095.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.053] GetProcessHeap () returned 0xd20000 [0095.053] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.053] GetProcessHeap () returned 0xd20000 [0095.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.053] GetProcessHeap () returned 0xd20000 [0095.053] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.053] GetProcessHeap () returned 0xd20000 [0095.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.053] GetProcessHeap () returned 0xd20000 [0095.053] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.053] GetProcessHeap () returned 0xd20000 [0095.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.053] GetProcessHeap () returned 0xd20000 [0095.053] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.053] GetProcessHeap () returned 0xd20000 [0095.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.053] GetProcessHeap () returned 0xd20000 [0095.053] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.054] GetProcessHeap () returned 0xd20000 [0095.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.054] GetProcessHeap () returned 0xd20000 [0095.054] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.054] GetProcessHeap () returned 0xd20000 [0095.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.054] GetProcessHeap () returned 0xd20000 [0095.054] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.054] GetProcessHeap () returned 0xd20000 [0095.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.054] GetProcessHeap () returned 0xd20000 [0095.054] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.054] GetProcessHeap () returned 0xd20000 [0095.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.054] GetProcessHeap () returned 0xd20000 [0095.054] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.054] GetProcessHeap () returned 0xd20000 [0095.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.054] GetProcessHeap () returned 0xd20000 [0095.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.055] GetProcessHeap () returned 0xd20000 [0095.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.055] GetProcessHeap () returned 0xd20000 [0095.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.055] GetProcessHeap () returned 0xd20000 [0095.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.055] GetProcessHeap () returned 0xd20000 [0095.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.055] GetProcessHeap () returned 0xd20000 [0095.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.055] GetProcessHeap () returned 0xd20000 [0095.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.055] GetProcessHeap () returned 0xd20000 [0095.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.055] GetProcessHeap () returned 0xd20000 [0095.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.055] GetProcessHeap () returned 0xd20000 [0095.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.056] GetProcessHeap () returned 0xd20000 [0095.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.056] GetProcessHeap () returned 0xd20000 [0095.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0095.056] GetProcessHeap () returned 0xd20000 [0095.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0095.056] GetProcessHeap () returned 0xd20000 [0095.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.056] GetProcessHeap () returned 0xd20000 [0095.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.056] GetProcessHeap () returned 0xd20000 [0095.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.056] GetProcessHeap () returned 0xd20000 [0095.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.056] GetProcessHeap () returned 0xd20000 [0095.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.056] GetProcessHeap () returned 0xd20000 [0095.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.056] GetProcessHeap () returned 0xd20000 [0095.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.057] GetProcessHeap () returned 0xd20000 [0095.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.057] GetProcessHeap () returned 0xd20000 [0095.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.057] GetProcessHeap () returned 0xd20000 [0095.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.057] GetProcessHeap () returned 0xd20000 [0095.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.057] GetProcessHeap () returned 0xd20000 [0095.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.057] GetProcessHeap () returned 0xd20000 [0095.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.057] GetProcessHeap () returned 0xd20000 [0095.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.057] GetProcessHeap () returned 0xd20000 [0095.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.057] GetProcessHeap () returned 0xd20000 [0095.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.058] GetProcessHeap () returned 0xd20000 [0095.058] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.058] GetProcessHeap () returned 0xd20000 [0095.058] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.058] GetProcessHeap () returned 0xd20000 [0095.058] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.058] GetProcessHeap () returned 0xd20000 [0095.058] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.058] GetProcessHeap () returned 0xd20000 [0095.058] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.058] GetProcessHeap () returned 0xd20000 [0095.058] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.058] GetProcessHeap () returned 0xd20000 [0095.058] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.058] GetProcessHeap () returned 0xd20000 [0095.058] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.058] GetProcessHeap () returned 0xd20000 [0095.058] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.059] GetProcessHeap () returned 0xd20000 [0095.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.059] GetProcessHeap () returned 0xd20000 [0095.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.059] GetProcessHeap () returned 0xd20000 [0095.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.059] GetProcessHeap () returned 0xd20000 [0095.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.059] GetProcessHeap () returned 0xd20000 [0095.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.059] GetProcessHeap () returned 0xd20000 [0095.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.059] GetProcessHeap () returned 0xd20000 [0095.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.059] GetProcessHeap () returned 0xd20000 [0095.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.059] GetProcessHeap () returned 0xd20000 [0095.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.060] GetProcessHeap () returned 0xd20000 [0095.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.060] GetProcessHeap () returned 0xd20000 [0095.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.060] GetProcessHeap () returned 0xd20000 [0095.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.060] GetProcessHeap () returned 0xd20000 [0095.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.060] GetProcessHeap () returned 0xd20000 [0095.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.060] GetProcessHeap () returned 0xd20000 [0095.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.060] GetProcessHeap () returned 0xd20000 [0095.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.060] GetProcessHeap () returned 0xd20000 [0095.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.060] GetProcessHeap () returned 0xd20000 [0095.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.061] GetProcessHeap () returned 0xd20000 [0095.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.061] GetProcessHeap () returned 0xd20000 [0095.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.061] GetProcessHeap () returned 0xd20000 [0095.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.061] GetProcessHeap () returned 0xd20000 [0095.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.061] GetProcessHeap () returned 0xd20000 [0095.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.061] GetProcessHeap () returned 0xd20000 [0095.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.061] GetProcessHeap () returned 0xd20000 [0095.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.061] GetProcessHeap () returned 0xd20000 [0095.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.061] GetProcessHeap () returned 0xd20000 [0095.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.061] GetProcessHeap () returned 0xd20000 [0095.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.062] GetProcessHeap () returned 0xd20000 [0095.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.062] GetProcessHeap () returned 0xd20000 [0095.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.062] GetProcessHeap () returned 0xd20000 [0095.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.062] GetProcessHeap () returned 0xd20000 [0095.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.062] GetProcessHeap () returned 0xd20000 [0095.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.062] GetProcessHeap () returned 0xd20000 [0095.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.062] GetProcessHeap () returned 0xd20000 [0095.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.062] GetProcessHeap () returned 0xd20000 [0095.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.062] GetProcessHeap () returned 0xd20000 [0095.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.063] GetProcessHeap () returned 0xd20000 [0095.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.063] GetProcessHeap () returned 0xd20000 [0095.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.063] GetProcessHeap () returned 0xd20000 [0095.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.063] GetProcessHeap () returned 0xd20000 [0095.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.063] GetProcessHeap () returned 0xd20000 [0095.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.063] GetProcessHeap () returned 0xd20000 [0095.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.063] GetProcessHeap () returned 0xd20000 [0095.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.064] GetProcessHeap () returned 0xd20000 [0095.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.064] GetProcessHeap () returned 0xd20000 [0095.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.064] GetProcessHeap () returned 0xd20000 [0095.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.064] GetProcessHeap () returned 0xd20000 [0095.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.064] GetProcessHeap () returned 0xd20000 [0095.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.064] GetProcessHeap () returned 0xd20000 [0095.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.064] GetProcessHeap () returned 0xd20000 [0095.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.064] GetProcessHeap () returned 0xd20000 [0095.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.064] GetProcessHeap () returned 0xd20000 [0095.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.064] GetProcessHeap () returned 0xd20000 [0095.065] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.065] GetProcessHeap () returned 0xd20000 [0095.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.065] GetProcessHeap () returned 0xd20000 [0095.065] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.065] GetProcessHeap () returned 0xd20000 [0095.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.065] GetProcessHeap () returned 0xd20000 [0095.065] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.065] GetProcessHeap () returned 0xd20000 [0095.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.065] GetProcessHeap () returned 0xd20000 [0095.065] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.065] GetProcessHeap () returned 0xd20000 [0095.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.065] GetProcessHeap () returned 0xd20000 [0095.065] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.065] GetProcessHeap () returned 0xd20000 [0095.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.066] GetProcessHeap () returned 0xd20000 [0095.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.066] GetProcessHeap () returned 0xd20000 [0095.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.066] GetProcessHeap () returned 0xd20000 [0095.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.066] GetProcessHeap () returned 0xd20000 [0095.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.066] GetProcessHeap () returned 0xd20000 [0095.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.066] GetProcessHeap () returned 0xd20000 [0095.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.066] GetProcessHeap () returned 0xd20000 [0095.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.066] GetProcessHeap () returned 0xd20000 [0095.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.066] GetProcessHeap () returned 0xd20000 [0095.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.066] GetProcessHeap () returned 0xd20000 [0095.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.067] GetProcessHeap () returned 0xd20000 [0095.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.067] GetProcessHeap () returned 0xd20000 [0095.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.067] GetProcessHeap () returned 0xd20000 [0095.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.067] GetProcessHeap () returned 0xd20000 [0095.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.067] GetProcessHeap () returned 0xd20000 [0095.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.067] GetProcessHeap () returned 0xd20000 [0095.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.067] GetProcessHeap () returned 0xd20000 [0095.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.067] GetProcessHeap () returned 0xd20000 [0095.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.067] GetProcessHeap () returned 0xd20000 [0095.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.068] GetProcessHeap () returned 0xd20000 [0095.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.068] GetProcessHeap () returned 0xd20000 [0095.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.068] GetProcessHeap () returned 0xd20000 [0095.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.068] GetProcessHeap () returned 0xd20000 [0095.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.068] GetProcessHeap () returned 0xd20000 [0095.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.068] GetProcessHeap () returned 0xd20000 [0095.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.068] GetProcessHeap () returned 0xd20000 [0095.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.068] GetProcessHeap () returned 0xd20000 [0095.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.068] GetProcessHeap () returned 0xd20000 [0095.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.069] GetProcessHeap () returned 0xd20000 [0095.069] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.069] GetProcessHeap () returned 0xd20000 [0095.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.069] GetProcessHeap () returned 0xd20000 [0095.069] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.069] GetProcessHeap () returned 0xd20000 [0095.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.069] GetProcessHeap () returned 0xd20000 [0095.069] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.069] GetProcessHeap () returned 0xd20000 [0095.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.069] GetProcessHeap () returned 0xd20000 [0095.069] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.069] GetProcessHeap () returned 0xd20000 [0095.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.069] GetProcessHeap () returned 0xd20000 [0095.069] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.070] GetProcessHeap () returned 0xd20000 [0095.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.070] GetProcessHeap () returned 0xd20000 [0095.070] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.070] GetProcessHeap () returned 0xd20000 [0095.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.070] GetProcessHeap () returned 0xd20000 [0095.070] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.070] GetProcessHeap () returned 0xd20000 [0095.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.070] GetProcessHeap () returned 0xd20000 [0095.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0095.070] GetProcessHeap () returned 0xd20000 [0095.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0095.070] GetProcessHeap () returned 0xd20000 [0095.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0095.070] GetProcessHeap () returned 0xd20000 [0095.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0095.070] GetProcessHeap () returned 0xd20000 [0095.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444e0 | out: hHeap=0xd20000) returned 1 [0095.071] GetProcessHeap () returned 0xd20000 [0095.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4adc8 | out: hHeap=0xd20000) returned 1 [0095.071] GetProcessHeap () returned 0xd20000 [0095.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0095.071] GetProcessHeap () returned 0xd20000 [0095.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ad38 | out: hHeap=0xd20000) returned 1 [0095.071] GetProcessHeap () returned 0xd20000 [0095.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0095.071] GetProcessHeap () returned 0xd20000 [0095.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.071] GetProcessHeap () returned 0xd20000 [0095.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0095.071] WriteFile (in: hFile=0x230, lpBuffer=0xd4dbf0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4dbf0*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0095.077] GetProcessHeap () returned 0xd20000 [0095.077] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4dbf0, Size=0x30) returned 0xd4dbf0 [0095.077] GetProcessHeap () returned 0xd20000 [0095.077] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0095.078] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0095.078] GetProcessHeap () returned 0xd20000 [0095.078] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x3354e) returned 0xd4dc28 [0095.083] ReadFile (in: hFile=0x230, lpBuffer=0xd4dc28, nNumberOfBytesToRead=0x3354e, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4dc28*, lpNumberOfBytesRead=0x299d7e8*=0x3354e, lpOverlapped=0x0) returned 1 [0095.088] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0095.089] WriteFile (in: hFile=0x230, lpBuffer=0xd4dc28*, nNumberOfBytesToWrite=0x3354e, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4dc28*, lpNumberOfBytesWritten=0x299d7e4*=0x3354e, lpOverlapped=0x0) returned 1 [0095.093] GetProcessHeap () returned 0xd20000 [0095.093] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4dc28 | out: hHeap=0xd20000) returned 1 [0095.093] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0095.093] WriteFile (in: hFile=0x230, lpBuffer=0xd4dbf0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4dbf0*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0095.095] CloseHandle (hObject=0x230) returned 1 [0095.103] GetProcessHeap () returned 0xd20000 [0095.103] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42850 | out: hHeap=0xd20000) returned 1 [0095.103] GetProcessHeap () returned 0xd20000 [0095.103] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bf08 | out: hHeap=0xd20000) returned 1 [0095.103] GetProcessHeap () returned 0xd20000 [0095.103] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0095.103] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" [0095.103] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm.[ponce.lorena@aol.com]" [0095.103] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ja-jp.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0095.104] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ja-jp.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0095.104] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0095.104] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0095.104] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0095.104] GetProcessHeap () returned 0xd20000 [0095.104] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44420 | out: hHeap=0xd20000) returned 1 [0095.105] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3f205a, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3f205a, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x9ace3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_ko-kr.htm", cAlternateFileName="EULA_K~1.HTM")) returned 1 [0095.105] lstrcmpiW (lpString1="EULA_ko-kr.htm", lpString2=".") returned 1 [0095.105] lstrcmpiW (lpString1="EULA_ko-kr.htm", lpString2="..") returned 1 [0095.105] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_ko-kr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" [0095.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_ko-kr.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0095.105] GetProcessHeap () returned 0xd20000 [0095.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd445a0 [0095.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_ko-kr.htm", cchWideChar=-1, lpMultiByteStr=0xd445a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_ko-kr.htm", lpUsedDefaultChar=0x0) returned 15 [0095.105] lstrlenA (lpString="EULA_ko-kr.htm") returned 14 [0095.105] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0095.105] lstrlenA (lpString="EULA_ko-kr.htm") returned 14 [0095.105] lstrlenA (lpString=".dll") returned 4 [0095.105] lstrlenA (lpString=".dll") returned 4 [0095.105] lstrlenA (lpString="EULA_ko-kr.htm") returned 14 [0095.105] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0095.105] lstrlenA (lpString="EULA_ko-kr.htm") returned 14 [0095.105] lstrlenA (lpString=".ini") returned 4 [0095.105] lstrlenA (lpString=".ini") returned 4 [0095.105] lstrlenA (lpString="EULA_ko-kr.htm") returned 14 [0095.106] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0095.106] lstrlenA (lpString="EULA_ko-kr.htm") returned 14 [0095.106] lstrlenA (lpString=".inc") returned 4 [0095.106] lstrlenA (lpString=".inc") returned 4 [0095.106] lstrlenA (lpString="EULA_ko-kr.htm") returned 14 [0095.106] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0095.106] lstrcmpiW (lpString1="EULA_ko-kr.htm", lpString2="HOW_RECOVER.html") returned -1 [0095.106] lstrcmpiW (lpString1="EULA_ko-kr.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0095.106] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0095.106] lstrcmpiW (lpString1="EULA_ko-kr.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0095.106] GetProcessHeap () returned 0xd20000 [0095.106] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42490 [0095.106] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0095.108] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=634083) returned 1 [0095.108] GetProcessHeap () returned 0xd20000 [0095.108] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bc38 [0095.108] GetProcessHeap () returned 0xd20000 [0095.108] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0095.108] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm") returned 52 [0095.108] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0095.108] GetProcessHeap () returned 0xd20000 [0095.108] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0095.108] GetProcessHeap () returned 0xd20000 [0095.108] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4dc28 [0095.108] lstrlenA (lpString="rsa_encrypt") returned 11 [0095.108] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0095.111] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0095.111] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0095.111] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0095.111] GetProcessHeap () returned 0xd20000 [0095.111] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0095.111] lstrlenA (lpString="010001") returned 6 [0095.111] GetProcessHeap () returned 0xd20000 [0095.111] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cbd8 [0095.111] GetProcessHeap () returned 0xd20000 [0095.111] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0095.111] GetProcessHeap () returned 0xd20000 [0095.111] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4a948 [0095.111] GetProcessHeap () returned 0xd20000 [0095.111] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0095.111] GetProcessHeap () returned 0xd20000 [0095.111] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aca8 [0095.111] GetProcessHeap () returned 0xd20000 [0095.112] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44fb0 [0095.112] GetProcessHeap () returned 0xd20000 [0095.112] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd38 [0095.112] GetProcessHeap () returned 0xd20000 [0095.112] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0095.112] GetProcessHeap () returned 0xd20000 [0095.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.112] GetProcessHeap () returned 0xd20000 [0095.112] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0095.112] GetProcessHeap () returned 0xd20000 [0095.112] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0095.112] GetProcessHeap () returned 0xd20000 [0095.112] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44b50 [0095.112] GetProcessHeap () returned 0xd20000 [0095.112] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.112] GetProcessHeap () returned 0xd20000 [0095.112] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444c8 [0095.112] GetProcessHeap () returned 0xd20000 [0095.112] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4adc8 [0095.112] GetProcessHeap () returned 0xd20000 [0095.113] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0095.113] GetProcessHeap () returned 0xd20000 [0095.113] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0095.113] GetProcessHeap () returned 0xd20000 [0095.113] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4adc8 | out: hHeap=0xd20000) returned 1 [0095.113] GetProcessHeap () returned 0xd20000 [0095.113] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.113] GetProcessHeap () returned 0xd20000 [0095.113] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445b8 [0095.113] GetProcessHeap () returned 0xd20000 [0095.113] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.113] GetProcessHeap () returned 0xd20000 [0095.113] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.113] GetProcessHeap () returned 0xd20000 [0095.113] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.113] GetProcessHeap () returned 0xd20000 [0095.113] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.113] GetProcessHeap () returned 0xd20000 [0095.113] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.113] GetProcessHeap () returned 0xd20000 [0095.114] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.114] GetProcessHeap () returned 0xd20000 [0095.114] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b008 [0095.114] GetProcessHeap () returned 0xd20000 [0095.114] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445b8 | out: hHeap=0xd20000) returned 1 [0095.114] GetProcessHeap () returned 0xd20000 [0095.114] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0095.114] GetProcessHeap () returned 0xd20000 [0095.114] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b008 | out: hHeap=0xd20000) returned 1 [0095.114] GetProcessHeap () returned 0xd20000 [0095.114] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.114] GetProcessHeap () returned 0xd20000 [0095.114] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.114] GetProcessHeap () returned 0xd20000 [0095.114] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.114] GetProcessHeap () returned 0xd20000 [0095.114] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.114] GetProcessHeap () returned 0xd20000 [0095.114] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.115] GetProcessHeap () returned 0xd20000 [0095.115] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.115] GetProcessHeap () returned 0xd20000 [0095.115] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.115] GetProcessHeap () returned 0xd20000 [0095.115] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.115] GetProcessHeap () returned 0xd20000 [0095.115] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.115] GetProcessHeap () returned 0xd20000 [0095.115] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.115] GetProcessHeap () returned 0xd20000 [0095.115] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.115] GetProcessHeap () returned 0xd20000 [0095.115] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.115] GetProcessHeap () returned 0xd20000 [0095.115] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.115] GetProcessHeap () returned 0xd20000 [0095.115] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.115] GetProcessHeap () returned 0xd20000 [0095.116] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.116] GetProcessHeap () returned 0xd20000 [0095.116] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.116] GetProcessHeap () returned 0xd20000 [0095.116] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.116] GetProcessHeap () returned 0xd20000 [0095.116] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.116] GetProcessHeap () returned 0xd20000 [0095.116] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.116] GetProcessHeap () returned 0xd20000 [0095.116] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.116] GetProcessHeap () returned 0xd20000 [0095.116] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.116] GetProcessHeap () returned 0xd20000 [0095.116] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.116] GetProcessHeap () returned 0xd20000 [0095.116] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.116] GetProcessHeap () returned 0xd20000 [0095.116] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.116] GetProcessHeap () returned 0xd20000 [0095.117] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.117] GetProcessHeap () returned 0xd20000 [0095.117] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.117] GetProcessHeap () returned 0xd20000 [0095.117] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.117] GetProcessHeap () returned 0xd20000 [0095.117] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.117] GetProcessHeap () returned 0xd20000 [0095.117] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.117] GetProcessHeap () returned 0xd20000 [0095.117] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.117] GetProcessHeap () returned 0xd20000 [0095.117] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.117] GetProcessHeap () returned 0xd20000 [0095.117] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.117] GetProcessHeap () returned 0xd20000 [0095.117] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.117] GetProcessHeap () returned 0xd20000 [0095.117] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.117] GetProcessHeap () returned 0xd20000 [0095.118] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.118] GetProcessHeap () returned 0xd20000 [0095.118] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.118] GetProcessHeap () returned 0xd20000 [0095.118] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.118] GetProcessHeap () returned 0xd20000 [0095.118] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.118] GetProcessHeap () returned 0xd20000 [0095.118] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.118] GetProcessHeap () returned 0xd20000 [0095.118] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.118] GetProcessHeap () returned 0xd20000 [0095.118] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.118] GetProcessHeap () returned 0xd20000 [0095.118] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.118] GetProcessHeap () returned 0xd20000 [0095.118] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.119] GetProcessHeap () returned 0xd20000 [0095.119] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.119] GetProcessHeap () returned 0xd20000 [0095.119] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.119] GetProcessHeap () returned 0xd20000 [0095.119] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.119] GetProcessHeap () returned 0xd20000 [0095.119] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.119] GetProcessHeap () returned 0xd20000 [0095.119] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.119] GetProcessHeap () returned 0xd20000 [0095.119] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0095.119] GetProcessHeap () returned 0xd20000 [0095.119] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0095.119] GetProcessHeap () returned 0xd20000 [0095.119] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.119] GetProcessHeap () returned 0xd20000 [0095.119] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.119] GetProcessHeap () returned 0xd20000 [0095.119] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.120] GetProcessHeap () returned 0xd20000 [0095.120] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.120] GetProcessHeap () returned 0xd20000 [0095.120] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.120] GetProcessHeap () returned 0xd20000 [0095.120] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.120] GetProcessHeap () returned 0xd20000 [0095.120] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.120] GetProcessHeap () returned 0xd20000 [0095.120] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.120] GetProcessHeap () returned 0xd20000 [0095.120] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.120] GetProcessHeap () returned 0xd20000 [0095.120] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.120] GetProcessHeap () returned 0xd20000 [0095.120] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.120] GetProcessHeap () returned 0xd20000 [0095.121] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.121] GetProcessHeap () returned 0xd20000 [0095.121] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.121] GetProcessHeap () returned 0xd20000 [0095.121] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.121] GetProcessHeap () returned 0xd20000 [0095.121] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.121] GetProcessHeap () returned 0xd20000 [0095.121] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.121] GetProcessHeap () returned 0xd20000 [0095.121] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.121] GetProcessHeap () returned 0xd20000 [0095.121] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.121] GetProcessHeap () returned 0xd20000 [0095.122] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.122] GetProcessHeap () returned 0xd20000 [0095.122] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.122] GetProcessHeap () returned 0xd20000 [0095.122] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.122] GetProcessHeap () returned 0xd20000 [0095.122] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.122] GetProcessHeap () returned 0xd20000 [0095.122] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.122] GetProcessHeap () returned 0xd20000 [0095.122] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.122] GetProcessHeap () returned 0xd20000 [0095.122] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.122] GetProcessHeap () returned 0xd20000 [0095.122] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.122] GetProcessHeap () returned 0xd20000 [0095.122] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.122] GetProcessHeap () returned 0xd20000 [0095.122] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.123] GetProcessHeap () returned 0xd20000 [0095.123] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.123] GetProcessHeap () returned 0xd20000 [0095.123] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.123] GetProcessHeap () returned 0xd20000 [0095.123] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.123] GetProcessHeap () returned 0xd20000 [0095.123] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.123] GetProcessHeap () returned 0xd20000 [0095.123] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.123] GetProcessHeap () returned 0xd20000 [0095.123] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.123] GetProcessHeap () returned 0xd20000 [0095.123] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.123] GetProcessHeap () returned 0xd20000 [0095.123] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.123] GetProcessHeap () returned 0xd20000 [0095.123] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.123] GetProcessHeap () returned 0xd20000 [0095.124] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.124] GetProcessHeap () returned 0xd20000 [0095.124] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.124] GetProcessHeap () returned 0xd20000 [0095.124] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.124] GetProcessHeap () returned 0xd20000 [0095.124] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.124] GetProcessHeap () returned 0xd20000 [0095.124] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.124] GetProcessHeap () returned 0xd20000 [0095.124] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.124] GetProcessHeap () returned 0xd20000 [0095.124] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.124] GetProcessHeap () returned 0xd20000 [0095.124] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.124] GetProcessHeap () returned 0xd20000 [0095.124] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.124] GetProcessHeap () returned 0xd20000 [0095.124] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.125] GetProcessHeap () returned 0xd20000 [0095.125] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.125] GetProcessHeap () returned 0xd20000 [0095.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.125] GetProcessHeap () returned 0xd20000 [0095.125] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.125] GetProcessHeap () returned 0xd20000 [0095.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.125] GetProcessHeap () returned 0xd20000 [0095.125] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.125] GetProcessHeap () returned 0xd20000 [0095.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.125] GetProcessHeap () returned 0xd20000 [0095.125] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.125] GetProcessHeap () returned 0xd20000 [0095.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.125] GetProcessHeap () returned 0xd20000 [0095.125] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.125] GetProcessHeap () returned 0xd20000 [0095.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.126] GetProcessHeap () returned 0xd20000 [0095.126] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.126] GetProcessHeap () returned 0xd20000 [0095.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.126] GetProcessHeap () returned 0xd20000 [0095.126] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.127] GetProcessHeap () returned 0xd20000 [0095.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.127] GetProcessHeap () returned 0xd20000 [0095.127] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.127] GetProcessHeap () returned 0xd20000 [0095.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.127] GetProcessHeap () returned 0xd20000 [0095.127] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.127] GetProcessHeap () returned 0xd20000 [0095.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.127] GetProcessHeap () returned 0xd20000 [0095.127] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.127] GetProcessHeap () returned 0xd20000 [0095.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.127] GetProcessHeap () returned 0xd20000 [0095.127] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.127] GetProcessHeap () returned 0xd20000 [0095.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.128] GetProcessHeap () returned 0xd20000 [0095.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.128] GetProcessHeap () returned 0xd20000 [0095.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.128] GetProcessHeap () returned 0xd20000 [0095.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.128] GetProcessHeap () returned 0xd20000 [0095.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.128] GetProcessHeap () returned 0xd20000 [0095.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.128] GetProcessHeap () returned 0xd20000 [0095.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.128] GetProcessHeap () returned 0xd20000 [0095.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.128] GetProcessHeap () returned 0xd20000 [0095.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.128] GetProcessHeap () returned 0xd20000 [0095.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.128] GetProcessHeap () returned 0xd20000 [0095.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.129] GetProcessHeap () returned 0xd20000 [0095.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.129] GetProcessHeap () returned 0xd20000 [0095.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.129] GetProcessHeap () returned 0xd20000 [0095.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.129] GetProcessHeap () returned 0xd20000 [0095.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.129] GetProcessHeap () returned 0xd20000 [0095.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.129] GetProcessHeap () returned 0xd20000 [0095.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.129] GetProcessHeap () returned 0xd20000 [0095.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.129] GetProcessHeap () returned 0xd20000 [0095.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.129] GetProcessHeap () returned 0xd20000 [0095.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.129] GetProcessHeap () returned 0xd20000 [0095.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.129] GetProcessHeap () returned 0xd20000 [0095.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.130] GetProcessHeap () returned 0xd20000 [0095.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.130] GetProcessHeap () returned 0xd20000 [0095.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.130] GetProcessHeap () returned 0xd20000 [0095.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.130] GetProcessHeap () returned 0xd20000 [0095.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.130] GetProcessHeap () returned 0xd20000 [0095.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.130] GetProcessHeap () returned 0xd20000 [0095.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.130] GetProcessHeap () returned 0xd20000 [0095.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0095.130] GetProcessHeap () returned 0xd20000 [0095.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0095.130] GetProcessHeap () returned 0xd20000 [0095.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.131] GetProcessHeap () returned 0xd20000 [0095.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.131] GetProcessHeap () returned 0xd20000 [0095.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.131] GetProcessHeap () returned 0xd20000 [0095.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.131] GetProcessHeap () returned 0xd20000 [0095.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.131] GetProcessHeap () returned 0xd20000 [0095.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.131] GetProcessHeap () returned 0xd20000 [0095.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.131] GetProcessHeap () returned 0xd20000 [0095.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.131] GetProcessHeap () returned 0xd20000 [0095.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.131] GetProcessHeap () returned 0xd20000 [0095.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.131] GetProcessHeap () returned 0xd20000 [0095.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.132] GetProcessHeap () returned 0xd20000 [0095.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.132] GetProcessHeap () returned 0xd20000 [0095.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0095.132] GetProcessHeap () returned 0xd20000 [0095.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0095.132] GetProcessHeap () returned 0xd20000 [0095.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.132] GetProcessHeap () returned 0xd20000 [0095.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.132] GetProcessHeap () returned 0xd20000 [0095.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.132] GetProcessHeap () returned 0xd20000 [0095.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.133] GetProcessHeap () returned 0xd20000 [0095.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0095.133] GetProcessHeap () returned 0xd20000 [0095.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0095.133] GetProcessHeap () returned 0xd20000 [0095.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.133] GetProcessHeap () returned 0xd20000 [0095.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.133] GetProcessHeap () returned 0xd20000 [0095.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0095.133] GetProcessHeap () returned 0xd20000 [0095.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0095.133] GetProcessHeap () returned 0xd20000 [0095.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0095.133] GetProcessHeap () returned 0xd20000 [0095.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0095.133] GetProcessHeap () returned 0xd20000 [0095.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444c8 | out: hHeap=0xd20000) returned 1 [0095.133] GetProcessHeap () returned 0xd20000 [0095.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aca8 | out: hHeap=0xd20000) returned 1 [0095.134] GetProcessHeap () returned 0xd20000 [0095.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0095.134] GetProcessHeap () returned 0xd20000 [0095.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a948 | out: hHeap=0xd20000) returned 1 [0095.134] GetProcessHeap () returned 0xd20000 [0095.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0095.134] GetProcessHeap () returned 0xd20000 [0095.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0095.134] GetProcessHeap () returned 0xd20000 [0095.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0095.134] WriteFile (in: hFile=0x230, lpBuffer=0xd4dc28*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4dc28*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0095.143] GetProcessHeap () returned 0xd20000 [0095.143] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4dc28, Size=0x30) returned 0xd4dc28 [0095.143] GetProcessHeap () returned 0xd20000 [0095.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0095.143] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0095.143] GetProcessHeap () returned 0xd20000 [0095.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x9ace3) returned 0x2d5b020 [0095.156] ReadFile (in: hFile=0x230, lpBuffer=0x2d5b020, nNumberOfBytesToRead=0x9ace3, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x2d5b020*, lpNumberOfBytesRead=0x299d7e8*=0x9ace3, lpOverlapped=0x0) returned 1 [0095.172] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0095.172] WriteFile (in: hFile=0x230, lpBuffer=0x2d5b020*, nNumberOfBytesToWrite=0x9ace3, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0x2d5b020*, lpNumberOfBytesWritten=0x299d7e4*=0x9ace3, lpOverlapped=0x0) returned 1 [0095.181] GetProcessHeap () returned 0xd20000 [0095.181] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0x2d5b020 | out: hHeap=0xd20000) returned 1 [0095.182] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0095.182] WriteFile (in: hFile=0x230, lpBuffer=0xd4dc28*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4dc28*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0095.183] CloseHandle (hObject=0x230) returned 1 [0095.211] GetProcessHeap () returned 0xd20000 [0095.211] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42490 | out: hHeap=0xd20000) returned 1 [0095.211] GetProcessHeap () returned 0xd20000 [0095.211] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bc38 | out: hHeap=0xd20000) returned 1 [0095.211] GetProcessHeap () returned 0xd20000 [0095.211] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0095.212] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" [0095.212] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm.[ponce.lorena@aol.com]" [0095.212] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ko-kr.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0095.212] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ko-kr.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0095.212] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0095.213] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0095.213] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0095.213] GetProcessHeap () returned 0xd20000 [0095.213] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445a0 | out: hHeap=0xd20000) returned 1 [0095.213] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3f33e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3f33e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1293b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_lt-lt.htm", cAlternateFileName="EULA_L~1.HTM")) returned 1 [0095.213] lstrcmpiW (lpString1="EULA_lt-lt.htm", lpString2=".") returned 1 [0095.213] lstrcmpiW (lpString1="EULA_lt-lt.htm", lpString2="..") returned 1 [0095.213] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_lt-lt.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" [0095.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_lt-lt.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0095.213] GetProcessHeap () returned 0xd20000 [0095.213] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd444e0 [0095.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_lt-lt.htm", cchWideChar=-1, lpMultiByteStr=0xd444e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_lt-lt.htm", lpUsedDefaultChar=0x0) returned 15 [0095.213] lstrlenA (lpString="EULA_lt-lt.htm") returned 14 [0095.213] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0095.213] lstrlenA (lpString="EULA_lt-lt.htm") returned 14 [0095.213] lstrlenA (lpString=".dll") returned 4 [0095.213] lstrlenA (lpString=".dll") returned 4 [0095.213] lstrlenA (lpString="EULA_lt-lt.htm") returned 14 [0095.214] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0095.214] lstrlenA (lpString="EULA_lt-lt.htm") returned 14 [0095.214] lstrlenA (lpString=".ini") returned 4 [0095.214] lstrlenA (lpString=".ini") returned 4 [0095.214] lstrlenA (lpString="EULA_lt-lt.htm") returned 14 [0095.214] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0095.214] lstrlenA (lpString="EULA_lt-lt.htm") returned 14 [0095.214] lstrlenA (lpString=".inc") returned 4 [0095.214] lstrlenA (lpString=".inc") returned 4 [0095.214] lstrlenA (lpString="EULA_lt-lt.htm") returned 14 [0095.214] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0095.214] lstrcmpiW (lpString1="EULA_lt-lt.htm", lpString2="HOW_RECOVER.html") returned -1 [0095.214] lstrcmpiW (lpString1="EULA_lt-lt.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0095.214] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0095.214] lstrcmpiW (lpString1="EULA_lt-lt.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0095.214] GetProcessHeap () returned 0xd20000 [0095.214] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd428a0 [0095.214] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0095.215] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=76091) returned 1 [0095.215] GetProcessHeap () returned 0xd20000 [0095.215] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bda0 [0095.215] GetProcessHeap () returned 0xd20000 [0095.215] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0095.215] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm") returned 52 [0095.215] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0095.215] GetProcessHeap () returned 0xd20000 [0095.215] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0095.215] GetProcessHeap () returned 0xd20000 [0095.216] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4dc60 [0095.216] lstrlenA (lpString="rsa_encrypt") returned 11 [0095.216] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0095.218] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0095.218] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0095.218] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0095.218] GetProcessHeap () returned 0xd20000 [0095.218] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0095.218] lstrlenA (lpString="010001") returned 6 [0095.218] GetProcessHeap () returned 0xd20000 [0095.218] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc98 [0095.218] GetProcessHeap () returned 0xd20000 [0095.219] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0095.219] GetProcessHeap () returned 0xd20000 [0095.219] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b2d8 [0095.219] GetProcessHeap () returned 0xd20000 [0095.219] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0095.219] GetProcessHeap () returned 0xd20000 [0095.219] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aaf8 [0095.219] GetProcessHeap () returned 0xd20000 [0095.219] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44b50 [0095.219] GetProcessHeap () returned 0xd20000 [0095.219] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc38 [0095.219] GetProcessHeap () returned 0xd20000 [0095.219] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0095.219] GetProcessHeap () returned 0xd20000 [0095.219] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.219] GetProcessHeap () returned 0xd20000 [0095.219] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0095.220] GetProcessHeap () returned 0xd20000 [0095.220] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0095.220] GetProcessHeap () returned 0xd20000 [0095.220] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44808 [0095.220] GetProcessHeap () returned 0xd20000 [0095.220] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.220] GetProcessHeap () returned 0xd20000 [0095.220] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446d8 [0095.220] GetProcessHeap () returned 0xd20000 [0095.220] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ad38 [0095.220] GetProcessHeap () returned 0xd20000 [0095.220] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0095.220] GetProcessHeap () returned 0xd20000 [0095.220] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0095.220] GetProcessHeap () returned 0xd20000 [0095.220] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ad38 | out: hHeap=0xd20000) returned 1 [0095.220] GetProcessHeap () returned 0xd20000 [0095.220] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.220] GetProcessHeap () returned 0xd20000 [0095.220] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445d0 [0095.220] GetProcessHeap () returned 0xd20000 [0095.220] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.221] GetProcessHeap () returned 0xd20000 [0095.221] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.221] GetProcessHeap () returned 0xd20000 [0095.221] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.221] GetProcessHeap () returned 0xd20000 [0095.221] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.221] GetProcessHeap () returned 0xd20000 [0095.221] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.221] GetProcessHeap () returned 0xd20000 [0095.221] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.221] GetProcessHeap () returned 0xd20000 [0095.221] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b368 [0095.221] GetProcessHeap () returned 0xd20000 [0095.221] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445d0 | out: hHeap=0xd20000) returned 1 [0095.221] GetProcessHeap () returned 0xd20000 [0095.221] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0095.221] GetProcessHeap () returned 0xd20000 [0095.221] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b368 | out: hHeap=0xd20000) returned 1 [0095.221] GetProcessHeap () returned 0xd20000 [0095.221] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.221] GetProcessHeap () returned 0xd20000 [0095.221] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.222] GetProcessHeap () returned 0xd20000 [0095.222] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.222] GetProcessHeap () returned 0xd20000 [0095.222] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.222] GetProcessHeap () returned 0xd20000 [0095.222] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.222] GetProcessHeap () returned 0xd20000 [0095.222] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.222] GetProcessHeap () returned 0xd20000 [0095.222] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.222] GetProcessHeap () returned 0xd20000 [0095.222] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.222] GetProcessHeap () returned 0xd20000 [0095.222] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.222] GetProcessHeap () returned 0xd20000 [0095.222] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.222] GetProcessHeap () returned 0xd20000 [0095.222] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0095.222] GetProcessHeap () returned 0xd20000 [0095.222] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0095.222] GetProcessHeap () returned 0xd20000 [0095.223] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.223] GetProcessHeap () returned 0xd20000 [0095.223] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.223] GetProcessHeap () returned 0xd20000 [0095.223] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.223] GetProcessHeap () returned 0xd20000 [0095.223] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.223] GetProcessHeap () returned 0xd20000 [0095.223] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.223] GetProcessHeap () returned 0xd20000 [0095.223] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.223] GetProcessHeap () returned 0xd20000 [0095.223] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.223] GetProcessHeap () returned 0xd20000 [0095.223] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.223] GetProcessHeap () returned 0xd20000 [0095.223] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.223] GetProcessHeap () returned 0xd20000 [0095.223] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.223] GetProcessHeap () returned 0xd20000 [0095.224] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.224] GetProcessHeap () returned 0xd20000 [0095.224] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.224] GetProcessHeap () returned 0xd20000 [0095.224] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.224] GetProcessHeap () returned 0xd20000 [0095.224] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.224] GetProcessHeap () returned 0xd20000 [0095.224] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.224] GetProcessHeap () returned 0xd20000 [0095.224] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.224] GetProcessHeap () returned 0xd20000 [0095.224] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.224] GetProcessHeap () returned 0xd20000 [0095.224] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.224] GetProcessHeap () returned 0xd20000 [0095.224] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.224] GetProcessHeap () returned 0xd20000 [0095.224] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.224] GetProcessHeap () returned 0xd20000 [0095.224] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.225] GetProcessHeap () returned 0xd20000 [0095.225] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.225] GetProcessHeap () returned 0xd20000 [0095.225] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.225] GetProcessHeap () returned 0xd20000 [0095.225] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.225] GetProcessHeap () returned 0xd20000 [0095.225] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.225] GetProcessHeap () returned 0xd20000 [0095.225] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.225] GetProcessHeap () returned 0xd20000 [0095.225] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.225] GetProcessHeap () returned 0xd20000 [0095.225] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.225] GetProcessHeap () returned 0xd20000 [0095.225] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.225] GetProcessHeap () returned 0xd20000 [0095.225] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.225] GetProcessHeap () returned 0xd20000 [0095.225] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.225] GetProcessHeap () returned 0xd20000 [0095.225] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.226] GetProcessHeap () returned 0xd20000 [0095.226] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.226] GetProcessHeap () returned 0xd20000 [0095.226] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.226] GetProcessHeap () returned 0xd20000 [0095.226] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.226] GetProcessHeap () returned 0xd20000 [0095.226] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.226] GetProcessHeap () returned 0xd20000 [0095.226] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.226] GetProcessHeap () returned 0xd20000 [0095.226] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.226] GetProcessHeap () returned 0xd20000 [0095.226] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.226] GetProcessHeap () returned 0xd20000 [0095.226] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.226] GetProcessHeap () returned 0xd20000 [0095.226] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.226] GetProcessHeap () returned 0xd20000 [0095.226] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.226] GetProcessHeap () returned 0xd20000 [0095.226] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.227] GetProcessHeap () returned 0xd20000 [0095.227] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.227] GetProcessHeap () returned 0xd20000 [0095.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.227] GetProcessHeap () returned 0xd20000 [0095.227] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.227] GetProcessHeap () returned 0xd20000 [0095.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.227] GetProcessHeap () returned 0xd20000 [0095.227] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.227] GetProcessHeap () returned 0xd20000 [0095.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.227] GetProcessHeap () returned 0xd20000 [0095.227] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.227] GetProcessHeap () returned 0xd20000 [0095.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.227] GetProcessHeap () returned 0xd20000 [0095.227] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.227] GetProcessHeap () returned 0xd20000 [0095.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.228] GetProcessHeap () returned 0xd20000 [0095.228] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.228] GetProcessHeap () returned 0xd20000 [0095.228] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.228] GetProcessHeap () returned 0xd20000 [0095.228] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.228] GetProcessHeap () returned 0xd20000 [0095.228] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.228] GetProcessHeap () returned 0xd20000 [0095.228] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.228] GetProcessHeap () returned 0xd20000 [0095.228] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.228] GetProcessHeap () returned 0xd20000 [0095.228] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.228] GetProcessHeap () returned 0xd20000 [0095.228] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.228] GetProcessHeap () returned 0xd20000 [0095.228] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.228] GetProcessHeap () returned 0xd20000 [0095.228] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.228] GetProcessHeap () returned 0xd20000 [0095.229] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.229] GetProcessHeap () returned 0xd20000 [0095.229] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.229] GetProcessHeap () returned 0xd20000 [0095.229] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.229] GetProcessHeap () returned 0xd20000 [0095.229] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.229] GetProcessHeap () returned 0xd20000 [0095.229] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.229] GetProcessHeap () returned 0xd20000 [0095.229] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.229] GetProcessHeap () returned 0xd20000 [0095.229] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.229] GetProcessHeap () returned 0xd20000 [0095.229] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.229] GetProcessHeap () returned 0xd20000 [0095.229] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.229] GetProcessHeap () returned 0xd20000 [0095.229] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.229] GetProcessHeap () returned 0xd20000 [0095.229] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.229] GetProcessHeap () returned 0xd20000 [0095.230] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.230] GetProcessHeap () returned 0xd20000 [0095.230] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.230] GetProcessHeap () returned 0xd20000 [0095.230] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.230] GetProcessHeap () returned 0xd20000 [0095.230] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.230] GetProcessHeap () returned 0xd20000 [0095.230] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.230] GetProcessHeap () returned 0xd20000 [0095.230] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.230] GetProcessHeap () returned 0xd20000 [0095.230] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.230] GetProcessHeap () returned 0xd20000 [0095.230] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.230] GetProcessHeap () returned 0xd20000 [0095.230] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.230] GetProcessHeap () returned 0xd20000 [0095.230] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.231] GetProcessHeap () returned 0xd20000 [0095.231] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.231] GetProcessHeap () returned 0xd20000 [0095.231] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.231] GetProcessHeap () returned 0xd20000 [0095.231] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.231] GetProcessHeap () returned 0xd20000 [0095.231] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.231] GetProcessHeap () returned 0xd20000 [0095.231] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.231] GetProcessHeap () returned 0xd20000 [0095.231] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.231] GetProcessHeap () returned 0xd20000 [0095.231] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.231] GetProcessHeap () returned 0xd20000 [0095.231] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.231] GetProcessHeap () returned 0xd20000 [0095.231] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.231] GetProcessHeap () returned 0xd20000 [0095.232] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.232] GetProcessHeap () returned 0xd20000 [0095.232] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.232] GetProcessHeap () returned 0xd20000 [0095.232] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.232] GetProcessHeap () returned 0xd20000 [0095.232] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.232] GetProcessHeap () returned 0xd20000 [0095.232] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.232] GetProcessHeap () returned 0xd20000 [0095.232] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.232] GetProcessHeap () returned 0xd20000 [0095.232] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.232] GetProcessHeap () returned 0xd20000 [0095.232] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.232] GetProcessHeap () returned 0xd20000 [0095.232] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.232] GetProcessHeap () returned 0xd20000 [0095.232] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.232] GetProcessHeap () returned 0xd20000 [0095.232] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.233] GetProcessHeap () returned 0xd20000 [0095.233] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.233] GetProcessHeap () returned 0xd20000 [0095.233] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.233] GetProcessHeap () returned 0xd20000 [0095.233] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.233] GetProcessHeap () returned 0xd20000 [0095.233] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.233] GetProcessHeap () returned 0xd20000 [0095.233] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.233] GetProcessHeap () returned 0xd20000 [0095.233] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.233] GetProcessHeap () returned 0xd20000 [0095.233] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.233] GetProcessHeap () returned 0xd20000 [0095.233] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.233] GetProcessHeap () returned 0xd20000 [0095.233] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.233] GetProcessHeap () returned 0xd20000 [0095.233] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.233] GetProcessHeap () returned 0xd20000 [0095.233] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.234] GetProcessHeap () returned 0xd20000 [0095.234] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.234] GetProcessHeap () returned 0xd20000 [0095.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.234] GetProcessHeap () returned 0xd20000 [0095.234] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.234] GetProcessHeap () returned 0xd20000 [0095.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.234] GetProcessHeap () returned 0xd20000 [0095.234] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.234] GetProcessHeap () returned 0xd20000 [0095.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.234] GetProcessHeap () returned 0xd20000 [0095.234] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.234] GetProcessHeap () returned 0xd20000 [0095.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.234] GetProcessHeap () returned 0xd20000 [0095.234] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.234] GetProcessHeap () returned 0xd20000 [0095.235] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.235] GetProcessHeap () returned 0xd20000 [0095.235] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.235] GetProcessHeap () returned 0xd20000 [0095.235] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.235] GetProcessHeap () returned 0xd20000 [0095.235] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.235] GetProcessHeap () returned 0xd20000 [0095.235] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.235] GetProcessHeap () returned 0xd20000 [0095.235] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.236] GetProcessHeap () returned 0xd20000 [0095.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.236] GetProcessHeap () returned 0xd20000 [0095.236] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.236] GetProcessHeap () returned 0xd20000 [0095.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.236] GetProcessHeap () returned 0xd20000 [0095.236] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.236] GetProcessHeap () returned 0xd20000 [0095.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.236] GetProcessHeap () returned 0xd20000 [0095.236] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.236] GetProcessHeap () returned 0xd20000 [0095.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.236] GetProcessHeap () returned 0xd20000 [0095.236] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.236] GetProcessHeap () returned 0xd20000 [0095.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.236] GetProcessHeap () returned 0xd20000 [0095.236] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.236] GetProcessHeap () returned 0xd20000 [0095.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.237] GetProcessHeap () returned 0xd20000 [0095.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.237] GetProcessHeap () returned 0xd20000 [0095.237] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.237] GetProcessHeap () returned 0xd20000 [0095.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.237] GetProcessHeap () returned 0xd20000 [0095.237] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.237] GetProcessHeap () returned 0xd20000 [0095.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.237] GetProcessHeap () returned 0xd20000 [0095.237] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.237] GetProcessHeap () returned 0xd20000 [0095.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.237] GetProcessHeap () returned 0xd20000 [0095.237] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.237] GetProcessHeap () returned 0xd20000 [0095.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.237] GetProcessHeap () returned 0xd20000 [0095.237] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.237] GetProcessHeap () returned 0xd20000 [0095.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.237] GetProcessHeap () returned 0xd20000 [0095.238] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.238] GetProcessHeap () returned 0xd20000 [0095.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.238] GetProcessHeap () returned 0xd20000 [0095.238] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.238] GetProcessHeap () returned 0xd20000 [0095.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.238] GetProcessHeap () returned 0xd20000 [0095.238] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0095.238] GetProcessHeap () returned 0xd20000 [0095.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0095.238] GetProcessHeap () returned 0xd20000 [0095.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0095.238] GetProcessHeap () returned 0xd20000 [0095.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0095.238] GetProcessHeap () returned 0xd20000 [0095.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0095.238] GetProcessHeap () returned 0xd20000 [0095.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0095.238] GetProcessHeap () returned 0xd20000 [0095.238] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446d8 | out: hHeap=0xd20000) returned 1 [0095.238] GetProcessHeap () returned 0xd20000 [0095.239] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aaf8 | out: hHeap=0xd20000) returned 1 [0095.239] GetProcessHeap () returned 0xd20000 [0095.239] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0095.239] GetProcessHeap () returned 0xd20000 [0095.239] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b2d8 | out: hHeap=0xd20000) returned 1 [0095.239] GetProcessHeap () returned 0xd20000 [0095.239] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0095.239] GetProcessHeap () returned 0xd20000 [0095.239] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.239] GetProcessHeap () returned 0xd20000 [0095.239] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0095.239] WriteFile (in: hFile=0x230, lpBuffer=0xd4dc60*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4dc60*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0095.245] GetProcessHeap () returned 0xd20000 [0095.245] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4dc60, Size=0x30) returned 0xd4dc60 [0095.245] GetProcessHeap () returned 0xd20000 [0095.245] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0095.245] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0095.245] GetProcessHeap () returned 0xd20000 [0095.245] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1293b) returned 0xd4dc98 [0095.245] ReadFile (in: hFile=0x230, lpBuffer=0xd4dc98, nNumberOfBytesToRead=0x1293b, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4dc98*, lpNumberOfBytesRead=0x299d7e8*=0x1293b, lpOverlapped=0x0) returned 1 [0095.247] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0095.247] WriteFile (in: hFile=0x230, lpBuffer=0xd4dc98*, nNumberOfBytesToWrite=0x1293b, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4dc98*, lpNumberOfBytesWritten=0x299d7e4*=0x1293b, lpOverlapped=0x0) returned 1 [0095.252] GetProcessHeap () returned 0xd20000 [0095.252] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4dc98 | out: hHeap=0xd20000) returned 1 [0095.252] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0095.252] WriteFile (in: hFile=0x230, lpBuffer=0xd4dc60*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4dc60*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0095.253] CloseHandle (hObject=0x230) returned 1 [0095.257] GetProcessHeap () returned 0xd20000 [0095.257] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd428a0 | out: hHeap=0xd20000) returned 1 [0095.257] GetProcessHeap () returned 0xd20000 [0095.257] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bda0 | out: hHeap=0xd20000) returned 1 [0095.257] GetProcessHeap () returned 0xd20000 [0095.257] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0095.257] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" [0095.257] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm.[ponce.lorena@aol.com]" [0095.257] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lt-lt.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0095.258] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lt-lt.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0095.258] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0095.258] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0095.258] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0095.258] GetProcessHeap () returned 0xd20000 [0095.258] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444e0 | out: hHeap=0xd20000) returned 1 [0095.258] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3f5af3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3f5af3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x147c5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_lv-lv.htm", cAlternateFileName="EULA_L~2.HTM")) returned 1 [0095.259] lstrcmpiW (lpString1="EULA_lv-lv.htm", lpString2=".") returned 1 [0095.259] lstrcmpiW (lpString1="EULA_lv-lv.htm", lpString2="..") returned 1 [0095.259] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_lv-lv.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" [0095.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_lv-lv.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0095.259] GetProcessHeap () returned 0xd20000 [0095.259] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd44528 [0095.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_lv-lv.htm", cchWideChar=-1, lpMultiByteStr=0xd44528, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_lv-lv.htm", lpUsedDefaultChar=0x0) returned 15 [0095.259] lstrlenA (lpString="EULA_lv-lv.htm") returned 14 [0095.259] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0095.259] lstrlenA (lpString="EULA_lv-lv.htm") returned 14 [0095.259] lstrlenA (lpString=".dll") returned 4 [0095.259] lstrlenA (lpString=".dll") returned 4 [0095.259] lstrlenA (lpString="EULA_lv-lv.htm") returned 14 [0095.259] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0095.259] lstrlenA (lpString="EULA_lv-lv.htm") returned 14 [0095.259] lstrlenA (lpString=".ini") returned 4 [0095.259] lstrlenA (lpString=".ini") returned 4 [0095.259] lstrlenA (lpString="EULA_lv-lv.htm") returned 14 [0095.259] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0095.260] lstrlenA (lpString="EULA_lv-lv.htm") returned 14 [0095.260] lstrlenA (lpString=".inc") returned 4 [0095.260] lstrlenA (lpString=".inc") returned 4 [0095.260] lstrlenA (lpString="EULA_lv-lv.htm") returned 14 [0095.260] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0095.260] lstrcmpiW (lpString1="EULA_lv-lv.htm", lpString2="HOW_RECOVER.html") returned -1 [0095.260] lstrcmpiW (lpString1="EULA_lv-lv.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0095.260] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0095.260] lstrcmpiW (lpString1="EULA_lv-lv.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0095.260] GetProcessHeap () returned 0xd20000 [0095.260] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42490 [0095.260] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0095.261] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=83909) returned 1 [0095.261] GetProcessHeap () returned 0xd20000 [0095.261] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bcb0 [0095.261] GetProcessHeap () returned 0xd20000 [0095.261] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0095.261] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm") returned 52 [0095.261] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0095.261] GetProcessHeap () returned 0xd20000 [0095.261] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0095.261] GetProcessHeap () returned 0xd20000 [0095.261] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x38b) returned 0xd4dc98 [0095.261] lstrlenA (lpString="rsa_encrypt") returned 11 [0095.261] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0095.264] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0095.264] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0095.264] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0095.264] GetProcessHeap () returned 0xd20000 [0095.265] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0095.265] lstrlenA (lpString="010001") returned 6 [0095.265] GetProcessHeap () returned 0xd20000 [0095.265] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cbc8 [0095.265] GetProcessHeap () returned 0xd20000 [0095.265] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0095.265] GetProcessHeap () returned 0xd20000 [0095.265] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4af78 [0095.265] GetProcessHeap () returned 0xd20000 [0095.265] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0095.265] GetProcessHeap () returned 0xd20000 [0095.265] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b008 [0095.265] GetProcessHeap () returned 0xd20000 [0095.265] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd450c8 [0095.265] GetProcessHeap () returned 0xd20000 [0095.265] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc08 [0095.265] GetProcessHeap () returned 0xd20000 [0095.265] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0095.265] GetProcessHeap () returned 0xd20000 [0095.265] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.265] GetProcessHeap () returned 0xd20000 [0095.266] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0095.266] GetProcessHeap () returned 0xd20000 [0095.266] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0095.266] GetProcessHeap () returned 0xd20000 [0095.266] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44c68 [0095.266] GetProcessHeap () returned 0xd20000 [0095.266] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.266] GetProcessHeap () returned 0xd20000 [0095.266] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44540 [0095.266] GetProcessHeap () returned 0xd20000 [0095.266] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aa68 [0095.266] GetProcessHeap () returned 0xd20000 [0095.266] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0095.267] GetProcessHeap () returned 0xd20000 [0095.267] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0095.267] GetProcessHeap () returned 0xd20000 [0095.267] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aa68 | out: hHeap=0xd20000) returned 1 [0095.267] GetProcessHeap () returned 0xd20000 [0095.267] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.267] GetProcessHeap () returned 0xd20000 [0095.267] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44558 [0095.267] GetProcessHeap () returned 0xd20000 [0095.267] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.267] GetProcessHeap () returned 0xd20000 [0095.267] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.267] GetProcessHeap () returned 0xd20000 [0095.267] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.267] GetProcessHeap () returned 0xd20000 [0095.267] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.267] GetProcessHeap () returned 0xd20000 [0095.267] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.267] GetProcessHeap () returned 0xd20000 [0095.267] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.267] GetProcessHeap () returned 0xd20000 [0095.268] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b2d8 [0095.268] GetProcessHeap () returned 0xd20000 [0095.268] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44558 | out: hHeap=0xd20000) returned 1 [0095.268] GetProcessHeap () returned 0xd20000 [0095.268] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0095.268] GetProcessHeap () returned 0xd20000 [0095.268] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b2d8 | out: hHeap=0xd20000) returned 1 [0095.268] GetProcessHeap () returned 0xd20000 [0095.268] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.268] GetProcessHeap () returned 0xd20000 [0095.268] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.268] GetProcessHeap () returned 0xd20000 [0095.268] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.268] GetProcessHeap () returned 0xd20000 [0095.268] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.268] GetProcessHeap () returned 0xd20000 [0095.268] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.268] GetProcessHeap () returned 0xd20000 [0095.268] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.268] GetProcessHeap () returned 0xd20000 [0095.268] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.268] GetProcessHeap () returned 0xd20000 [0095.269] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.269] GetProcessHeap () returned 0xd20000 [0095.269] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.269] GetProcessHeap () returned 0xd20000 [0095.269] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.269] GetProcessHeap () returned 0xd20000 [0095.269] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.269] GetProcessHeap () returned 0xd20000 [0095.269] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.269] GetProcessHeap () returned 0xd20000 [0095.269] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0095.269] GetProcessHeap () returned 0xd20000 [0095.269] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0095.269] GetProcessHeap () returned 0xd20000 [0095.269] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.269] GetProcessHeap () returned 0xd20000 [0095.269] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.269] GetProcessHeap () returned 0xd20000 [0095.269] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.269] GetProcessHeap () returned 0xd20000 [0095.269] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.270] GetProcessHeap () returned 0xd20000 [0095.270] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.270] GetProcessHeap () returned 0xd20000 [0095.270] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.270] GetProcessHeap () returned 0xd20000 [0095.270] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0095.270] GetProcessHeap () returned 0xd20000 [0095.270] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0095.270] GetProcessHeap () returned 0xd20000 [0095.270] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.270] GetProcessHeap () returned 0xd20000 [0095.270] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.270] GetProcessHeap () returned 0xd20000 [0095.270] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.270] GetProcessHeap () returned 0xd20000 [0095.270] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.270] GetProcessHeap () returned 0xd20000 [0095.270] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.270] GetProcessHeap () returned 0xd20000 [0095.270] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.270] GetProcessHeap () returned 0xd20000 [0095.270] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.271] GetProcessHeap () returned 0xd20000 [0095.271] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.271] GetProcessHeap () returned 0xd20000 [0095.271] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.271] GetProcessHeap () returned 0xd20000 [0095.271] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.271] GetProcessHeap () returned 0xd20000 [0095.271] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.271] GetProcessHeap () returned 0xd20000 [0095.271] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.271] GetProcessHeap () returned 0xd20000 [0095.271] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.271] GetProcessHeap () returned 0xd20000 [0095.271] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.271] GetProcessHeap () returned 0xd20000 [0095.271] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.271] GetProcessHeap () returned 0xd20000 [0095.271] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.271] GetProcessHeap () returned 0xd20000 [0095.271] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.271] GetProcessHeap () returned 0xd20000 [0095.272] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.272] GetProcessHeap () returned 0xd20000 [0095.272] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.272] GetProcessHeap () returned 0xd20000 [0095.272] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.272] GetProcessHeap () returned 0xd20000 [0095.272] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.272] GetProcessHeap () returned 0xd20000 [0095.272] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.272] GetProcessHeap () returned 0xd20000 [0095.272] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.272] GetProcessHeap () returned 0xd20000 [0095.272] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.272] GetProcessHeap () returned 0xd20000 [0095.272] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.272] GetProcessHeap () returned 0xd20000 [0095.272] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.272] GetProcessHeap () returned 0xd20000 [0095.272] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.272] GetProcessHeap () returned 0xd20000 [0095.273] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.273] GetProcessHeap () returned 0xd20000 [0095.273] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.273] GetProcessHeap () returned 0xd20000 [0095.273] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.273] GetProcessHeap () returned 0xd20000 [0095.273] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.273] GetProcessHeap () returned 0xd20000 [0095.273] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.273] GetProcessHeap () returned 0xd20000 [0095.273] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.273] GetProcessHeap () returned 0xd20000 [0095.273] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.273] GetProcessHeap () returned 0xd20000 [0095.273] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.273] GetProcessHeap () returned 0xd20000 [0095.273] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.273] GetProcessHeap () returned 0xd20000 [0095.273] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.273] GetProcessHeap () returned 0xd20000 [0095.273] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.274] GetProcessHeap () returned 0xd20000 [0095.274] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.274] GetProcessHeap () returned 0xd20000 [0095.274] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.274] GetProcessHeap () returned 0xd20000 [0095.274] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.274] GetProcessHeap () returned 0xd20000 [0095.274] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.274] GetProcessHeap () returned 0xd20000 [0095.274] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.274] GetProcessHeap () returned 0xd20000 [0095.274] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.274] GetProcessHeap () returned 0xd20000 [0095.274] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.274] GetProcessHeap () returned 0xd20000 [0095.274] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.274] GetProcessHeap () returned 0xd20000 [0095.274] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.274] GetProcessHeap () returned 0xd20000 [0095.275] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.275] GetProcessHeap () returned 0xd20000 [0095.275] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.275] GetProcessHeap () returned 0xd20000 [0095.275] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.275] GetProcessHeap () returned 0xd20000 [0095.275] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.275] GetProcessHeap () returned 0xd20000 [0095.275] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.275] GetProcessHeap () returned 0xd20000 [0095.275] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.275] GetProcessHeap () returned 0xd20000 [0095.275] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.275] GetProcessHeap () returned 0xd20000 [0095.275] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.275] GetProcessHeap () returned 0xd20000 [0095.275] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.275] GetProcessHeap () returned 0xd20000 [0095.275] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.275] GetProcessHeap () returned 0xd20000 [0095.275] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.276] GetProcessHeap () returned 0xd20000 [0095.276] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.276] GetProcessHeap () returned 0xd20000 [0095.276] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.276] GetProcessHeap () returned 0xd20000 [0095.276] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.276] GetProcessHeap () returned 0xd20000 [0095.276] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.276] GetProcessHeap () returned 0xd20000 [0095.276] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.276] GetProcessHeap () returned 0xd20000 [0095.276] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.276] GetProcessHeap () returned 0xd20000 [0095.276] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.276] GetProcessHeap () returned 0xd20000 [0095.276] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.276] GetProcessHeap () returned 0xd20000 [0095.276] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.276] GetProcessHeap () returned 0xd20000 [0095.276] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.277] GetProcessHeap () returned 0xd20000 [0095.277] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.277] GetProcessHeap () returned 0xd20000 [0095.277] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.277] GetProcessHeap () returned 0xd20000 [0095.277] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.277] GetProcessHeap () returned 0xd20000 [0095.277] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.277] GetProcessHeap () returned 0xd20000 [0095.277] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.277] GetProcessHeap () returned 0xd20000 [0095.277] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.277] GetProcessHeap () returned 0xd20000 [0095.277] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.277] GetProcessHeap () returned 0xd20000 [0095.277] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.277] GetProcessHeap () returned 0xd20000 [0095.277] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.277] GetProcessHeap () returned 0xd20000 [0095.277] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.278] GetProcessHeap () returned 0xd20000 [0095.278] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.278] GetProcessHeap () returned 0xd20000 [0095.278] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.278] GetProcessHeap () returned 0xd20000 [0095.278] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.278] GetProcessHeap () returned 0xd20000 [0095.278] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.278] GetProcessHeap () returned 0xd20000 [0095.278] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.278] GetProcessHeap () returned 0xd20000 [0095.278] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.278] GetProcessHeap () returned 0xd20000 [0095.278] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.278] GetProcessHeap () returned 0xd20000 [0095.278] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.278] GetProcessHeap () returned 0xd20000 [0095.278] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.278] GetProcessHeap () returned 0xd20000 [0095.278] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.278] GetProcessHeap () returned 0xd20000 [0095.279] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.279] GetProcessHeap () returned 0xd20000 [0095.279] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.279] GetProcessHeap () returned 0xd20000 [0095.279] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.279] GetProcessHeap () returned 0xd20000 [0095.279] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.279] GetProcessHeap () returned 0xd20000 [0095.279] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.279] GetProcessHeap () returned 0xd20000 [0095.279] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.279] GetProcessHeap () returned 0xd20000 [0095.279] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.279] GetProcessHeap () returned 0xd20000 [0095.279] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.279] GetProcessHeap () returned 0xd20000 [0095.279] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0095.279] GetProcessHeap () returned 0xd20000 [0095.279] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0095.279] GetProcessHeap () returned 0xd20000 [0095.279] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.279] GetProcessHeap () returned 0xd20000 [0095.279] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.280] GetProcessHeap () returned 0xd20000 [0095.280] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.280] GetProcessHeap () returned 0xd20000 [0095.280] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.280] GetProcessHeap () returned 0xd20000 [0095.280] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.280] GetProcessHeap () returned 0xd20000 [0095.280] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.280] GetProcessHeap () returned 0xd20000 [0095.280] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.280] GetProcessHeap () returned 0xd20000 [0095.280] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.280] GetProcessHeap () returned 0xd20000 [0095.280] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.280] GetProcessHeap () returned 0xd20000 [0095.280] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.280] GetProcessHeap () returned 0xd20000 [0095.280] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.280] GetProcessHeap () returned 0xd20000 [0095.280] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.280] GetProcessHeap () returned 0xd20000 [0095.280] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0095.280] GetProcessHeap () returned 0xd20000 [0095.281] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0095.281] GetProcessHeap () returned 0xd20000 [0095.281] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0095.281] GetProcessHeap () returned 0xd20000 [0095.281] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0095.281] GetProcessHeap () returned 0xd20000 [0095.281] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.281] GetProcessHeap () returned 0xd20000 [0095.281] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.281] GetProcessHeap () returned 0xd20000 [0095.281] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0095.281] GetProcessHeap () returned 0xd20000 [0095.281] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0095.281] GetProcessHeap () returned 0xd20000 [0095.281] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.281] GetProcessHeap () returned 0xd20000 [0095.281] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.282] GetProcessHeap () returned 0xd20000 [0095.282] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.282] GetProcessHeap () returned 0xd20000 [0095.282] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.282] GetProcessHeap () returned 0xd20000 [0095.282] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.282] GetProcessHeap () returned 0xd20000 [0095.282] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.282] GetProcessHeap () returned 0xd20000 [0095.282] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.282] GetProcessHeap () returned 0xd20000 [0095.282] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.282] GetProcessHeap () returned 0xd20000 [0095.282] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.282] GetProcessHeap () returned 0xd20000 [0095.282] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.282] GetProcessHeap () returned 0xd20000 [0095.282] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0095.282] GetProcessHeap () returned 0xd20000 [0095.282] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0095.282] GetProcessHeap () returned 0xd20000 [0095.283] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.283] GetProcessHeap () returned 0xd20000 [0095.283] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.283] GetProcessHeap () returned 0xd20000 [0095.283] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.283] GetProcessHeap () returned 0xd20000 [0095.283] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.283] GetProcessHeap () returned 0xd20000 [0095.283] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.283] GetProcessHeap () returned 0xd20000 [0095.283] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.283] GetProcessHeap () returned 0xd20000 [0095.283] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.283] GetProcessHeap () returned 0xd20000 [0095.283] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.283] GetProcessHeap () returned 0xd20000 [0095.283] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.283] GetProcessHeap () returned 0xd20000 [0095.283] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.283] GetProcessHeap () returned 0xd20000 [0095.284] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.284] GetProcessHeap () returned 0xd20000 [0095.284] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.284] GetProcessHeap () returned 0xd20000 [0095.284] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.284] GetProcessHeap () returned 0xd20000 [0095.284] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.284] GetProcessHeap () returned 0xd20000 [0095.284] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.284] GetProcessHeap () returned 0xd20000 [0095.284] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.284] GetProcessHeap () returned 0xd20000 [0095.284] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.284] GetProcessHeap () returned 0xd20000 [0095.284] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.284] GetProcessHeap () returned 0xd20000 [0095.284] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0095.284] GetProcessHeap () returned 0xd20000 [0095.284] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0095.284] GetProcessHeap () returned 0xd20000 [0095.284] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0095.284] GetProcessHeap () returned 0xd20000 [0095.284] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0095.284] GetProcessHeap () returned 0xd20000 [0095.285] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44540 | out: hHeap=0xd20000) returned 1 [0095.285] GetProcessHeap () returned 0xd20000 [0095.285] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b008 | out: hHeap=0xd20000) returned 1 [0095.285] GetProcessHeap () returned 0xd20000 [0095.285] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0095.285] GetProcessHeap () returned 0xd20000 [0095.285] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4af78 | out: hHeap=0xd20000) returned 1 [0095.285] GetProcessHeap () returned 0xd20000 [0095.285] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0095.285] GetProcessHeap () returned 0xd20000 [0095.285] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.285] GetProcessHeap () returned 0xd20000 [0095.285] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0095.285] WriteFile (in: hFile=0x230, lpBuffer=0xd4dc98*, nNumberOfBytesToWrite=0x38b, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4dc98*, lpNumberOfBytesWritten=0x299d864*=0x38b, lpOverlapped=0x0) returned 1 [0095.290] GetProcessHeap () returned 0xd20000 [0095.290] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4dc98, Size=0x30) returned 0xd4dc98 [0095.290] GetProcessHeap () returned 0xd20000 [0095.290] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0095.290] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0095.290] GetProcessHeap () returned 0xd20000 [0095.290] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x147d0) returned 0xd4dcd0 [0095.290] ReadFile (in: hFile=0x230, lpBuffer=0xd4dcd0, nNumberOfBytesToRead=0x147d0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4dcd0*, lpNumberOfBytesRead=0x299d7e8*=0x147d0, lpOverlapped=0x0) returned 1 [0095.294] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0095.294] WriteFile (in: hFile=0x230, lpBuffer=0xd4dcd0*, nNumberOfBytesToWrite=0x147d0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4dcd0*, lpNumberOfBytesWritten=0x299d7e4*=0x147d0, lpOverlapped=0x0) returned 1 [0095.296] GetProcessHeap () returned 0xd20000 [0095.296] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4dcd0 | out: hHeap=0xd20000) returned 1 [0095.296] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0095.297] WriteFile (in: hFile=0x230, lpBuffer=0xd4dc98*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4dc98*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0095.298] CloseHandle (hObject=0x230) returned 1 [0095.301] GetProcessHeap () returned 0xd20000 [0095.301] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42490 | out: hHeap=0xd20000) returned 1 [0095.301] GetProcessHeap () returned 0xd20000 [0095.301] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bcb0 | out: hHeap=0xd20000) returned 1 [0095.301] GetProcessHeap () returned 0xd20000 [0095.302] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0095.302] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" [0095.302] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm.[ponce.lorena@aol.com]" [0095.302] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_lv-lv.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0095.303] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_lv-lv.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0095.303] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0095.303] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0095.303] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0095.303] GetProcessHeap () returned 0xd20000 [0095.303] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44528 | out: hHeap=0xd20000) returned 1 [0095.303] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3fa921, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3fa921, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10674, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_nb-no.htm", cAlternateFileName="EULA_N~1.HTM")) returned 1 [0095.303] lstrcmpiW (lpString1="EULA_nb-no.htm", lpString2=".") returned 1 [0095.303] lstrcmpiW (lpString1="EULA_nb-no.htm", lpString2="..") returned 1 [0095.303] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_nb-no.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" [0095.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_nb-no.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0095.303] GetProcessHeap () returned 0xd20000 [0095.303] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd444f8 [0095.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_nb-no.htm", cchWideChar=-1, lpMultiByteStr=0xd444f8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_nb-no.htm", lpUsedDefaultChar=0x0) returned 15 [0095.303] lstrlenA (lpString="EULA_nb-no.htm") returned 14 [0095.303] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0095.303] lstrlenA (lpString="EULA_nb-no.htm") returned 14 [0095.303] lstrlenA (lpString=".dll") returned 4 [0095.304] lstrlenA (lpString=".dll") returned 4 [0095.304] lstrlenA (lpString="EULA_nb-no.htm") returned 14 [0095.304] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0095.304] lstrlenA (lpString="EULA_nb-no.htm") returned 14 [0095.304] lstrlenA (lpString=".ini") returned 4 [0095.304] lstrlenA (lpString=".ini") returned 4 [0095.304] lstrlenA (lpString="EULA_nb-no.htm") returned 14 [0095.304] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0095.304] lstrlenA (lpString="EULA_nb-no.htm") returned 14 [0095.304] lstrlenA (lpString=".inc") returned 4 [0095.304] lstrlenA (lpString=".inc") returned 4 [0095.304] lstrlenA (lpString="EULA_nb-no.htm") returned 14 [0095.304] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0095.304] lstrcmpiW (lpString1="EULA_nb-no.htm", lpString2="HOW_RECOVER.html") returned -1 [0095.304] lstrcmpiW (lpString1="EULA_nb-no.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0095.304] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0095.304] lstrcmpiW (lpString1="EULA_nb-no.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0095.304] GetProcessHeap () returned 0xd20000 [0095.304] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd428a0 [0095.304] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0095.305] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=67188) returned 1 [0095.305] GetProcessHeap () returned 0xd20000 [0095.305] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bd28 [0095.305] GetProcessHeap () returned 0xd20000 [0095.305] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0095.305] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm") returned 52 [0095.305] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0095.305] GetProcessHeap () returned 0xd20000 [0095.305] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0095.305] GetProcessHeap () returned 0xd20000 [0095.305] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x38c) returned 0xd4dcd0 [0095.306] lstrlenA (lpString="rsa_encrypt") returned 11 [0095.306] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0095.307] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0095.307] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0095.307] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0095.307] GetProcessHeap () returned 0xd20000 [0095.307] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0095.307] lstrlenA (lpString="010001") returned 6 [0095.307] GetProcessHeap () returned 0xd20000 [0095.307] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc98 [0095.308] GetProcessHeap () returned 0xd20000 [0095.308] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0095.308] GetProcessHeap () returned 0xd20000 [0095.308] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b2d8 [0095.308] GetProcessHeap () returned 0xd20000 [0095.308] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0095.308] GetProcessHeap () returned 0xd20000 [0095.308] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b368 [0095.308] GetProcessHeap () returned 0xd20000 [0095.308] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd452f8 [0095.308] GetProcessHeap () returned 0xd20000 [0095.308] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0095.308] GetProcessHeap () returned 0xd20000 [0095.308] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0095.308] GetProcessHeap () returned 0xd20000 [0095.308] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.308] GetProcessHeap () returned 0xd20000 [0095.308] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0095.308] GetProcessHeap () returned 0xd20000 [0095.308] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0095.308] GetProcessHeap () returned 0xd20000 [0095.308] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44808 [0095.309] GetProcessHeap () returned 0xd20000 [0095.309] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.309] GetProcessHeap () returned 0xd20000 [0095.309] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44438 [0095.309] GetProcessHeap () returned 0xd20000 [0095.309] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0095.309] GetProcessHeap () returned 0xd20000 [0095.309] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0095.309] GetProcessHeap () returned 0xd20000 [0095.309] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0095.309] GetProcessHeap () returned 0xd20000 [0095.309] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0095.309] GetProcessHeap () returned 0xd20000 [0095.309] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.309] GetProcessHeap () returned 0xd20000 [0095.309] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44498 [0095.309] GetProcessHeap () returned 0xd20000 [0095.309] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.309] GetProcessHeap () returned 0xd20000 [0095.309] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.309] GetProcessHeap () returned 0xd20000 [0095.309] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.309] GetProcessHeap () returned 0xd20000 [0095.310] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.310] GetProcessHeap () returned 0xd20000 [0095.310] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.310] GetProcessHeap () returned 0xd20000 [0095.310] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.310] GetProcessHeap () returned 0xd20000 [0095.310] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b3f8 [0095.310] GetProcessHeap () returned 0xd20000 [0095.310] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44498 | out: hHeap=0xd20000) returned 1 [0095.310] GetProcessHeap () returned 0xd20000 [0095.310] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0095.310] GetProcessHeap () returned 0xd20000 [0095.310] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b3f8 | out: hHeap=0xd20000) returned 1 [0095.310] GetProcessHeap () returned 0xd20000 [0095.310] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.310] GetProcessHeap () returned 0xd20000 [0095.310] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.310] GetProcessHeap () returned 0xd20000 [0095.310] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.310] GetProcessHeap () returned 0xd20000 [0095.310] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.310] GetProcessHeap () returned 0xd20000 [0095.310] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.311] GetProcessHeap () returned 0xd20000 [0095.311] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.311] GetProcessHeap () returned 0xd20000 [0095.311] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.311] GetProcessHeap () returned 0xd20000 [0095.311] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.311] GetProcessHeap () returned 0xd20000 [0095.311] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.311] GetProcessHeap () returned 0xd20000 [0095.311] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.311] GetProcessHeap () returned 0xd20000 [0095.311] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.311] GetProcessHeap () returned 0xd20000 [0095.311] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.311] GetProcessHeap () returned 0xd20000 [0095.311] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.311] GetProcessHeap () returned 0xd20000 [0095.311] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.311] GetProcessHeap () returned 0xd20000 [0095.311] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.311] GetProcessHeap () returned 0xd20000 [0095.312] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.312] GetProcessHeap () returned 0xd20000 [0095.312] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.312] GetProcessHeap () returned 0xd20000 [0095.312] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.312] GetProcessHeap () returned 0xd20000 [0095.312] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.312] GetProcessHeap () returned 0xd20000 [0095.312] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.312] GetProcessHeap () returned 0xd20000 [0095.312] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.312] GetProcessHeap () returned 0xd20000 [0095.312] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.312] GetProcessHeap () returned 0xd20000 [0095.312] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.312] GetProcessHeap () returned 0xd20000 [0095.312] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.312] GetProcessHeap () returned 0xd20000 [0095.312] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.312] GetProcessHeap () returned 0xd20000 [0095.312] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.313] GetProcessHeap () returned 0xd20000 [0095.313] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.313] GetProcessHeap () returned 0xd20000 [0095.313] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.313] GetProcessHeap () returned 0xd20000 [0095.313] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.313] GetProcessHeap () returned 0xd20000 [0095.313] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.313] GetProcessHeap () returned 0xd20000 [0095.313] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.313] GetProcessHeap () returned 0xd20000 [0095.313] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.313] GetProcessHeap () returned 0xd20000 [0095.313] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.313] GetProcessHeap () returned 0xd20000 [0095.313] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.313] GetProcessHeap () returned 0xd20000 [0095.313] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.313] GetProcessHeap () returned 0xd20000 [0095.314] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.314] GetProcessHeap () returned 0xd20000 [0095.314] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.314] GetProcessHeap () returned 0xd20000 [0095.314] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.314] GetProcessHeap () returned 0xd20000 [0095.314] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.314] GetProcessHeap () returned 0xd20000 [0095.314] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.314] GetProcessHeap () returned 0xd20000 [0095.314] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.314] GetProcessHeap () returned 0xd20000 [0095.314] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.314] GetProcessHeap () returned 0xd20000 [0095.314] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.314] GetProcessHeap () returned 0xd20000 [0095.314] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.314] GetProcessHeap () returned 0xd20000 [0095.314] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.314] GetProcessHeap () returned 0xd20000 [0095.314] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.314] GetProcessHeap () returned 0xd20000 [0095.314] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.315] GetProcessHeap () returned 0xd20000 [0095.315] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.315] GetProcessHeap () returned 0xd20000 [0095.315] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.315] GetProcessHeap () returned 0xd20000 [0095.315] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.315] GetProcessHeap () returned 0xd20000 [0095.315] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.315] GetProcessHeap () returned 0xd20000 [0095.315] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.315] GetProcessHeap () returned 0xd20000 [0095.315] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.315] GetProcessHeap () returned 0xd20000 [0095.315] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.315] GetProcessHeap () returned 0xd20000 [0095.315] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.315] GetProcessHeap () returned 0xd20000 [0095.315] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.315] GetProcessHeap () returned 0xd20000 [0095.316] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.316] GetProcessHeap () returned 0xd20000 [0095.316] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.316] GetProcessHeap () returned 0xd20000 [0095.316] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.316] GetProcessHeap () returned 0xd20000 [0095.316] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.316] GetProcessHeap () returned 0xd20000 [0095.316] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.316] GetProcessHeap () returned 0xd20000 [0095.316] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.316] GetProcessHeap () returned 0xd20000 [0095.316] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.316] GetProcessHeap () returned 0xd20000 [0095.316] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.316] GetProcessHeap () returned 0xd20000 [0095.316] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.316] GetProcessHeap () returned 0xd20000 [0095.316] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.316] GetProcessHeap () returned 0xd20000 [0095.317] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.317] GetProcessHeap () returned 0xd20000 [0095.317] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.317] GetProcessHeap () returned 0xd20000 [0095.317] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.317] GetProcessHeap () returned 0xd20000 [0095.317] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.317] GetProcessHeap () returned 0xd20000 [0095.317] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.317] GetProcessHeap () returned 0xd20000 [0095.317] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.317] GetProcessHeap () returned 0xd20000 [0095.317] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.317] GetProcessHeap () returned 0xd20000 [0095.317] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.317] GetProcessHeap () returned 0xd20000 [0095.317] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.317] GetProcessHeap () returned 0xd20000 [0095.317] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.317] GetProcessHeap () returned 0xd20000 [0095.317] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.317] GetProcessHeap () returned 0xd20000 [0095.317] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.318] GetProcessHeap () returned 0xd20000 [0095.318] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.318] GetProcessHeap () returned 0xd20000 [0095.318] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.318] GetProcessHeap () returned 0xd20000 [0095.318] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.318] GetProcessHeap () returned 0xd20000 [0095.318] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.318] GetProcessHeap () returned 0xd20000 [0095.318] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.318] GetProcessHeap () returned 0xd20000 [0095.318] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.318] GetProcessHeap () returned 0xd20000 [0095.318] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.318] GetProcessHeap () returned 0xd20000 [0095.318] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.318] GetProcessHeap () returned 0xd20000 [0095.318] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.318] GetProcessHeap () returned 0xd20000 [0095.318] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.318] GetProcessHeap () returned 0xd20000 [0095.318] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.319] GetProcessHeap () returned 0xd20000 [0095.319] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.319] GetProcessHeap () returned 0xd20000 [0095.319] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.319] GetProcessHeap () returned 0xd20000 [0095.319] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.319] GetProcessHeap () returned 0xd20000 [0095.319] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.319] GetProcessHeap () returned 0xd20000 [0095.319] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.319] GetProcessHeap () returned 0xd20000 [0095.319] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.319] GetProcessHeap () returned 0xd20000 [0095.319] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.319] GetProcessHeap () returned 0xd20000 [0095.319] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.319] GetProcessHeap () returned 0xd20000 [0095.319] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.319] GetProcessHeap () returned 0xd20000 [0095.319] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.319] GetProcessHeap () returned 0xd20000 [0095.319] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.320] GetProcessHeap () returned 0xd20000 [0095.320] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.320] GetProcessHeap () returned 0xd20000 [0095.320] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.320] GetProcessHeap () returned 0xd20000 [0095.320] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.320] GetProcessHeap () returned 0xd20000 [0095.320] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.320] GetProcessHeap () returned 0xd20000 [0095.320] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.320] GetProcessHeap () returned 0xd20000 [0095.320] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.320] GetProcessHeap () returned 0xd20000 [0095.320] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.320] GetProcessHeap () returned 0xd20000 [0095.320] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.320] GetProcessHeap () returned 0xd20000 [0095.320] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.320] GetProcessHeap () returned 0xd20000 [0095.320] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.320] GetProcessHeap () returned 0xd20000 [0095.321] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.321] GetProcessHeap () returned 0xd20000 [0095.321] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.321] GetProcessHeap () returned 0xd20000 [0095.321] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.321] GetProcessHeap () returned 0xd20000 [0095.321] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.321] GetProcessHeap () returned 0xd20000 [0095.321] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.321] GetProcessHeap () returned 0xd20000 [0095.321] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.321] GetProcessHeap () returned 0xd20000 [0095.321] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.321] GetProcessHeap () returned 0xd20000 [0095.321] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.321] GetProcessHeap () returned 0xd20000 [0095.321] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.321] GetProcessHeap () returned 0xd20000 [0095.321] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.321] GetProcessHeap () returned 0xd20000 [0095.321] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.322] GetProcessHeap () returned 0xd20000 [0095.322] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.322] GetProcessHeap () returned 0xd20000 [0095.322] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.322] GetProcessHeap () returned 0xd20000 [0095.322] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.322] GetProcessHeap () returned 0xd20000 [0095.322] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.322] GetProcessHeap () returned 0xd20000 [0095.322] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.322] GetProcessHeap () returned 0xd20000 [0095.322] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.322] GetProcessHeap () returned 0xd20000 [0095.322] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.322] GetProcessHeap () returned 0xd20000 [0095.322] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.322] GetProcessHeap () returned 0xd20000 [0095.322] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.322] GetProcessHeap () returned 0xd20000 [0095.322] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.322] GetProcessHeap () returned 0xd20000 [0095.322] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.323] GetProcessHeap () returned 0xd20000 [0095.323] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.323] GetProcessHeap () returned 0xd20000 [0095.323] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.323] GetProcessHeap () returned 0xd20000 [0095.323] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.323] GetProcessHeap () returned 0xd20000 [0095.323] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.323] GetProcessHeap () returned 0xd20000 [0095.323] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.323] GetProcessHeap () returned 0xd20000 [0095.323] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.323] GetProcessHeap () returned 0xd20000 [0095.323] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.323] GetProcessHeap () returned 0xd20000 [0095.323] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.323] GetProcessHeap () returned 0xd20000 [0095.323] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0095.323] GetProcessHeap () returned 0xd20000 [0095.323] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0095.323] GetProcessHeap () returned 0xd20000 [0095.324] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.324] GetProcessHeap () returned 0xd20000 [0095.324] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.324] GetProcessHeap () returned 0xd20000 [0095.324] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.324] GetProcessHeap () returned 0xd20000 [0095.324] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.324] GetProcessHeap () returned 0xd20000 [0095.324] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.324] GetProcessHeap () returned 0xd20000 [0095.324] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.324] GetProcessHeap () returned 0xd20000 [0095.324] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.324] GetProcessHeap () returned 0xd20000 [0095.324] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.324] GetProcessHeap () returned 0xd20000 [0095.324] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.324] GetProcessHeap () returned 0xd20000 [0095.324] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.324] GetProcessHeap () returned 0xd20000 [0095.324] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.325] GetProcessHeap () returned 0xd20000 [0095.325] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.325] GetProcessHeap () returned 0xd20000 [0095.325] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.325] GetProcessHeap () returned 0xd20000 [0095.325] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.325] GetProcessHeap () returned 0xd20000 [0095.325] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.325] GetProcessHeap () returned 0xd20000 [0095.325] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.325] GetProcessHeap () returned 0xd20000 [0095.325] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.325] GetProcessHeap () returned 0xd20000 [0095.325] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.325] GetProcessHeap () returned 0xd20000 [0095.325] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.325] GetProcessHeap () returned 0xd20000 [0095.325] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.325] GetProcessHeap () returned 0xd20000 [0095.325] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.325] GetProcessHeap () returned 0xd20000 [0095.325] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.326] GetProcessHeap () returned 0xd20000 [0095.326] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0095.326] GetProcessHeap () returned 0xd20000 [0095.326] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0095.326] GetProcessHeap () returned 0xd20000 [0095.326] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.326] GetProcessHeap () returned 0xd20000 [0095.326] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.326] GetProcessHeap () returned 0xd20000 [0095.326] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.326] GetProcessHeap () returned 0xd20000 [0095.326] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.326] GetProcessHeap () returned 0xd20000 [0095.326] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0095.326] GetProcessHeap () returned 0xd20000 [0095.326] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0095.326] GetProcessHeap () returned 0xd20000 [0095.326] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0095.326] GetProcessHeap () returned 0xd20000 [0095.326] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0095.326] GetProcessHeap () returned 0xd20000 [0095.326] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44438 | out: hHeap=0xd20000) returned 1 [0095.327] GetProcessHeap () returned 0xd20000 [0095.327] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b368 | out: hHeap=0xd20000) returned 1 [0095.327] GetProcessHeap () returned 0xd20000 [0095.327] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0095.327] GetProcessHeap () returned 0xd20000 [0095.327] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b2d8 | out: hHeap=0xd20000) returned 1 [0095.327] GetProcessHeap () returned 0xd20000 [0095.327] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0095.327] GetProcessHeap () returned 0xd20000 [0095.327] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.327] GetProcessHeap () returned 0xd20000 [0095.327] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0095.327] WriteFile (in: hFile=0x230, lpBuffer=0xd4dcd0*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4dcd0*, lpNumberOfBytesWritten=0x299d864*=0x38c, lpOverlapped=0x0) returned 1 [0095.415] GetProcessHeap () returned 0xd20000 [0095.415] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4dcd0, Size=0x30) returned 0xd4dcd0 [0095.415] GetProcessHeap () returned 0xd20000 [0095.415] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0095.415] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0095.415] GetProcessHeap () returned 0xd20000 [0095.415] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10680) returned 0xd4dd08 [0095.416] ReadFile (in: hFile=0x230, lpBuffer=0xd4dd08, nNumberOfBytesToRead=0x10680, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4dd08*, lpNumberOfBytesRead=0x299d7e8*=0x10680, lpOverlapped=0x0) returned 1 [0095.418] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0095.418] WriteFile (in: hFile=0x230, lpBuffer=0xd4dd08*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4dd08*, lpNumberOfBytesWritten=0x299d7e4*=0x10680, lpOverlapped=0x0) returned 1 [0095.421] GetProcessHeap () returned 0xd20000 [0095.421] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4dd08 | out: hHeap=0xd20000) returned 1 [0095.421] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0095.421] WriteFile (in: hFile=0x230, lpBuffer=0xd4dcd0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4dcd0*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0095.423] CloseHandle (hObject=0x230) returned 1 [0095.429] GetProcessHeap () returned 0xd20000 [0095.429] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd428a0 | out: hHeap=0xd20000) returned 1 [0095.429] GetProcessHeap () returned 0xd20000 [0095.429] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bd28 | out: hHeap=0xd20000) returned 1 [0095.429] GetProcessHeap () returned 0xd20000 [0095.429] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0095.429] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" [0095.429] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm.[ponce.lorena@aol.com]" [0095.429] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nb-no.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0095.430] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nb-no.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0095.430] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0095.430] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0095.430] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0095.430] GetProcessHeap () returned 0xd20000 [0095.431] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444f8 | out: hHeap=0xd20000) returned 1 [0095.431] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3fe3b1, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3fe3b1, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10698, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_nl-nl.htm", cAlternateFileName="EULA_N~2.HTM")) returned 1 [0095.431] lstrcmpiW (lpString1="EULA_nl-nl.htm", lpString2=".") returned 1 [0095.431] lstrcmpiW (lpString1="EULA_nl-nl.htm", lpString2="..") returned 1 [0095.431] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_nl-nl.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" [0095.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_nl-nl.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0095.431] GetProcessHeap () returned 0xd20000 [0095.431] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd44618 [0095.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_nl-nl.htm", cchWideChar=-1, lpMultiByteStr=0xd44618, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_nl-nl.htm", lpUsedDefaultChar=0x0) returned 15 [0095.431] lstrlenA (lpString="EULA_nl-nl.htm") returned 14 [0095.431] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0095.431] lstrlenA (lpString="EULA_nl-nl.htm") returned 14 [0095.431] lstrlenA (lpString=".dll") returned 4 [0095.431] lstrlenA (lpString=".dll") returned 4 [0095.432] lstrlenA (lpString="EULA_nl-nl.htm") returned 14 [0095.432] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0095.432] lstrlenA (lpString="EULA_nl-nl.htm") returned 14 [0095.432] lstrlenA (lpString=".ini") returned 4 [0095.432] lstrlenA (lpString=".ini") returned 4 [0095.432] lstrlenA (lpString="EULA_nl-nl.htm") returned 14 [0095.432] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0095.432] lstrlenA (lpString="EULA_nl-nl.htm") returned 14 [0095.433] lstrlenA (lpString=".inc") returned 4 [0095.433] lstrlenA (lpString=".inc") returned 4 [0095.433] lstrlenA (lpString="EULA_nl-nl.htm") returned 14 [0095.433] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0095.433] lstrcmpiW (lpString1="EULA_nl-nl.htm", lpString2="HOW_RECOVER.html") returned -1 [0095.433] lstrcmpiW (lpString1="EULA_nl-nl.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0095.433] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0095.433] lstrcmpiW (lpString1="EULA_nl-nl.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0095.433] GetProcessHeap () returned 0xd20000 [0095.433] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd426e8 [0095.433] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0095.434] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=67224) returned 1 [0095.434] GetProcessHeap () returned 0xd20000 [0095.434] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bb48 [0095.434] GetProcessHeap () returned 0xd20000 [0095.434] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0095.435] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm") returned 52 [0095.435] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0095.435] GetProcessHeap () returned 0xd20000 [0095.435] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0095.435] GetProcessHeap () returned 0xd20000 [0095.435] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x388) returned 0xd4dd08 [0095.435] lstrlenA (lpString="rsa_encrypt") returned 11 [0095.435] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0095.437] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0095.437] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0095.437] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0095.437] GetProcessHeap () returned 0xd20000 [0095.437] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0095.437] lstrlenA (lpString="010001") returned 6 [0095.437] GetProcessHeap () returned 0xd20000 [0095.437] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0095.437] GetProcessHeap () returned 0xd20000 [0095.437] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0095.437] GetProcessHeap () returned 0xd20000 [0095.437] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b758 [0095.437] GetProcessHeap () returned 0xd20000 [0095.437] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0095.438] GetProcessHeap () returned 0xd20000 [0095.438] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b2d8 [0095.438] GetProcessHeap () returned 0xd20000 [0095.438] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44920 [0095.438] GetProcessHeap () returned 0xd20000 [0095.438] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc98 [0095.438] GetProcessHeap () returned 0xd20000 [0095.438] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0095.438] GetProcessHeap () returned 0xd20000 [0095.438] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.438] GetProcessHeap () returned 0xd20000 [0095.438] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0095.438] GetProcessHeap () returned 0xd20000 [0095.438] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0095.438] GetProcessHeap () returned 0xd20000 [0095.438] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44c68 [0095.438] GetProcessHeap () returned 0xd20000 [0095.438] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.438] GetProcessHeap () returned 0xd20000 [0095.438] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44540 [0095.439] GetProcessHeap () returned 0xd20000 [0095.439] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4a948 [0095.439] GetProcessHeap () returned 0xd20000 [0095.439] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0095.439] GetProcessHeap () returned 0xd20000 [0095.439] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0095.439] GetProcessHeap () returned 0xd20000 [0095.439] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a948 | out: hHeap=0xd20000) returned 1 [0095.439] GetProcessHeap () returned 0xd20000 [0095.439] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.439] GetProcessHeap () returned 0xd20000 [0095.439] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44648 [0095.439] GetProcessHeap () returned 0xd20000 [0095.439] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.439] GetProcessHeap () returned 0xd20000 [0095.439] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.439] GetProcessHeap () returned 0xd20000 [0095.439] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0095.439] GetProcessHeap () returned 0xd20000 [0095.439] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0095.439] GetProcessHeap () returned 0xd20000 [0095.439] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.440] GetProcessHeap () returned 0xd20000 [0095.440] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.440] GetProcessHeap () returned 0xd20000 [0095.440] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4aee8 [0095.440] GetProcessHeap () returned 0xd20000 [0095.440] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44648 | out: hHeap=0xd20000) returned 1 [0095.440] GetProcessHeap () returned 0xd20000 [0095.440] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0095.440] GetProcessHeap () returned 0xd20000 [0095.440] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aee8 | out: hHeap=0xd20000) returned 1 [0095.440] GetProcessHeap () returned 0xd20000 [0095.440] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.440] GetProcessHeap () returned 0xd20000 [0095.440] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.440] GetProcessHeap () returned 0xd20000 [0095.440] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.440] GetProcessHeap () returned 0xd20000 [0095.440] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.440] GetProcessHeap () returned 0xd20000 [0095.440] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.440] GetProcessHeap () returned 0xd20000 [0095.440] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.441] GetProcessHeap () returned 0xd20000 [0095.441] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.441] GetProcessHeap () returned 0xd20000 [0095.441] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.441] GetProcessHeap () returned 0xd20000 [0095.441] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.441] GetProcessHeap () returned 0xd20000 [0095.441] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.441] GetProcessHeap () returned 0xd20000 [0095.441] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.441] GetProcessHeap () returned 0xd20000 [0095.441] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.441] GetProcessHeap () returned 0xd20000 [0095.441] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.441] GetProcessHeap () returned 0xd20000 [0095.441] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.441] GetProcessHeap () returned 0xd20000 [0095.441] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.441] GetProcessHeap () returned 0xd20000 [0095.441] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.441] GetProcessHeap () returned 0xd20000 [0095.441] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.442] GetProcessHeap () returned 0xd20000 [0095.442] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.442] GetProcessHeap () returned 0xd20000 [0095.442] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.442] GetProcessHeap () returned 0xd20000 [0095.442] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.442] GetProcessHeap () returned 0xd20000 [0095.442] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.442] GetProcessHeap () returned 0xd20000 [0095.442] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.442] GetProcessHeap () returned 0xd20000 [0095.442] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.442] GetProcessHeap () returned 0xd20000 [0095.442] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.442] GetProcessHeap () returned 0xd20000 [0095.442] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.442] GetProcessHeap () returned 0xd20000 [0095.442] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.442] GetProcessHeap () returned 0xd20000 [0095.442] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.442] GetProcessHeap () returned 0xd20000 [0095.443] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.443] GetProcessHeap () returned 0xd20000 [0095.443] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.443] GetProcessHeap () returned 0xd20000 [0095.443] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.443] GetProcessHeap () returned 0xd20000 [0095.443] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.443] GetProcessHeap () returned 0xd20000 [0095.443] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.443] GetProcessHeap () returned 0xd20000 [0095.443] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.443] GetProcessHeap () returned 0xd20000 [0095.443] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.443] GetProcessHeap () returned 0xd20000 [0095.443] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.443] GetProcessHeap () returned 0xd20000 [0095.443] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.443] GetProcessHeap () returned 0xd20000 [0095.443] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.443] GetProcessHeap () returned 0xd20000 [0095.443] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.443] GetProcessHeap () returned 0xd20000 [0095.444] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.444] GetProcessHeap () returned 0xd20000 [0095.444] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.444] GetProcessHeap () returned 0xd20000 [0095.444] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.444] GetProcessHeap () returned 0xd20000 [0095.444] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.444] GetProcessHeap () returned 0xd20000 [0095.444] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.444] GetProcessHeap () returned 0xd20000 [0095.444] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.444] GetProcessHeap () returned 0xd20000 [0095.444] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.444] GetProcessHeap () returned 0xd20000 [0095.444] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.444] GetProcessHeap () returned 0xd20000 [0095.444] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.444] GetProcessHeap () returned 0xd20000 [0095.444] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.445] GetProcessHeap () returned 0xd20000 [0095.445] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.445] GetProcessHeap () returned 0xd20000 [0095.445] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.445] GetProcessHeap () returned 0xd20000 [0095.445] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.445] GetProcessHeap () returned 0xd20000 [0095.445] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.445] GetProcessHeap () returned 0xd20000 [0095.445] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.445] GetProcessHeap () returned 0xd20000 [0095.445] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.445] GetProcessHeap () returned 0xd20000 [0095.445] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.445] GetProcessHeap () returned 0xd20000 [0095.445] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.445] GetProcessHeap () returned 0xd20000 [0095.445] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.445] GetProcessHeap () returned 0xd20000 [0095.446] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.446] GetProcessHeap () returned 0xd20000 [0095.446] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.446] GetProcessHeap () returned 0xd20000 [0095.446] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.446] GetProcessHeap () returned 0xd20000 [0095.446] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.446] GetProcessHeap () returned 0xd20000 [0095.446] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.446] GetProcessHeap () returned 0xd20000 [0095.446] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.446] GetProcessHeap () returned 0xd20000 [0095.446] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.446] GetProcessHeap () returned 0xd20000 [0095.446] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.446] GetProcessHeap () returned 0xd20000 [0095.446] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.446] GetProcessHeap () returned 0xd20000 [0095.446] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.446] GetProcessHeap () returned 0xd20000 [0095.446] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.447] GetProcessHeap () returned 0xd20000 [0095.447] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.447] GetProcessHeap () returned 0xd20000 [0095.447] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.447] GetProcessHeap () returned 0xd20000 [0095.447] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.447] GetProcessHeap () returned 0xd20000 [0095.447] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.447] GetProcessHeap () returned 0xd20000 [0095.447] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.447] GetProcessHeap () returned 0xd20000 [0095.447] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.447] GetProcessHeap () returned 0xd20000 [0095.447] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.447] GetProcessHeap () returned 0xd20000 [0095.447] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.447] GetProcessHeap () returned 0xd20000 [0095.447] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.447] GetProcessHeap () returned 0xd20000 [0095.448] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.448] GetProcessHeap () returned 0xd20000 [0095.448] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.448] GetProcessHeap () returned 0xd20000 [0095.448] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.448] GetProcessHeap () returned 0xd20000 [0095.448] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.448] GetProcessHeap () returned 0xd20000 [0095.448] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.448] GetProcessHeap () returned 0xd20000 [0095.448] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.448] GetProcessHeap () returned 0xd20000 [0095.448] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.448] GetProcessHeap () returned 0xd20000 [0095.448] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.448] GetProcessHeap () returned 0xd20000 [0095.448] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.448] GetProcessHeap () returned 0xd20000 [0095.448] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.448] GetProcessHeap () returned 0xd20000 [0095.448] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.449] GetProcessHeap () returned 0xd20000 [0095.449] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.449] GetProcessHeap () returned 0xd20000 [0095.449] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.449] GetProcessHeap () returned 0xd20000 [0095.449] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0095.449] GetProcessHeap () returned 0xd20000 [0095.449] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0095.449] GetProcessHeap () returned 0xd20000 [0095.449] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.449] GetProcessHeap () returned 0xd20000 [0095.449] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.449] GetProcessHeap () returned 0xd20000 [0095.449] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.449] GetProcessHeap () returned 0xd20000 [0095.449] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.449] GetProcessHeap () returned 0xd20000 [0095.449] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.449] GetProcessHeap () returned 0xd20000 [0095.449] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.450] GetProcessHeap () returned 0xd20000 [0095.450] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.450] GetProcessHeap () returned 0xd20000 [0095.450] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.450] GetProcessHeap () returned 0xd20000 [0095.450] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.450] GetProcessHeap () returned 0xd20000 [0095.450] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.450] GetProcessHeap () returned 0xd20000 [0095.450] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.450] GetProcessHeap () returned 0xd20000 [0095.450] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.450] GetProcessHeap () returned 0xd20000 [0095.450] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0095.450] GetProcessHeap () returned 0xd20000 [0095.450] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0095.450] GetProcessHeap () returned 0xd20000 [0095.450] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.451] GetProcessHeap () returned 0xd20000 [0095.451] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.451] GetProcessHeap () returned 0xd20000 [0095.451] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.451] GetProcessHeap () returned 0xd20000 [0095.451] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.451] GetProcessHeap () returned 0xd20000 [0095.451] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0095.451] GetProcessHeap () returned 0xd20000 [0095.451] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0095.451] GetProcessHeap () returned 0xd20000 [0095.451] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.451] GetProcessHeap () returned 0xd20000 [0095.451] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.451] GetProcessHeap () returned 0xd20000 [0095.451] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.451] GetProcessHeap () returned 0xd20000 [0095.451] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.452] GetProcessHeap () returned 0xd20000 [0095.452] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.452] GetProcessHeap () returned 0xd20000 [0095.452] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.452] GetProcessHeap () returned 0xd20000 [0095.452] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.452] GetProcessHeap () returned 0xd20000 [0095.452] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.452] GetProcessHeap () returned 0xd20000 [0095.452] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.452] GetProcessHeap () returned 0xd20000 [0095.452] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.452] GetProcessHeap () returned 0xd20000 [0095.452] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0095.452] GetProcessHeap () returned 0xd20000 [0095.452] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0095.452] GetProcessHeap () returned 0xd20000 [0095.452] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.452] GetProcessHeap () returned 0xd20000 [0095.452] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.452] GetProcessHeap () returned 0xd20000 [0095.453] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.453] GetProcessHeap () returned 0xd20000 [0095.453] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.453] GetProcessHeap () returned 0xd20000 [0095.453] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.453] GetProcessHeap () returned 0xd20000 [0095.453] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.453] GetProcessHeap () returned 0xd20000 [0095.453] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.453] GetProcessHeap () returned 0xd20000 [0095.453] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.453] GetProcessHeap () returned 0xd20000 [0095.453] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.453] GetProcessHeap () returned 0xd20000 [0095.454] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.454] GetProcessHeap () returned 0xd20000 [0095.454] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.454] GetProcessHeap () returned 0xd20000 [0095.454] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.454] GetProcessHeap () returned 0xd20000 [0095.454] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.454] GetProcessHeap () returned 0xd20000 [0095.454] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.454] GetProcessHeap () returned 0xd20000 [0095.454] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.454] GetProcessHeap () returned 0xd20000 [0095.454] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.455] GetProcessHeap () returned 0xd20000 [0095.455] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.455] GetProcessHeap () returned 0xd20000 [0095.455] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.455] GetProcessHeap () returned 0xd20000 [0095.455] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.455] GetProcessHeap () returned 0xd20000 [0095.455] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.455] GetProcessHeap () returned 0xd20000 [0095.455] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.455] GetProcessHeap () returned 0xd20000 [0095.455] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.455] GetProcessHeap () returned 0xd20000 [0095.455] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.455] GetProcessHeap () returned 0xd20000 [0095.455] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.455] GetProcessHeap () returned 0xd20000 [0095.455] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.455] GetProcessHeap () returned 0xd20000 [0095.456] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.456] GetProcessHeap () returned 0xd20000 [0095.456] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.456] GetProcessHeap () returned 0xd20000 [0095.456] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.456] GetProcessHeap () returned 0xd20000 [0095.456] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.456] GetProcessHeap () returned 0xd20000 [0095.456] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.456] GetProcessHeap () returned 0xd20000 [0095.456] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.456] GetProcessHeap () returned 0xd20000 [0095.456] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.456] GetProcessHeap () returned 0xd20000 [0095.456] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.456] GetProcessHeap () returned 0xd20000 [0095.456] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.456] GetProcessHeap () returned 0xd20000 [0095.456] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.456] GetProcessHeap () returned 0xd20000 [0095.457] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.457] GetProcessHeap () returned 0xd20000 [0095.457] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.457] GetProcessHeap () returned 0xd20000 [0095.457] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.457] GetProcessHeap () returned 0xd20000 [0095.457] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.457] GetProcessHeap () returned 0xd20000 [0095.457] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.457] GetProcessHeap () returned 0xd20000 [0095.457] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.457] GetProcessHeap () returned 0xd20000 [0095.457] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.457] GetProcessHeap () returned 0xd20000 [0095.457] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.457] GetProcessHeap () returned 0xd20000 [0095.457] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.457] GetProcessHeap () returned 0xd20000 [0095.457] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.457] GetProcessHeap () returned 0xd20000 [0095.457] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.458] GetProcessHeap () returned 0xd20000 [0095.458] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0095.458] GetProcessHeap () returned 0xd20000 [0095.458] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0095.458] GetProcessHeap () returned 0xd20000 [0095.458] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0095.458] GetProcessHeap () returned 0xd20000 [0095.458] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0095.458] GetProcessHeap () returned 0xd20000 [0095.458] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44540 | out: hHeap=0xd20000) returned 1 [0095.458] GetProcessHeap () returned 0xd20000 [0095.458] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b2d8 | out: hHeap=0xd20000) returned 1 [0095.458] GetProcessHeap () returned 0xd20000 [0095.458] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0095.458] GetProcessHeap () returned 0xd20000 [0095.458] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b758 | out: hHeap=0xd20000) returned 1 [0095.458] GetProcessHeap () returned 0xd20000 [0095.458] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0095.458] GetProcessHeap () returned 0xd20000 [0095.459] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.459] GetProcessHeap () returned 0xd20000 [0095.459] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0095.459] WriteFile (in: hFile=0x230, lpBuffer=0xd4dd08*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4dd08*, lpNumberOfBytesWritten=0x299d864*=0x388, lpOverlapped=0x0) returned 1 [0095.464] GetProcessHeap () returned 0xd20000 [0095.464] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4dd08, Size=0x30) returned 0xd4dd08 [0095.464] GetProcessHeap () returned 0xd20000 [0095.464] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0095.464] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0095.464] GetProcessHeap () returned 0xd20000 [0095.464] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x106a0) returned 0xd4dd40 [0095.464] ReadFile (in: hFile=0x230, lpBuffer=0xd4dd40, nNumberOfBytesToRead=0x106a0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4dd40*, lpNumberOfBytesRead=0x299d7e8*=0x106a0, lpOverlapped=0x0) returned 1 [0095.466] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0095.467] WriteFile (in: hFile=0x230, lpBuffer=0xd4dd40*, nNumberOfBytesToWrite=0x106a0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4dd40*, lpNumberOfBytesWritten=0x299d7e4*=0x106a0, lpOverlapped=0x0) returned 1 [0095.469] GetProcessHeap () returned 0xd20000 [0095.469] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4dd40 | out: hHeap=0xd20000) returned 1 [0095.469] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0095.470] WriteFile (in: hFile=0x230, lpBuffer=0xd4dd08*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4dd08*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0095.471] CloseHandle (hObject=0x230) returned 1 [0095.475] GetProcessHeap () returned 0xd20000 [0095.475] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd426e8 | out: hHeap=0xd20000) returned 1 [0095.475] GetProcessHeap () returned 0xd20000 [0095.475] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bb48 | out: hHeap=0xd20000) returned 1 [0095.475] GetProcessHeap () returned 0xd20000 [0095.475] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0095.475] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" [0095.475] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm.[ponce.lorena@aol.com]" [0095.476] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_nl-nl.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0095.476] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_nl-nl.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0095.476] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0095.476] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0095.477] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0095.477] GetProcessHeap () returned 0xd20000 [0095.477] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44618 | out: hHeap=0xd20000) returned 1 [0095.477] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ff747, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ff747, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x13f94, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_pl-pl.htm", cAlternateFileName="EULA_P~1.HTM")) returned 1 [0095.477] lstrcmpiW (lpString1="EULA_pl-pl.htm", lpString2=".") returned 1 [0095.477] lstrcmpiW (lpString1="EULA_pl-pl.htm", lpString2="..") returned 1 [0095.477] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_pl-pl.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" [0095.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_pl-pl.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0095.477] GetProcessHeap () returned 0xd20000 [0095.477] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd44588 [0095.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_pl-pl.htm", cchWideChar=-1, lpMultiByteStr=0xd44588, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_pl-pl.htm", lpUsedDefaultChar=0x0) returned 15 [0095.477] lstrlenA (lpString="EULA_pl-pl.htm") returned 14 [0095.477] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0095.477] lstrlenA (lpString="EULA_pl-pl.htm") returned 14 [0095.477] lstrlenA (lpString=".dll") returned 4 [0095.477] lstrlenA (lpString=".dll") returned 4 [0095.478] lstrlenA (lpString="EULA_pl-pl.htm") returned 14 [0095.478] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0095.478] lstrlenA (lpString="EULA_pl-pl.htm") returned 14 [0095.478] lstrlenA (lpString=".ini") returned 4 [0095.478] lstrlenA (lpString=".ini") returned 4 [0095.478] lstrlenA (lpString="EULA_pl-pl.htm") returned 14 [0095.478] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0095.478] lstrlenA (lpString="EULA_pl-pl.htm") returned 14 [0095.478] lstrlenA (lpString=".inc") returned 4 [0095.478] lstrlenA (lpString=".inc") returned 4 [0095.478] lstrlenA (lpString="EULA_pl-pl.htm") returned 14 [0095.478] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0095.478] lstrcmpiW (lpString1="EULA_pl-pl.htm", lpString2="HOW_RECOVER.html") returned -1 [0095.478] lstrcmpiW (lpString1="EULA_pl-pl.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0095.478] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0095.478] lstrcmpiW (lpString1="EULA_pl-pl.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0095.478] GetProcessHeap () returned 0xd20000 [0095.478] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42738 [0095.478] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0095.479] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=81812) returned 1 [0095.479] GetProcessHeap () returned 0xd20000 [0095.479] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bff8 [0095.479] GetProcessHeap () returned 0xd20000 [0095.479] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0095.479] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm") returned 52 [0095.479] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0095.479] GetProcessHeap () returned 0xd20000 [0095.479] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0095.480] GetProcessHeap () returned 0xd20000 [0095.480] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4dd40 [0095.480] lstrlenA (lpString="rsa_encrypt") returned 11 [0095.480] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0095.481] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0095.482] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0095.482] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0095.482] GetProcessHeap () returned 0xd20000 [0095.482] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0095.482] lstrlenA (lpString="010001") returned 6 [0095.482] GetProcessHeap () returned 0xd20000 [0095.482] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd98 [0095.482] GetProcessHeap () returned 0xd20000 [0095.482] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0095.482] GetProcessHeap () returned 0xd20000 [0095.482] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aee8 [0095.482] GetProcessHeap () returned 0xd20000 [0095.482] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0095.482] GetProcessHeap () returned 0xd20000 [0095.482] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b368 [0095.482] GetProcessHeap () returned 0xd20000 [0095.482] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44e98 [0095.482] GetProcessHeap () returned 0xd20000 [0095.482] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0095.482] GetProcessHeap () returned 0xd20000 [0095.483] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0095.483] GetProcessHeap () returned 0xd20000 [0095.483] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.483] GetProcessHeap () returned 0xd20000 [0095.483] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0095.483] GetProcessHeap () returned 0xd20000 [0095.483] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0095.483] GetProcessHeap () returned 0xd20000 [0095.483] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44920 [0095.483] GetProcessHeap () returned 0xd20000 [0095.483] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.483] GetProcessHeap () returned 0xd20000 [0095.483] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44648 [0095.483] GetProcessHeap () returned 0xd20000 [0095.483] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b758 [0095.483] GetProcessHeap () returned 0xd20000 [0095.483] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0095.483] GetProcessHeap () returned 0xd20000 [0095.483] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0095.483] GetProcessHeap () returned 0xd20000 [0095.483] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b758 | out: hHeap=0xd20000) returned 1 [0095.484] GetProcessHeap () returned 0xd20000 [0095.484] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.484] GetProcessHeap () returned 0xd20000 [0095.484] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444c8 [0095.484] GetProcessHeap () returned 0xd20000 [0095.484] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.484] GetProcessHeap () returned 0xd20000 [0095.484] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.484] GetProcessHeap () returned 0xd20000 [0095.484] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.484] GetProcessHeap () returned 0xd20000 [0095.484] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.484] GetProcessHeap () returned 0xd20000 [0095.484] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.484] GetProcessHeap () returned 0xd20000 [0095.484] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.484] GetProcessHeap () returned 0xd20000 [0095.484] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b7e8 [0095.484] GetProcessHeap () returned 0xd20000 [0095.484] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444c8 | out: hHeap=0xd20000) returned 1 [0095.491] GetProcessHeap () returned 0xd20000 [0095.491] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0095.491] GetProcessHeap () returned 0xd20000 [0095.491] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0095.491] GetProcessHeap () returned 0xd20000 [0095.491] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.491] GetProcessHeap () returned 0xd20000 [0095.491] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.491] GetProcessHeap () returned 0xd20000 [0095.491] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.491] GetProcessHeap () returned 0xd20000 [0095.491] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.491] GetProcessHeap () returned 0xd20000 [0095.491] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.492] GetProcessHeap () returned 0xd20000 [0095.492] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.492] GetProcessHeap () returned 0xd20000 [0095.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.492] GetProcessHeap () returned 0xd20000 [0095.492] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.492] GetProcessHeap () returned 0xd20000 [0095.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.492] GetProcessHeap () returned 0xd20000 [0095.492] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.492] GetProcessHeap () returned 0xd20000 [0095.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.492] GetProcessHeap () returned 0xd20000 [0095.492] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.492] GetProcessHeap () returned 0xd20000 [0095.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.492] GetProcessHeap () returned 0xd20000 [0095.492] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.492] GetProcessHeap () returned 0xd20000 [0095.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.493] GetProcessHeap () returned 0xd20000 [0095.493] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.493] GetProcessHeap () returned 0xd20000 [0095.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.493] GetProcessHeap () returned 0xd20000 [0095.493] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.493] GetProcessHeap () returned 0xd20000 [0095.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.493] GetProcessHeap () returned 0xd20000 [0095.493] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.493] GetProcessHeap () returned 0xd20000 [0095.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.493] GetProcessHeap () returned 0xd20000 [0095.493] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.493] GetProcessHeap () returned 0xd20000 [0095.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.493] GetProcessHeap () returned 0xd20000 [0095.493] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.493] GetProcessHeap () returned 0xd20000 [0095.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.493] GetProcessHeap () returned 0xd20000 [0095.494] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.494] GetProcessHeap () returned 0xd20000 [0095.494] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.494] GetProcessHeap () returned 0xd20000 [0095.494] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.494] GetProcessHeap () returned 0xd20000 [0095.494] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.494] GetProcessHeap () returned 0xd20000 [0095.494] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.494] GetProcessHeap () returned 0xd20000 [0095.494] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.494] GetProcessHeap () returned 0xd20000 [0095.494] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.494] GetProcessHeap () returned 0xd20000 [0095.494] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.494] GetProcessHeap () returned 0xd20000 [0095.494] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.494] GetProcessHeap () returned 0xd20000 [0095.494] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.494] GetProcessHeap () returned 0xd20000 [0095.494] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.494] GetProcessHeap () returned 0xd20000 [0095.495] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.495] GetProcessHeap () returned 0xd20000 [0095.495] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.495] GetProcessHeap () returned 0xd20000 [0095.495] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.495] GetProcessHeap () returned 0xd20000 [0095.495] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.495] GetProcessHeap () returned 0xd20000 [0095.495] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.495] GetProcessHeap () returned 0xd20000 [0095.495] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.495] GetProcessHeap () returned 0xd20000 [0095.495] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.495] GetProcessHeap () returned 0xd20000 [0095.495] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.495] GetProcessHeap () returned 0xd20000 [0095.495] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.495] GetProcessHeap () returned 0xd20000 [0095.495] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.495] GetProcessHeap () returned 0xd20000 [0095.495] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.496] GetProcessHeap () returned 0xd20000 [0095.496] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.496] GetProcessHeap () returned 0xd20000 [0095.496] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.496] GetProcessHeap () returned 0xd20000 [0095.496] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.496] GetProcessHeap () returned 0xd20000 [0095.496] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.496] GetProcessHeap () returned 0xd20000 [0095.496] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.496] GetProcessHeap () returned 0xd20000 [0095.496] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.496] GetProcessHeap () returned 0xd20000 [0095.496] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.496] GetProcessHeap () returned 0xd20000 [0095.496] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.496] GetProcessHeap () returned 0xd20000 [0095.496] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.496] GetProcessHeap () returned 0xd20000 [0095.496] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.496] GetProcessHeap () returned 0xd20000 [0095.496] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.497] GetProcessHeap () returned 0xd20000 [0095.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.497] GetProcessHeap () returned 0xd20000 [0095.497] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.497] GetProcessHeap () returned 0xd20000 [0095.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.497] GetProcessHeap () returned 0xd20000 [0095.497] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.497] GetProcessHeap () returned 0xd20000 [0095.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.497] GetProcessHeap () returned 0xd20000 [0095.497] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.497] GetProcessHeap () returned 0xd20000 [0095.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.497] GetProcessHeap () returned 0xd20000 [0095.497] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.497] GetProcessHeap () returned 0xd20000 [0095.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.497] GetProcessHeap () returned 0xd20000 [0095.497] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.498] GetProcessHeap () returned 0xd20000 [0095.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.498] GetProcessHeap () returned 0xd20000 [0095.498] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.498] GetProcessHeap () returned 0xd20000 [0095.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.498] GetProcessHeap () returned 0xd20000 [0095.498] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.498] GetProcessHeap () returned 0xd20000 [0095.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.498] GetProcessHeap () returned 0xd20000 [0095.498] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.498] GetProcessHeap () returned 0xd20000 [0095.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.498] GetProcessHeap () returned 0xd20000 [0095.498] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.498] GetProcessHeap () returned 0xd20000 [0095.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.498] GetProcessHeap () returned 0xd20000 [0095.498] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.498] GetProcessHeap () returned 0xd20000 [0095.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.499] GetProcessHeap () returned 0xd20000 [0095.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.499] GetProcessHeap () returned 0xd20000 [0095.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.499] GetProcessHeap () returned 0xd20000 [0095.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.499] GetProcessHeap () returned 0xd20000 [0095.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.499] GetProcessHeap () returned 0xd20000 [0095.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.499] GetProcessHeap () returned 0xd20000 [0095.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.499] GetProcessHeap () returned 0xd20000 [0095.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.499] GetProcessHeap () returned 0xd20000 [0095.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.499] GetProcessHeap () returned 0xd20000 [0095.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.499] GetProcessHeap () returned 0xd20000 [0095.500] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.500] GetProcessHeap () returned 0xd20000 [0095.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.500] GetProcessHeap () returned 0xd20000 [0095.500] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.500] GetProcessHeap () returned 0xd20000 [0095.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.500] GetProcessHeap () returned 0xd20000 [0095.500] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.500] GetProcessHeap () returned 0xd20000 [0095.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.502] GetProcessHeap () returned 0xd20000 [0095.502] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.502] GetProcessHeap () returned 0xd20000 [0095.502] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.502] GetProcessHeap () returned 0xd20000 [0095.502] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.502] GetProcessHeap () returned 0xd20000 [0095.502] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.502] GetProcessHeap () returned 0xd20000 [0095.502] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.502] GetProcessHeap () returned 0xd20000 [0095.502] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.503] GetProcessHeap () returned 0xd20000 [0095.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.503] GetProcessHeap () returned 0xd20000 [0095.503] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.503] GetProcessHeap () returned 0xd20000 [0095.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.503] GetProcessHeap () returned 0xd20000 [0095.503] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.503] GetProcessHeap () returned 0xd20000 [0095.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.503] GetProcessHeap () returned 0xd20000 [0095.503] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.503] GetProcessHeap () returned 0xd20000 [0095.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.503] GetProcessHeap () returned 0xd20000 [0095.503] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.503] GetProcessHeap () returned 0xd20000 [0095.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.503] GetProcessHeap () returned 0xd20000 [0095.503] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.503] GetProcessHeap () returned 0xd20000 [0095.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.504] GetProcessHeap () returned 0xd20000 [0095.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.504] GetProcessHeap () returned 0xd20000 [0095.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0095.504] GetProcessHeap () returned 0xd20000 [0095.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0095.504] GetProcessHeap () returned 0xd20000 [0095.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.504] GetProcessHeap () returned 0xd20000 [0095.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.504] GetProcessHeap () returned 0xd20000 [0095.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.504] GetProcessHeap () returned 0xd20000 [0095.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.504] GetProcessHeap () returned 0xd20000 [0095.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.504] GetProcessHeap () returned 0xd20000 [0095.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.504] GetProcessHeap () returned 0xd20000 [0095.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.504] GetProcessHeap () returned 0xd20000 [0095.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.505] GetProcessHeap () returned 0xd20000 [0095.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.505] GetProcessHeap () returned 0xd20000 [0095.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.505] GetProcessHeap () returned 0xd20000 [0095.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.505] GetProcessHeap () returned 0xd20000 [0095.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.505] GetProcessHeap () returned 0xd20000 [0095.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.505] GetProcessHeap () returned 0xd20000 [0095.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.505] GetProcessHeap () returned 0xd20000 [0095.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.505] GetProcessHeap () returned 0xd20000 [0095.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.505] GetProcessHeap () returned 0xd20000 [0095.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.505] GetProcessHeap () returned 0xd20000 [0095.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.506] GetProcessHeap () returned 0xd20000 [0095.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.506] GetProcessHeap () returned 0xd20000 [0095.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.506] GetProcessHeap () returned 0xd20000 [0095.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.506] GetProcessHeap () returned 0xd20000 [0095.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.506] GetProcessHeap () returned 0xd20000 [0095.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0095.506] GetProcessHeap () returned 0xd20000 [0095.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0095.506] GetProcessHeap () returned 0xd20000 [0095.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.506] GetProcessHeap () returned 0xd20000 [0095.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.506] GetProcessHeap () returned 0xd20000 [0095.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.506] GetProcessHeap () returned 0xd20000 [0095.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.506] GetProcessHeap () returned 0xd20000 [0095.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.507] GetProcessHeap () returned 0xd20000 [0095.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.507] GetProcessHeap () returned 0xd20000 [0095.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.507] GetProcessHeap () returned 0xd20000 [0095.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.507] GetProcessHeap () returned 0xd20000 [0095.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.507] GetProcessHeap () returned 0xd20000 [0095.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.507] GetProcessHeap () returned 0xd20000 [0095.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.507] GetProcessHeap () returned 0xd20000 [0095.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.507] GetProcessHeap () returned 0xd20000 [0095.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0095.507] GetProcessHeap () returned 0xd20000 [0095.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0095.507] GetProcessHeap () returned 0xd20000 [0095.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.508] GetProcessHeap () returned 0xd20000 [0095.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.508] GetProcessHeap () returned 0xd20000 [0095.508] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.508] GetProcessHeap () returned 0xd20000 [0095.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.508] GetProcessHeap () returned 0xd20000 [0095.508] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.508] GetProcessHeap () returned 0xd20000 [0095.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.508] GetProcessHeap () returned 0xd20000 [0095.508] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.508] GetProcessHeap () returned 0xd20000 [0095.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.508] GetProcessHeap () returned 0xd20000 [0095.508] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.508] GetProcessHeap () returned 0xd20000 [0095.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.508] GetProcessHeap () returned 0xd20000 [0095.509] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.509] GetProcessHeap () returned 0xd20000 [0095.509] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.509] GetProcessHeap () returned 0xd20000 [0095.509] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.509] GetProcessHeap () returned 0xd20000 [0095.509] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.509] GetProcessHeap () returned 0xd20000 [0095.509] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.509] GetProcessHeap () returned 0xd20000 [0095.509] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.509] GetProcessHeap () returned 0xd20000 [0095.509] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.509] GetProcessHeap () returned 0xd20000 [0095.509] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.509] GetProcessHeap () returned 0xd20000 [0095.509] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0095.509] GetProcessHeap () returned 0xd20000 [0095.509] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0095.509] GetProcessHeap () returned 0xd20000 [0095.510] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0095.510] GetProcessHeap () returned 0xd20000 [0095.510] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0095.510] GetProcessHeap () returned 0xd20000 [0095.510] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44648 | out: hHeap=0xd20000) returned 1 [0095.510] GetProcessHeap () returned 0xd20000 [0095.510] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b368 | out: hHeap=0xd20000) returned 1 [0095.510] GetProcessHeap () returned 0xd20000 [0095.510] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0095.510] GetProcessHeap () returned 0xd20000 [0095.510] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aee8 | out: hHeap=0xd20000) returned 1 [0095.510] GetProcessHeap () returned 0xd20000 [0095.510] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0095.510] GetProcessHeap () returned 0xd20000 [0095.510] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.510] GetProcessHeap () returned 0xd20000 [0095.510] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0095.511] WriteFile (in: hFile=0x230, lpBuffer=0xd4dd40*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4dd40*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0095.517] GetProcessHeap () returned 0xd20000 [0095.517] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4dd40, Size=0x30) returned 0xd4dd40 [0095.517] GetProcessHeap () returned 0xd20000 [0095.517] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0095.517] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0095.517] GetProcessHeap () returned 0xd20000 [0095.518] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x13f94) returned 0xd4dd78 [0095.519] ReadFile (in: hFile=0x230, lpBuffer=0xd4dd78, nNumberOfBytesToRead=0x13f94, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4dd78*, lpNumberOfBytesRead=0x299d7e8*=0x13f94, lpOverlapped=0x0) returned 1 [0095.521] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0095.521] WriteFile (in: hFile=0x230, lpBuffer=0xd4dd78*, nNumberOfBytesToWrite=0x13f94, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4dd78*, lpNumberOfBytesWritten=0x299d7e4*=0x13f94, lpOverlapped=0x0) returned 1 [0095.525] GetProcessHeap () returned 0xd20000 [0095.525] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4dd78 | out: hHeap=0xd20000) returned 1 [0095.525] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0095.525] WriteFile (in: hFile=0x230, lpBuffer=0xd4dd40*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4dd40*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0095.527] CloseHandle (hObject=0x230) returned 1 [0095.531] GetProcessHeap () returned 0xd20000 [0095.531] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42738 | out: hHeap=0xd20000) returned 1 [0095.531] GetProcessHeap () returned 0xd20000 [0095.531] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bff8 | out: hHeap=0xd20000) returned 1 [0095.531] GetProcessHeap () returned 0xd20000 [0095.531] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0095.532] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" [0095.532] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm.[ponce.lorena@aol.com]" [0095.532] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pl-pl.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0095.533] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pl-pl.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0095.533] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0095.533] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0095.533] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0095.533] GetProcessHeap () returned 0xd20000 [0095.533] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44588 | out: hHeap=0xd20000) returned 1 [0095.533] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea400ac7, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea400ac7, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x10ac4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_pt-br.htm", cAlternateFileName="EULA_P~2.HTM")) returned 1 [0095.533] lstrcmpiW (lpString1="EULA_pt-br.htm", lpString2=".") returned 1 [0095.533] lstrcmpiW (lpString1="EULA_pt-br.htm", lpString2="..") returned 1 [0095.534] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_pt-br.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" [0095.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_pt-br.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0095.534] GetProcessHeap () returned 0xd20000 [0095.534] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd446a8 [0095.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_pt-br.htm", cchWideChar=-1, lpMultiByteStr=0xd446a8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_pt-br.htm", lpUsedDefaultChar=0x0) returned 15 [0095.534] lstrlenA (lpString="EULA_pt-br.htm") returned 14 [0095.534] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0095.534] lstrlenA (lpString="EULA_pt-br.htm") returned 14 [0095.534] lstrlenA (lpString=".dll") returned 4 [0095.534] lstrlenA (lpString=".dll") returned 4 [0095.534] lstrlenA (lpString="EULA_pt-br.htm") returned 14 [0095.534] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0095.534] lstrlenA (lpString="EULA_pt-br.htm") returned 14 [0095.534] lstrlenA (lpString=".ini") returned 4 [0095.534] lstrlenA (lpString=".ini") returned 4 [0095.534] lstrlenA (lpString="EULA_pt-br.htm") returned 14 [0095.534] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0095.534] lstrlenA (lpString="EULA_pt-br.htm") returned 14 [0095.534] lstrlenA (lpString=".inc") returned 4 [0095.534] lstrlenA (lpString=".inc") returned 4 [0095.535] lstrlenA (lpString="EULA_pt-br.htm") returned 14 [0095.535] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0095.535] lstrcmpiW (lpString1="EULA_pt-br.htm", lpString2="HOW_RECOVER.html") returned -1 [0095.535] lstrcmpiW (lpString1="EULA_pt-br.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0095.535] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0095.535] lstrcmpiW (lpString1="EULA_pt-br.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0095.535] GetProcessHeap () returned 0xd20000 [0095.535] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd426c0 [0095.535] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0095.535] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=68292) returned 1 [0095.536] GetProcessHeap () returned 0xd20000 [0095.536] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4be18 [0095.536] GetProcessHeap () returned 0xd20000 [0095.536] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0095.536] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm") returned 52 [0095.536] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0095.536] GetProcessHeap () returned 0xd20000 [0095.536] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0095.536] GetProcessHeap () returned 0xd20000 [0095.536] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x38c) returned 0xd4dd78 [0095.536] lstrlenA (lpString="rsa_encrypt") returned 11 [0095.536] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0095.541] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0095.541] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0095.541] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0095.541] GetProcessHeap () returned 0xd20000 [0095.541] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0095.541] lstrlenA (lpString="010001") returned 6 [0095.541] GetProcessHeap () returned 0xd20000 [0095.541] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cbd8 [0095.541] GetProcessHeap () returned 0xd20000 [0095.541] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0095.541] GetProcessHeap () returned 0xd20000 [0095.541] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0095.541] GetProcessHeap () returned 0xd20000 [0095.541] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0095.541] GetProcessHeap () returned 0xd20000 [0095.541] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aee8 [0095.541] GetProcessHeap () returned 0xd20000 [0095.542] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45528 [0095.542] GetProcessHeap () returned 0xd20000 [0095.542] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc48 [0095.542] GetProcessHeap () returned 0xd20000 [0095.542] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0095.542] GetProcessHeap () returned 0xd20000 [0095.542] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.542] GetProcessHeap () returned 0xd20000 [0095.542] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0095.542] GetProcessHeap () returned 0xd20000 [0095.542] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0095.542] GetProcessHeap () returned 0xd20000 [0095.542] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd452f8 [0095.542] GetProcessHeap () returned 0xd20000 [0095.542] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.542] GetProcessHeap () returned 0xd20000 [0095.542] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446c0 [0095.542] GetProcessHeap () returned 0xd20000 [0095.542] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aca8 [0095.542] GetProcessHeap () returned 0xd20000 [0095.542] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0095.542] GetProcessHeap () returned 0xd20000 [0095.542] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0095.542] GetProcessHeap () returned 0xd20000 [0095.543] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aca8 | out: hHeap=0xd20000) returned 1 [0095.543] GetProcessHeap () returned 0xd20000 [0095.543] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.543] GetProcessHeap () returned 0xd20000 [0095.543] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44618 [0095.543] GetProcessHeap () returned 0xd20000 [0095.543] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.543] GetProcessHeap () returned 0xd20000 [0095.543] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.543] GetProcessHeap () returned 0xd20000 [0095.543] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.543] GetProcessHeap () returned 0xd20000 [0095.543] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.543] GetProcessHeap () returned 0xd20000 [0095.543] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.543] GetProcessHeap () returned 0xd20000 [0095.543] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.543] GetProcessHeap () returned 0xd20000 [0095.543] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b7e8 [0095.544] GetProcessHeap () returned 0xd20000 [0095.544] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44618 | out: hHeap=0xd20000) returned 1 [0095.544] GetProcessHeap () returned 0xd20000 [0095.544] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0095.544] GetProcessHeap () returned 0xd20000 [0095.544] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0095.544] GetProcessHeap () returned 0xd20000 [0095.544] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.544] GetProcessHeap () returned 0xd20000 [0095.544] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.544] GetProcessHeap () returned 0xd20000 [0095.544] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.544] GetProcessHeap () returned 0xd20000 [0095.544] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.544] GetProcessHeap () returned 0xd20000 [0095.544] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.544] GetProcessHeap () returned 0xd20000 [0095.544] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.544] GetProcessHeap () returned 0xd20000 [0095.544] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.544] GetProcessHeap () returned 0xd20000 [0095.544] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.545] GetProcessHeap () returned 0xd20000 [0095.545] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.545] GetProcessHeap () returned 0xd20000 [0095.545] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.545] GetProcessHeap () returned 0xd20000 [0095.545] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.545] GetProcessHeap () returned 0xd20000 [0095.545] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.545] GetProcessHeap () returned 0xd20000 [0095.545] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.545] GetProcessHeap () returned 0xd20000 [0095.545] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.545] GetProcessHeap () returned 0xd20000 [0095.545] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.545] GetProcessHeap () returned 0xd20000 [0095.545] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.545] GetProcessHeap () returned 0xd20000 [0095.545] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.545] GetProcessHeap () returned 0xd20000 [0095.545] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.545] GetProcessHeap () returned 0xd20000 [0095.545] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.546] GetProcessHeap () returned 0xd20000 [0095.546] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.546] GetProcessHeap () returned 0xd20000 [0095.546] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.546] GetProcessHeap () returned 0xd20000 [0095.546] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.546] GetProcessHeap () returned 0xd20000 [0095.546] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.546] GetProcessHeap () returned 0xd20000 [0095.546] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.546] GetProcessHeap () returned 0xd20000 [0095.546] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.546] GetProcessHeap () returned 0xd20000 [0095.546] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.546] GetProcessHeap () returned 0xd20000 [0095.546] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.546] GetProcessHeap () returned 0xd20000 [0095.546] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.546] GetProcessHeap () returned 0xd20000 [0095.546] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.546] GetProcessHeap () returned 0xd20000 [0095.546] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.546] GetProcessHeap () returned 0xd20000 [0095.546] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.547] GetProcessHeap () returned 0xd20000 [0095.547] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.547] GetProcessHeap () returned 0xd20000 [0095.547] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.547] GetProcessHeap () returned 0xd20000 [0095.547] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.547] GetProcessHeap () returned 0xd20000 [0095.547] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.547] GetProcessHeap () returned 0xd20000 [0095.552] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.552] GetProcessHeap () returned 0xd20000 [0095.552] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.552] GetProcessHeap () returned 0xd20000 [0095.552] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.552] GetProcessHeap () returned 0xd20000 [0095.552] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.552] GetProcessHeap () returned 0xd20000 [0095.552] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.552] GetProcessHeap () returned 0xd20000 [0095.552] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.552] GetProcessHeap () returned 0xd20000 [0095.552] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.552] GetProcessHeap () returned 0xd20000 [0095.552] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.552] GetProcessHeap () returned 0xd20000 [0095.552] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.552] GetProcessHeap () returned 0xd20000 [0095.552] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.552] GetProcessHeap () returned 0xd20000 [0095.552] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.553] GetProcessHeap () returned 0xd20000 [0095.553] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.553] GetProcessHeap () returned 0xd20000 [0095.553] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.553] GetProcessHeap () returned 0xd20000 [0095.553] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.553] GetProcessHeap () returned 0xd20000 [0095.553] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.553] GetProcessHeap () returned 0xd20000 [0095.553] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.553] GetProcessHeap () returned 0xd20000 [0095.553] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.553] GetProcessHeap () returned 0xd20000 [0095.553] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.553] GetProcessHeap () returned 0xd20000 [0095.553] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.553] GetProcessHeap () returned 0xd20000 [0095.553] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.553] GetProcessHeap () returned 0xd20000 [0095.554] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.554] GetProcessHeap () returned 0xd20000 [0095.554] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.554] GetProcessHeap () returned 0xd20000 [0095.554] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.554] GetProcessHeap () returned 0xd20000 [0095.554] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.554] GetProcessHeap () returned 0xd20000 [0095.554] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.554] GetProcessHeap () returned 0xd20000 [0095.554] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.554] GetProcessHeap () returned 0xd20000 [0095.554] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.554] GetProcessHeap () returned 0xd20000 [0095.554] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0095.554] GetProcessHeap () returned 0xd20000 [0095.554] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0095.555] GetProcessHeap () returned 0xd20000 [0095.555] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.596] GetProcessHeap () returned 0xd20000 [0095.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.610] GetProcessHeap () returned 0xd20000 [0095.610] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.610] GetProcessHeap () returned 0xd20000 [0095.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.610] GetProcessHeap () returned 0xd20000 [0095.610] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.610] GetProcessHeap () returned 0xd20000 [0095.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.610] GetProcessHeap () returned 0xd20000 [0095.610] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.611] GetProcessHeap () returned 0xd20000 [0095.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.611] GetProcessHeap () returned 0xd20000 [0095.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.611] GetProcessHeap () returned 0xd20000 [0095.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.611] GetProcessHeap () returned 0xd20000 [0095.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.611] GetProcessHeap () returned 0xd20000 [0095.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.611] GetProcessHeap () returned 0xd20000 [0095.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0095.611] GetProcessHeap () returned 0xd20000 [0095.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0095.611] GetProcessHeap () returned 0xd20000 [0095.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.611] GetProcessHeap () returned 0xd20000 [0095.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.611] GetProcessHeap () returned 0xd20000 [0095.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.611] GetProcessHeap () returned 0xd20000 [0095.612] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.612] GetProcessHeap () returned 0xd20000 [0095.612] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0095.612] GetProcessHeap () returned 0xd20000 [0095.612] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0095.612] GetProcessHeap () returned 0xd20000 [0095.612] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.612] GetProcessHeap () returned 0xd20000 [0095.612] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.612] GetProcessHeap () returned 0xd20000 [0095.612] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.612] GetProcessHeap () returned 0xd20000 [0095.612] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.612] GetProcessHeap () returned 0xd20000 [0095.612] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.612] GetProcessHeap () returned 0xd20000 [0095.612] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.612] GetProcessHeap () returned 0xd20000 [0095.612] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.612] GetProcessHeap () returned 0xd20000 [0095.612] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.612] GetProcessHeap () returned 0xd20000 [0095.616] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.616] GetProcessHeap () returned 0xd20000 [0095.616] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.616] GetProcessHeap () returned 0xd20000 [0095.616] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0095.616] GetProcessHeap () returned 0xd20000 [0095.616] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0095.616] GetProcessHeap () returned 0xd20000 [0095.617] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.617] GetProcessHeap () returned 0xd20000 [0095.617] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.617] GetProcessHeap () returned 0xd20000 [0095.617] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.617] GetProcessHeap () returned 0xd20000 [0095.617] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.617] GetProcessHeap () returned 0xd20000 [0095.617] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.617] GetProcessHeap () returned 0xd20000 [0095.617] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.617] GetProcessHeap () returned 0xd20000 [0095.617] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.617] GetProcessHeap () returned 0xd20000 [0095.617] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.617] GetProcessHeap () returned 0xd20000 [0095.617] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.617] GetProcessHeap () returned 0xd20000 [0095.617] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.617] GetProcessHeap () returned 0xd20000 [0095.617] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.618] GetProcessHeap () returned 0xd20000 [0095.618] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.618] GetProcessHeap () returned 0xd20000 [0095.618] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.618] GetProcessHeap () returned 0xd20000 [0095.618] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.618] GetProcessHeap () returned 0xd20000 [0095.618] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.618] GetProcessHeap () returned 0xd20000 [0095.618] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.618] GetProcessHeap () returned 0xd20000 [0095.618] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.618] GetProcessHeap () returned 0xd20000 [0095.618] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.618] GetProcessHeap () returned 0xd20000 [0095.618] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.618] GetProcessHeap () returned 0xd20000 [0095.618] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.618] GetProcessHeap () returned 0xd20000 [0095.618] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.618] GetProcessHeap () returned 0xd20000 [0095.618] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.619] GetProcessHeap () returned 0xd20000 [0095.619] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.619] GetProcessHeap () returned 0xd20000 [0095.619] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.619] GetProcessHeap () returned 0xd20000 [0095.619] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.619] GetProcessHeap () returned 0xd20000 [0095.619] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.619] GetProcessHeap () returned 0xd20000 [0095.619] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.619] GetProcessHeap () returned 0xd20000 [0095.619] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.619] GetProcessHeap () returned 0xd20000 [0095.619] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.619] GetProcessHeap () returned 0xd20000 [0095.619] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.619] GetProcessHeap () returned 0xd20000 [0095.619] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.619] GetProcessHeap () returned 0xd20000 [0095.619] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.619] GetProcessHeap () returned 0xd20000 [0095.620] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.620] GetProcessHeap () returned 0xd20000 [0095.620] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.620] GetProcessHeap () returned 0xd20000 [0095.620] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.620] GetProcessHeap () returned 0xd20000 [0095.620] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.620] GetProcessHeap () returned 0xd20000 [0095.620] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.620] GetProcessHeap () returned 0xd20000 [0095.620] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.620] GetProcessHeap () returned 0xd20000 [0095.620] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.620] GetProcessHeap () returned 0xd20000 [0095.620] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.620] GetProcessHeap () returned 0xd20000 [0095.620] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.620] GetProcessHeap () returned 0xd20000 [0095.620] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.620] GetProcessHeap () returned 0xd20000 [0095.620] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.621] GetProcessHeap () returned 0xd20000 [0095.621] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.621] GetProcessHeap () returned 0xd20000 [0095.621] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.621] GetProcessHeap () returned 0xd20000 [0095.621] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.621] GetProcessHeap () returned 0xd20000 [0095.621] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.621] GetProcessHeap () returned 0xd20000 [0095.621] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.621] GetProcessHeap () returned 0xd20000 [0095.621] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.621] GetProcessHeap () returned 0xd20000 [0095.621] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.621] GetProcessHeap () returned 0xd20000 [0095.621] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.621] GetProcessHeap () returned 0xd20000 [0095.621] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.621] GetProcessHeap () returned 0xd20000 [0095.621] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.622] GetProcessHeap () returned 0xd20000 [0095.622] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.622] GetProcessHeap () returned 0xd20000 [0095.622] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.622] GetProcessHeap () returned 0xd20000 [0095.622] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.622] GetProcessHeap () returned 0xd20000 [0095.622] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.622] GetProcessHeap () returned 0xd20000 [0095.622] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.622] GetProcessHeap () returned 0xd20000 [0095.622] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.622] GetProcessHeap () returned 0xd20000 [0095.622] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.622] GetProcessHeap () returned 0xd20000 [0095.622] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.622] GetProcessHeap () returned 0xd20000 [0095.622] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.622] GetProcessHeap () returned 0xd20000 [0095.622] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.622] GetProcessHeap () returned 0xd20000 [0095.623] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.623] GetProcessHeap () returned 0xd20000 [0095.623] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.623] GetProcessHeap () returned 0xd20000 [0095.623] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.623] GetProcessHeap () returned 0xd20000 [0095.623] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.623] GetProcessHeap () returned 0xd20000 [0095.623] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.623] GetProcessHeap () returned 0xd20000 [0095.623] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0095.623] GetProcessHeap () returned 0xd20000 [0095.623] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0095.623] GetProcessHeap () returned 0xd20000 [0095.623] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.623] GetProcessHeap () returned 0xd20000 [0095.623] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.623] GetProcessHeap () returned 0xd20000 [0095.623] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.623] GetProcessHeap () returned 0xd20000 [0095.623] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.624] GetProcessHeap () returned 0xd20000 [0095.624] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0095.624] GetProcessHeap () returned 0xd20000 [0095.624] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0095.624] GetProcessHeap () returned 0xd20000 [0095.624] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0095.624] GetProcessHeap () returned 0xd20000 [0095.624] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0095.624] GetProcessHeap () returned 0xd20000 [0095.624] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446c0 | out: hHeap=0xd20000) returned 1 [0095.624] GetProcessHeap () returned 0xd20000 [0095.624] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aee8 | out: hHeap=0xd20000) returned 1 [0095.624] GetProcessHeap () returned 0xd20000 [0095.624] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0095.624] GetProcessHeap () returned 0xd20000 [0095.624] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0095.624] GetProcessHeap () returned 0xd20000 [0095.624] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0095.624] GetProcessHeap () returned 0xd20000 [0095.624] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0095.624] GetProcessHeap () returned 0xd20000 [0095.625] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0095.625] WriteFile (in: hFile=0x230, lpBuffer=0xd4dd78*, nNumberOfBytesToWrite=0x38c, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4dd78*, lpNumberOfBytesWritten=0x299d864*=0x38c, lpOverlapped=0x0) returned 1 [0095.631] GetProcessHeap () returned 0xd20000 [0095.631] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4dd78, Size=0x30) returned 0xd4dd78 [0095.631] GetProcessHeap () returned 0xd20000 [0095.632] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0095.632] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0095.632] GetProcessHeap () returned 0xd20000 [0095.632] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10ad0) returned 0xd4ddb0 [0095.632] ReadFile (in: hFile=0x230, lpBuffer=0xd4ddb0, nNumberOfBytesToRead=0x10ad0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4ddb0*, lpNumberOfBytesRead=0x299d7e8*=0x10ad0, lpOverlapped=0x0) returned 1 [0095.634] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0095.634] WriteFile (in: hFile=0x230, lpBuffer=0xd4ddb0*, nNumberOfBytesToWrite=0x10ad0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4ddb0*, lpNumberOfBytesWritten=0x299d7e4*=0x10ad0, lpOverlapped=0x0) returned 1 [0095.636] GetProcessHeap () returned 0xd20000 [0095.636] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ddb0 | out: hHeap=0xd20000) returned 1 [0095.637] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0095.637] WriteFile (in: hFile=0x230, lpBuffer=0xd4dd78*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4dd78*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0095.639] CloseHandle (hObject=0x230) returned 1 [0095.645] GetProcessHeap () returned 0xd20000 [0095.645] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd426c0 | out: hHeap=0xd20000) returned 1 [0095.645] GetProcessHeap () returned 0xd20000 [0095.645] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4be18 | out: hHeap=0xd20000) returned 1 [0095.645] GetProcessHeap () returned 0xd20000 [0095.645] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0095.645] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" [0095.645] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm.[ponce.lorena@aol.com]" [0095.645] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-br.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0095.646] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-br.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0095.646] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0095.646] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0095.646] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0095.646] GetProcessHeap () returned 0xd20000 [0095.647] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446a8 | out: hHeap=0xd20000) returned 1 [0095.647] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea401e7f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea401e7f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1158e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_pt-pt.htm", cAlternateFileName="EULA_P~3.HTM")) returned 1 [0095.647] lstrcmpiW (lpString1="EULA_pt-pt.htm", lpString2=".") returned 1 [0095.647] lstrcmpiW (lpString1="EULA_pt-pt.htm", lpString2="..") returned 1 [0095.647] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_pt-pt.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" [0095.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_pt-pt.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0095.647] GetProcessHeap () returned 0xd20000 [0095.647] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd44468 [0095.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_pt-pt.htm", cchWideChar=-1, lpMultiByteStr=0xd44468, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_pt-pt.htm", lpUsedDefaultChar=0x0) returned 15 [0095.647] lstrlenA (lpString="EULA_pt-pt.htm") returned 14 [0095.647] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0095.647] lstrlenA (lpString="EULA_pt-pt.htm") returned 14 [0095.647] lstrlenA (lpString=".dll") returned 4 [0095.647] lstrlenA (lpString=".dll") returned 4 [0095.647] lstrlenA (lpString="EULA_pt-pt.htm") returned 14 [0095.647] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0095.647] lstrlenA (lpString="EULA_pt-pt.htm") returned 14 [0095.648] lstrlenA (lpString=".ini") returned 4 [0095.648] lstrlenA (lpString=".ini") returned 4 [0095.648] lstrlenA (lpString="EULA_pt-pt.htm") returned 14 [0095.648] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0095.648] lstrlenA (lpString="EULA_pt-pt.htm") returned 14 [0095.648] lstrlenA (lpString=".inc") returned 4 [0095.648] lstrlenA (lpString=".inc") returned 4 [0095.648] lstrlenA (lpString="EULA_pt-pt.htm") returned 14 [0095.648] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0095.648] lstrcmpiW (lpString1="EULA_pt-pt.htm", lpString2="HOW_RECOVER.html") returned -1 [0095.648] lstrcmpiW (lpString1="EULA_pt-pt.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0095.648] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0095.648] lstrcmpiW (lpString1="EULA_pt-pt.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0095.648] GetProcessHeap () returned 0xd20000 [0095.648] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd426e8 [0095.648] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0095.649] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=71054) returned 1 [0095.649] GetProcessHeap () returned 0xd20000 [0095.649] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bf80 [0095.649] GetProcessHeap () returned 0xd20000 [0095.649] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0095.649] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm") returned 52 [0095.649] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0095.649] GetProcessHeap () returned 0xd20000 [0095.649] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0095.650] GetProcessHeap () returned 0xd20000 [0095.650] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x382) returned 0xd4ddb0 [0095.650] lstrlenA (lpString="rsa_encrypt") returned 11 [0095.650] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0095.652] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0095.652] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0095.652] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0095.652] GetProcessHeap () returned 0xd20000 [0095.652] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0095.652] lstrlenA (lpString="010001") returned 6 [0095.652] GetProcessHeap () returned 0xd20000 [0095.652] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0095.652] GetProcessHeap () returned 0xd20000 [0095.652] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0095.652] GetProcessHeap () returned 0xd20000 [0095.652] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b098 [0095.653] GetProcessHeap () returned 0xd20000 [0095.653] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0095.653] GetProcessHeap () returned 0xd20000 [0095.653] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b7e8 [0095.653] GetProcessHeap () returned 0xd20000 [0095.653] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45640 [0095.653] GetProcessHeap () returned 0xd20000 [0095.653] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd98 [0095.653] GetProcessHeap () returned 0xd20000 [0095.653] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0095.653] GetProcessHeap () returned 0xd20000 [0095.653] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.653] GetProcessHeap () returned 0xd20000 [0095.653] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44c68 [0095.653] GetProcessHeap () returned 0xd20000 [0095.653] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0095.653] GetProcessHeap () returned 0xd20000 [0095.653] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44808 [0095.653] GetProcessHeap () returned 0xd20000 [0095.654] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.654] GetProcessHeap () returned 0xd20000 [0095.654] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446d8 [0095.654] GetProcessHeap () returned 0xd20000 [0095.654] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b1b8 [0095.654] GetProcessHeap () returned 0xd20000 [0095.654] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0095.654] GetProcessHeap () returned 0xd20000 [0095.654] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0095.654] GetProcessHeap () returned 0xd20000 [0095.654] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b1b8 | out: hHeap=0xd20000) returned 1 [0095.654] GetProcessHeap () returned 0xd20000 [0095.654] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.654] GetProcessHeap () returned 0xd20000 [0095.654] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44498 [0095.654] GetProcessHeap () returned 0xd20000 [0095.654] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.654] GetProcessHeap () returned 0xd20000 [0095.654] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.654] GetProcessHeap () returned 0xd20000 [0095.655] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.655] GetProcessHeap () returned 0xd20000 [0095.655] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.655] GetProcessHeap () returned 0xd20000 [0095.655] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.655] GetProcessHeap () returned 0xd20000 [0095.655] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.655] GetProcessHeap () returned 0xd20000 [0095.655] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b638 [0095.655] GetProcessHeap () returned 0xd20000 [0095.655] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44498 | out: hHeap=0xd20000) returned 1 [0095.655] GetProcessHeap () returned 0xd20000 [0095.655] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0095.655] GetProcessHeap () returned 0xd20000 [0095.655] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b638 | out: hHeap=0xd20000) returned 1 [0095.655] GetProcessHeap () returned 0xd20000 [0095.655] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.655] GetProcessHeap () returned 0xd20000 [0095.655] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.656] GetProcessHeap () returned 0xd20000 [0095.656] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.656] GetProcessHeap () returned 0xd20000 [0095.656] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.656] GetProcessHeap () returned 0xd20000 [0095.656] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.656] GetProcessHeap () returned 0xd20000 [0095.656] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.656] GetProcessHeap () returned 0xd20000 [0095.656] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.656] GetProcessHeap () returned 0xd20000 [0095.656] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.656] GetProcessHeap () returned 0xd20000 [0095.656] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.656] GetProcessHeap () returned 0xd20000 [0095.656] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.656] GetProcessHeap () returned 0xd20000 [0095.656] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.657] GetProcessHeap () returned 0xd20000 [0095.657] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.657] GetProcessHeap () returned 0xd20000 [0095.657] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.657] GetProcessHeap () returned 0xd20000 [0095.657] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.657] GetProcessHeap () returned 0xd20000 [0095.657] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.657] GetProcessHeap () returned 0xd20000 [0095.657] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.657] GetProcessHeap () returned 0xd20000 [0095.657] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.657] GetProcessHeap () returned 0xd20000 [0095.657] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.657] GetProcessHeap () returned 0xd20000 [0095.657] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.657] GetProcessHeap () returned 0xd20000 [0095.657] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.657] GetProcessHeap () returned 0xd20000 [0095.658] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.658] GetProcessHeap () returned 0xd20000 [0095.658] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.658] GetProcessHeap () returned 0xd20000 [0095.658] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.658] GetProcessHeap () returned 0xd20000 [0095.658] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.658] GetProcessHeap () returned 0xd20000 [0095.658] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.658] GetProcessHeap () returned 0xd20000 [0095.658] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.658] GetProcessHeap () returned 0xd20000 [0095.658] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.658] GetProcessHeap () returned 0xd20000 [0095.658] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.658] GetProcessHeap () returned 0xd20000 [0095.658] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.658] GetProcessHeap () returned 0xd20000 [0095.658] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.658] GetProcessHeap () returned 0xd20000 [0095.659] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.659] GetProcessHeap () returned 0xd20000 [0095.659] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.659] GetProcessHeap () returned 0xd20000 [0095.659] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.659] GetProcessHeap () returned 0xd20000 [0095.659] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.659] GetProcessHeap () returned 0xd20000 [0095.659] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.659] GetProcessHeap () returned 0xd20000 [0095.659] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.659] GetProcessHeap () returned 0xd20000 [0095.659] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.659] GetProcessHeap () returned 0xd20000 [0095.659] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.659] GetProcessHeap () returned 0xd20000 [0095.659] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.659] GetProcessHeap () returned 0xd20000 [0095.659] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.660] GetProcessHeap () returned 0xd20000 [0095.660] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.660] GetProcessHeap () returned 0xd20000 [0095.660] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.660] GetProcessHeap () returned 0xd20000 [0095.660] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.660] GetProcessHeap () returned 0xd20000 [0095.660] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.660] GetProcessHeap () returned 0xd20000 [0095.660] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.660] GetProcessHeap () returned 0xd20000 [0095.660] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.660] GetProcessHeap () returned 0xd20000 [0095.660] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.660] GetProcessHeap () returned 0xd20000 [0095.660] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.660] GetProcessHeap () returned 0xd20000 [0095.660] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.660] GetProcessHeap () returned 0xd20000 [0095.660] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.661] GetProcessHeap () returned 0xd20000 [0095.661] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.661] GetProcessHeap () returned 0xd20000 [0095.661] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.661] GetProcessHeap () returned 0xd20000 [0095.661] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.661] GetProcessHeap () returned 0xd20000 [0095.661] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.661] GetProcessHeap () returned 0xd20000 [0095.661] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.661] GetProcessHeap () returned 0xd20000 [0095.661] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.661] GetProcessHeap () returned 0xd20000 [0095.661] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.661] GetProcessHeap () returned 0xd20000 [0095.661] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.661] GetProcessHeap () returned 0xd20000 [0095.661] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.662] GetProcessHeap () returned 0xd20000 [0095.662] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.662] GetProcessHeap () returned 0xd20000 [0095.662] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.662] GetProcessHeap () returned 0xd20000 [0095.662] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.662] GetProcessHeap () returned 0xd20000 [0095.662] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.662] GetProcessHeap () returned 0xd20000 [0095.662] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.662] GetProcessHeap () returned 0xd20000 [0095.662] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.662] GetProcessHeap () returned 0xd20000 [0095.662] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.662] GetProcessHeap () returned 0xd20000 [0095.662] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.662] GetProcessHeap () returned 0xd20000 [0095.662] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.662] GetProcessHeap () returned 0xd20000 [0095.662] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.663] GetProcessHeap () returned 0xd20000 [0095.663] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.663] GetProcessHeap () returned 0xd20000 [0095.663] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.663] GetProcessHeap () returned 0xd20000 [0095.663] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.663] GetProcessHeap () returned 0xd20000 [0095.663] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.663] GetProcessHeap () returned 0xd20000 [0095.663] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.663] GetProcessHeap () returned 0xd20000 [0095.663] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.663] GetProcessHeap () returned 0xd20000 [0095.663] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.663] GetProcessHeap () returned 0xd20000 [0095.663] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.663] GetProcessHeap () returned 0xd20000 [0095.663] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.663] GetProcessHeap () returned 0xd20000 [0095.663] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.664] GetProcessHeap () returned 0xd20000 [0095.664] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.664] GetProcessHeap () returned 0xd20000 [0095.664] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.664] GetProcessHeap () returned 0xd20000 [0095.664] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.664] GetProcessHeap () returned 0xd20000 [0095.664] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.664] GetProcessHeap () returned 0xd20000 [0095.664] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.664] GetProcessHeap () returned 0xd20000 [0095.664] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0095.664] GetProcessHeap () returned 0xd20000 [0095.664] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0095.664] GetProcessHeap () returned 0xd20000 [0095.664] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.664] GetProcessHeap () returned 0xd20000 [0095.664] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.664] GetProcessHeap () returned 0xd20000 [0095.664] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.665] GetProcessHeap () returned 0xd20000 [0095.665] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.665] GetProcessHeap () returned 0xd20000 [0095.665] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.665] GetProcessHeap () returned 0xd20000 [0095.665] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.665] GetProcessHeap () returned 0xd20000 [0095.665] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.665] GetProcessHeap () returned 0xd20000 [0095.665] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.665] GetProcessHeap () returned 0xd20000 [0095.665] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.665] GetProcessHeap () returned 0xd20000 [0095.665] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.665] GetProcessHeap () returned 0xd20000 [0095.665] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.665] GetProcessHeap () returned 0xd20000 [0095.665] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.665] GetProcessHeap () returned 0xd20000 [0095.665] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.665] GetProcessHeap () returned 0xd20000 [0095.666] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.666] GetProcessHeap () returned 0xd20000 [0095.666] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.666] GetProcessHeap () returned 0xd20000 [0095.666] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.666] GetProcessHeap () returned 0xd20000 [0095.666] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.666] GetProcessHeap () returned 0xd20000 [0095.666] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.666] GetProcessHeap () returned 0xd20000 [0095.666] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.666] GetProcessHeap () returned 0xd20000 [0095.666] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.666] GetProcessHeap () returned 0xd20000 [0095.666] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.666] GetProcessHeap () returned 0xd20000 [0095.666] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.666] GetProcessHeap () returned 0xd20000 [0095.666] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0095.666] GetProcessHeap () returned 0xd20000 [0095.667] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0095.667] GetProcessHeap () returned 0xd20000 [0095.667] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.667] GetProcessHeap () returned 0xd20000 [0095.667] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.667] GetProcessHeap () returned 0xd20000 [0095.667] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.667] GetProcessHeap () returned 0xd20000 [0095.667] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.667] GetProcessHeap () returned 0xd20000 [0095.667] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.667] GetProcessHeap () returned 0xd20000 [0095.667] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.667] GetProcessHeap () returned 0xd20000 [0095.667] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.667] GetProcessHeap () returned 0xd20000 [0095.667] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.667] GetProcessHeap () returned 0xd20000 [0095.667] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.667] GetProcessHeap () returned 0xd20000 [0095.668] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.668] GetProcessHeap () returned 0xd20000 [0095.668] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.668] GetProcessHeap () returned 0xd20000 [0095.668] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.668] GetProcessHeap () returned 0xd20000 [0095.668] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0095.668] GetProcessHeap () returned 0xd20000 [0095.668] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0095.668] GetProcessHeap () returned 0xd20000 [0095.668] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.668] GetProcessHeap () returned 0xd20000 [0095.668] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.668] GetProcessHeap () returned 0xd20000 [0095.668] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.668] GetProcessHeap () returned 0xd20000 [0095.668] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.668] GetProcessHeap () returned 0xd20000 [0095.668] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.668] GetProcessHeap () returned 0xd20000 [0095.669] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.669] GetProcessHeap () returned 0xd20000 [0095.669] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.669] GetProcessHeap () returned 0xd20000 [0095.669] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.669] GetProcessHeap () returned 0xd20000 [0095.669] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.669] GetProcessHeap () returned 0xd20000 [0095.669] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.669] GetProcessHeap () returned 0xd20000 [0095.669] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.669] GetProcessHeap () returned 0xd20000 [0095.669] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.669] GetProcessHeap () returned 0xd20000 [0095.669] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.669] GetProcessHeap () returned 0xd20000 [0095.669] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.669] GetProcessHeap () returned 0xd20000 [0095.669] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.669] GetProcessHeap () returned 0xd20000 [0095.669] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.670] GetProcessHeap () returned 0xd20000 [0095.670] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.670] GetProcessHeap () returned 0xd20000 [0095.670] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.670] GetProcessHeap () returned 0xd20000 [0095.670] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.670] GetProcessHeap () returned 0xd20000 [0095.670] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.670] GetProcessHeap () returned 0xd20000 [0095.670] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.670] GetProcessHeap () returned 0xd20000 [0095.670] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.670] GetProcessHeap () returned 0xd20000 [0095.670] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.670] GetProcessHeap () returned 0xd20000 [0095.670] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.670] GetProcessHeap () returned 0xd20000 [0095.670] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.670] GetProcessHeap () returned 0xd20000 [0095.670] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.671] GetProcessHeap () returned 0xd20000 [0095.671] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.671] GetProcessHeap () returned 0xd20000 [0095.671] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.671] GetProcessHeap () returned 0xd20000 [0095.671] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.671] GetProcessHeap () returned 0xd20000 [0095.671] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.671] GetProcessHeap () returned 0xd20000 [0095.671] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.671] GetProcessHeap () returned 0xd20000 [0095.671] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.671] GetProcessHeap () returned 0xd20000 [0095.671] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.671] GetProcessHeap () returned 0xd20000 [0095.671] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.671] GetProcessHeap () returned 0xd20000 [0095.671] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.671] GetProcessHeap () returned 0xd20000 [0095.672] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.672] GetProcessHeap () returned 0xd20000 [0095.672] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.672] GetProcessHeap () returned 0xd20000 [0095.672] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.672] GetProcessHeap () returned 0xd20000 [0095.672] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.672] GetProcessHeap () returned 0xd20000 [0095.672] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.672] GetProcessHeap () returned 0xd20000 [0095.672] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.672] GetProcessHeap () returned 0xd20000 [0095.672] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.672] GetProcessHeap () returned 0xd20000 [0095.672] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.672] GetProcessHeap () returned 0xd20000 [0095.672] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.672] GetProcessHeap () returned 0xd20000 [0095.672] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.672] GetProcessHeap () returned 0xd20000 [0095.672] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.672] GetProcessHeap () returned 0xd20000 [0095.673] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0095.673] GetProcessHeap () returned 0xd20000 [0095.673] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0095.673] GetProcessHeap () returned 0xd20000 [0095.673] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0095.673] GetProcessHeap () returned 0xd20000 [0095.673] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0095.673] GetProcessHeap () returned 0xd20000 [0095.673] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446d8 | out: hHeap=0xd20000) returned 1 [0095.673] GetProcessHeap () returned 0xd20000 [0095.673] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0095.673] GetProcessHeap () returned 0xd20000 [0095.673] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0095.673] GetProcessHeap () returned 0xd20000 [0095.673] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b098 | out: hHeap=0xd20000) returned 1 [0095.673] GetProcessHeap () returned 0xd20000 [0095.673] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0095.673] GetProcessHeap () returned 0xd20000 [0095.673] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.674] GetProcessHeap () returned 0xd20000 [0095.674] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0095.674] WriteFile (in: hFile=0x230, lpBuffer=0xd4ddb0*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ddb0*, lpNumberOfBytesWritten=0x299d864*=0x382, lpOverlapped=0x0) returned 1 [0095.682] GetProcessHeap () returned 0xd20000 [0095.682] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4ddb0, Size=0x30) returned 0xd4ddb0 [0095.682] GetProcessHeap () returned 0xd20000 [0095.682] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0095.682] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0095.682] GetProcessHeap () returned 0xd20000 [0095.682] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x11590) returned 0xd4dde8 [0095.683] ReadFile (in: hFile=0x230, lpBuffer=0xd4dde8, nNumberOfBytesToRead=0x11590, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4dde8*, lpNumberOfBytesRead=0x299d7e8*=0x11590, lpOverlapped=0x0) returned 1 [0095.686] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0095.686] WriteFile (in: hFile=0x230, lpBuffer=0xd4dde8*, nNumberOfBytesToWrite=0x11590, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4dde8*, lpNumberOfBytesWritten=0x299d7e4*=0x11590, lpOverlapped=0x0) returned 1 [0095.689] GetProcessHeap () returned 0xd20000 [0095.689] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4dde8 | out: hHeap=0xd20000) returned 1 [0095.689] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0095.689] WriteFile (in: hFile=0x230, lpBuffer=0xd4ddb0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ddb0*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0095.691] CloseHandle (hObject=0x230) returned 1 [0095.697] GetProcessHeap () returned 0xd20000 [0095.697] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd426e8 | out: hHeap=0xd20000) returned 1 [0095.697] GetProcessHeap () returned 0xd20000 [0095.697] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bf80 | out: hHeap=0xd20000) returned 1 [0095.697] GetProcessHeap () returned 0xd20000 [0095.697] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0095.698] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" [0095.698] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm.[ponce.lorena@aol.com]" [0095.698] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_pt-pt.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0095.699] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_pt-pt.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0095.699] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0095.699] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0095.699] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0095.699] GetProcessHeap () returned 0xd20000 [0095.699] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44468 | out: hHeap=0xd20000) returned 1 [0095.699] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5c6190, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5c6190, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_ro-ro.htm", cAlternateFileName="EULA_R~1.HTM")) returned 1 [0095.699] lstrcmpiW (lpString1="EULA_ro-ro.htm", lpString2=".") returned 1 [0095.699] lstrcmpiW (lpString1="EULA_ro-ro.htm", lpString2="..") returned 1 [0095.699] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_ro-ro.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" [0095.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_ro-ro.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0095.700] GetProcessHeap () returned 0xd20000 [0095.700] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd445d0 [0095.700] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_ro-ro.htm", cchWideChar=-1, lpMultiByteStr=0xd445d0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_ro-ro.htm", lpUsedDefaultChar=0x0) returned 15 [0095.700] lstrlenA (lpString="EULA_ro-ro.htm") returned 14 [0095.700] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0095.700] lstrlenA (lpString="EULA_ro-ro.htm") returned 14 [0095.700] lstrlenA (lpString=".dll") returned 4 [0095.700] lstrlenA (lpString=".dll") returned 4 [0095.700] lstrlenA (lpString="EULA_ro-ro.htm") returned 14 [0095.700] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0095.700] lstrlenA (lpString="EULA_ro-ro.htm") returned 14 [0095.700] lstrlenA (lpString=".ini") returned 4 [0095.700] lstrlenA (lpString=".ini") returned 4 [0095.700] lstrlenA (lpString="EULA_ro-ro.htm") returned 14 [0095.700] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0095.700] lstrlenA (lpString="EULA_ro-ro.htm") returned 14 [0095.700] lstrlenA (lpString=".inc") returned 4 [0095.701] lstrlenA (lpString=".inc") returned 4 [0095.701] lstrlenA (lpString="EULA_ro-ro.htm") returned 14 [0095.701] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0095.701] lstrcmpiW (lpString1="EULA_ro-ro.htm", lpString2="HOW_RECOVER.html") returned -1 [0095.701] lstrcmpiW (lpString1="EULA_ro-ro.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0095.701] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0095.701] lstrcmpiW (lpString1="EULA_ro-ro.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0095.701] GetProcessHeap () returned 0xd20000 [0095.701] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42620 [0095.701] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0095.702] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=78176) returned 1 [0095.702] GetProcessHeap () returned 0xd20000 [0095.703] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c1d8 [0095.703] GetProcessHeap () returned 0xd20000 [0095.703] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0095.703] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm") returned 52 [0095.703] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0095.703] GetProcessHeap () returned 0xd20000 [0095.703] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0095.703] GetProcessHeap () returned 0xd20000 [0095.703] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4dde8 [0095.703] lstrlenA (lpString="rsa_encrypt") returned 11 [0095.704] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0095.706] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0095.706] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0095.706] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0095.706] GetProcessHeap () returned 0xd20000 [0095.706] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0095.706] lstrlenA (lpString="010001") returned 6 [0095.706] GetProcessHeap () returned 0xd20000 [0095.706] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd98 [0095.707] GetProcessHeap () returned 0xd20000 [0095.707] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0095.707] GetProcessHeap () returned 0xd20000 [0095.707] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aaf8 [0095.707] GetProcessHeap () returned 0xd20000 [0095.707] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0095.707] GetProcessHeap () returned 0xd20000 [0095.707] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b7e8 [0095.707] GetProcessHeap () returned 0xd20000 [0095.707] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd452f8 [0095.707] GetProcessHeap () returned 0xd20000 [0095.707] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0095.707] GetProcessHeap () returned 0xd20000 [0095.707] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0095.707] GetProcessHeap () returned 0xd20000 [0095.707] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.707] GetProcessHeap () returned 0xd20000 [0095.707] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0095.707] GetProcessHeap () returned 0xd20000 [0095.708] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0095.708] GetProcessHeap () returned 0xd20000 [0095.708] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44d80 [0095.708] GetProcessHeap () returned 0xd20000 [0095.708] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.708] GetProcessHeap () returned 0xd20000 [0095.708] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44600 [0095.708] GetProcessHeap () returned 0xd20000 [0095.708] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b758 [0095.708] GetProcessHeap () returned 0xd20000 [0095.708] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0095.708] GetProcessHeap () returned 0xd20000 [0095.708] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0095.708] GetProcessHeap () returned 0xd20000 [0095.708] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b758 | out: hHeap=0xd20000) returned 1 [0095.708] GetProcessHeap () returned 0xd20000 [0095.708] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.708] GetProcessHeap () returned 0xd20000 [0095.708] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446c0 [0095.708] GetProcessHeap () returned 0xd20000 [0095.709] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.709] GetProcessHeap () returned 0xd20000 [0095.709] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.709] GetProcessHeap () returned 0xd20000 [0095.709] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.709] GetProcessHeap () returned 0xd20000 [0095.709] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.709] GetProcessHeap () returned 0xd20000 [0095.709] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.709] GetProcessHeap () returned 0xd20000 [0095.709] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.709] GetProcessHeap () returned 0xd20000 [0095.709] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b098 [0095.709] GetProcessHeap () returned 0xd20000 [0095.709] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446c0 | out: hHeap=0xd20000) returned 1 [0095.709] GetProcessHeap () returned 0xd20000 [0095.709] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0095.709] GetProcessHeap () returned 0xd20000 [0095.710] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b098 | out: hHeap=0xd20000) returned 1 [0095.710] GetProcessHeap () returned 0xd20000 [0095.710] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.710] GetProcessHeap () returned 0xd20000 [0095.710] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.710] GetProcessHeap () returned 0xd20000 [0095.710] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.710] GetProcessHeap () returned 0xd20000 [0095.710] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.710] GetProcessHeap () returned 0xd20000 [0095.710] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.710] GetProcessHeap () returned 0xd20000 [0095.710] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.710] GetProcessHeap () returned 0xd20000 [0095.710] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.710] GetProcessHeap () returned 0xd20000 [0095.710] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.710] GetProcessHeap () returned 0xd20000 [0095.710] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.711] GetProcessHeap () returned 0xd20000 [0095.711] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.711] GetProcessHeap () returned 0xd20000 [0095.711] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.711] GetProcessHeap () returned 0xd20000 [0095.711] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.711] GetProcessHeap () returned 0xd20000 [0095.711] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.711] GetProcessHeap () returned 0xd20000 [0095.711] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.711] GetProcessHeap () returned 0xd20000 [0095.711] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.711] GetProcessHeap () returned 0xd20000 [0095.711] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.711] GetProcessHeap () returned 0xd20000 [0095.711] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.711] GetProcessHeap () returned 0xd20000 [0095.711] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.712] GetProcessHeap () returned 0xd20000 [0095.712] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.712] GetProcessHeap () returned 0xd20000 [0095.712] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.712] GetProcessHeap () returned 0xd20000 [0095.712] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.712] GetProcessHeap () returned 0xd20000 [0095.712] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.712] GetProcessHeap () returned 0xd20000 [0095.712] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.712] GetProcessHeap () returned 0xd20000 [0095.712] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.712] GetProcessHeap () returned 0xd20000 [0095.712] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.712] GetProcessHeap () returned 0xd20000 [0095.712] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.712] GetProcessHeap () returned 0xd20000 [0095.712] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.712] GetProcessHeap () returned 0xd20000 [0095.713] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.713] GetProcessHeap () returned 0xd20000 [0095.713] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.713] GetProcessHeap () returned 0xd20000 [0095.713] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.713] GetProcessHeap () returned 0xd20000 [0095.713] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.713] GetProcessHeap () returned 0xd20000 [0095.713] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.713] GetProcessHeap () returned 0xd20000 [0095.713] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.713] GetProcessHeap () returned 0xd20000 [0095.713] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.713] GetProcessHeap () returned 0xd20000 [0095.713] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0095.713] GetProcessHeap () returned 0xd20000 [0095.713] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0095.713] GetProcessHeap () returned 0xd20000 [0095.714] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.714] GetProcessHeap () returned 0xd20000 [0095.714] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.714] GetProcessHeap () returned 0xd20000 [0095.714] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.714] GetProcessHeap () returned 0xd20000 [0095.714] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.714] GetProcessHeap () returned 0xd20000 [0095.714] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.714] GetProcessHeap () returned 0xd20000 [0095.714] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.714] GetProcessHeap () returned 0xd20000 [0095.714] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.714] GetProcessHeap () returned 0xd20000 [0095.715] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.715] GetProcessHeap () returned 0xd20000 [0095.715] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.715] GetProcessHeap () returned 0xd20000 [0095.715] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.715] GetProcessHeap () returned 0xd20000 [0095.715] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.715] GetProcessHeap () returned 0xd20000 [0095.715] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.715] GetProcessHeap () returned 0xd20000 [0095.715] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0095.715] GetProcessHeap () returned 0xd20000 [0095.715] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0095.715] GetProcessHeap () returned 0xd20000 [0095.715] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.715] GetProcessHeap () returned 0xd20000 [0095.715] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.715] GetProcessHeap () returned 0xd20000 [0095.716] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.716] GetProcessHeap () returned 0xd20000 [0095.716] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.716] GetProcessHeap () returned 0xd20000 [0095.716] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0095.716] GetProcessHeap () returned 0xd20000 [0095.716] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0095.716] GetProcessHeap () returned 0xd20000 [0095.716] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.716] GetProcessHeap () returned 0xd20000 [0095.716] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.716] GetProcessHeap () returned 0xd20000 [0095.716] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.716] GetProcessHeap () returned 0xd20000 [0095.716] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.716] GetProcessHeap () returned 0xd20000 [0095.716] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.716] GetProcessHeap () returned 0xd20000 [0095.717] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.717] GetProcessHeap () returned 0xd20000 [0095.717] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.717] GetProcessHeap () returned 0xd20000 [0095.717] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.717] GetProcessHeap () returned 0xd20000 [0095.717] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.717] GetProcessHeap () returned 0xd20000 [0095.717] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.717] GetProcessHeap () returned 0xd20000 [0095.717] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0095.717] GetProcessHeap () returned 0xd20000 [0095.717] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0095.717] GetProcessHeap () returned 0xd20000 [0095.717] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.717] GetProcessHeap () returned 0xd20000 [0095.717] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.717] GetProcessHeap () returned 0xd20000 [0095.717] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.718] GetProcessHeap () returned 0xd20000 [0095.718] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.718] GetProcessHeap () returned 0xd20000 [0095.718] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.718] GetProcessHeap () returned 0xd20000 [0095.718] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.718] GetProcessHeap () returned 0xd20000 [0095.718] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.718] GetProcessHeap () returned 0xd20000 [0095.718] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.718] GetProcessHeap () returned 0xd20000 [0095.718] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.718] GetProcessHeap () returned 0xd20000 [0095.718] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.718] GetProcessHeap () returned 0xd20000 [0095.718] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.718] GetProcessHeap () returned 0xd20000 [0095.718] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.718] GetProcessHeap () returned 0xd20000 [0095.718] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.719] GetProcessHeap () returned 0xd20000 [0095.719] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.719] GetProcessHeap () returned 0xd20000 [0095.719] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.719] GetProcessHeap () returned 0xd20000 [0095.720] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.720] GetProcessHeap () returned 0xd20000 [0095.720] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.720] GetProcessHeap () returned 0xd20000 [0095.720] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.720] GetProcessHeap () returned 0xd20000 [0095.720] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.720] GetProcessHeap () returned 0xd20000 [0095.720] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.720] GetProcessHeap () returned 0xd20000 [0095.720] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.720] GetProcessHeap () returned 0xd20000 [0095.720] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.720] GetProcessHeap () returned 0xd20000 [0095.721] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.721] GetProcessHeap () returned 0xd20000 [0095.721] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.721] GetProcessHeap () returned 0xd20000 [0095.721] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.721] GetProcessHeap () returned 0xd20000 [0095.721] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.721] GetProcessHeap () returned 0xd20000 [0095.721] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.721] GetProcessHeap () returned 0xd20000 [0095.721] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.721] GetProcessHeap () returned 0xd20000 [0095.721] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.721] GetProcessHeap () returned 0xd20000 [0095.721] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.721] GetProcessHeap () returned 0xd20000 [0095.721] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.721] GetProcessHeap () returned 0xd20000 [0095.721] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.722] GetProcessHeap () returned 0xd20000 [0095.722] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.722] GetProcessHeap () returned 0xd20000 [0095.722] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.722] GetProcessHeap () returned 0xd20000 [0095.722] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.722] GetProcessHeap () returned 0xd20000 [0095.722] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.722] GetProcessHeap () returned 0xd20000 [0095.722] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.722] GetProcessHeap () returned 0xd20000 [0095.722] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.722] GetProcessHeap () returned 0xd20000 [0095.722] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.722] GetProcessHeap () returned 0xd20000 [0095.722] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.723] GetProcessHeap () returned 0xd20000 [0095.723] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.723] GetProcessHeap () returned 0xd20000 [0095.723] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.723] GetProcessHeap () returned 0xd20000 [0095.723] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.723] GetProcessHeap () returned 0xd20000 [0095.723] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.723] GetProcessHeap () returned 0xd20000 [0095.723] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.723] GetProcessHeap () returned 0xd20000 [0095.723] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.723] GetProcessHeap () returned 0xd20000 [0095.723] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.723] GetProcessHeap () returned 0xd20000 [0095.723] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.723] GetProcessHeap () returned 0xd20000 [0095.723] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.723] GetProcessHeap () returned 0xd20000 [0095.724] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.724] GetProcessHeap () returned 0xd20000 [0095.724] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.724] GetProcessHeap () returned 0xd20000 [0095.724] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.724] GetProcessHeap () returned 0xd20000 [0095.724] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.724] GetProcessHeap () returned 0xd20000 [0095.724] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.724] GetProcessHeap () returned 0xd20000 [0095.724] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.724] GetProcessHeap () returned 0xd20000 [0095.724] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.724] GetProcessHeap () returned 0xd20000 [0095.724] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.724] GetProcessHeap () returned 0xd20000 [0095.725] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.725] GetProcessHeap () returned 0xd20000 [0095.725] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.725] GetProcessHeap () returned 0xd20000 [0095.725] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.725] GetProcessHeap () returned 0xd20000 [0095.725] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.725] GetProcessHeap () returned 0xd20000 [0095.725] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.725] GetProcessHeap () returned 0xd20000 [0095.725] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.725] GetProcessHeap () returned 0xd20000 [0095.725] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.725] GetProcessHeap () returned 0xd20000 [0095.725] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.725] GetProcessHeap () returned 0xd20000 [0095.725] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.725] GetProcessHeap () returned 0xd20000 [0095.725] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.726] GetProcessHeap () returned 0xd20000 [0095.726] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.726] GetProcessHeap () returned 0xd20000 [0095.726] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0095.726] GetProcessHeap () returned 0xd20000 [0095.726] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0095.726] GetProcessHeap () returned 0xd20000 [0095.726] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.726] GetProcessHeap () returned 0xd20000 [0095.726] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.726] GetProcessHeap () returned 0xd20000 [0095.726] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.726] GetProcessHeap () returned 0xd20000 [0095.726] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.726] GetProcessHeap () returned 0xd20000 [0095.726] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.726] GetProcessHeap () returned 0xd20000 [0095.726] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.727] GetProcessHeap () returned 0xd20000 [0095.727] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.727] GetProcessHeap () returned 0xd20000 [0095.727] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.727] GetProcessHeap () returned 0xd20000 [0095.727] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.727] GetProcessHeap () returned 0xd20000 [0095.727] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.727] GetProcessHeap () returned 0xd20000 [0095.727] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.727] GetProcessHeap () returned 0xd20000 [0095.727] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.727] GetProcessHeap () returned 0xd20000 [0095.727] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.727] GetProcessHeap () returned 0xd20000 [0095.727] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.727] GetProcessHeap () returned 0xd20000 [0095.727] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.727] GetProcessHeap () returned 0xd20000 [0095.728] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.728] GetProcessHeap () returned 0xd20000 [0095.728] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.728] GetProcessHeap () returned 0xd20000 [0095.728] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.728] GetProcessHeap () returned 0xd20000 [0095.728] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.728] GetProcessHeap () returned 0xd20000 [0095.728] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.728] GetProcessHeap () returned 0xd20000 [0095.728] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.728] GetProcessHeap () returned 0xd20000 [0095.728] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.728] GetProcessHeap () returned 0xd20000 [0095.728] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.728] GetProcessHeap () returned 0xd20000 [0095.728] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.728] GetProcessHeap () returned 0xd20000 [0095.728] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.729] GetProcessHeap () returned 0xd20000 [0095.729] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.729] GetProcessHeap () returned 0xd20000 [0095.729] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.729] GetProcessHeap () returned 0xd20000 [0095.729] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.729] GetProcessHeap () returned 0xd20000 [0095.729] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.729] GetProcessHeap () returned 0xd20000 [0095.729] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.729] GetProcessHeap () returned 0xd20000 [0095.729] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0095.729] GetProcessHeap () returned 0xd20000 [0095.729] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0095.729] GetProcessHeap () returned 0xd20000 [0095.729] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0095.729] GetProcessHeap () returned 0xd20000 [0095.729] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0095.729] GetProcessHeap () returned 0xd20000 [0095.729] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0095.730] GetProcessHeap () returned 0xd20000 [0095.730] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0095.730] GetProcessHeap () returned 0xd20000 [0095.730] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44600 | out: hHeap=0xd20000) returned 1 [0095.730] GetProcessHeap () returned 0xd20000 [0095.730] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0095.730] GetProcessHeap () returned 0xd20000 [0095.730] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0095.730] GetProcessHeap () returned 0xd20000 [0095.730] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aaf8 | out: hHeap=0xd20000) returned 1 [0095.730] GetProcessHeap () returned 0xd20000 [0095.730] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0095.730] GetProcessHeap () returned 0xd20000 [0095.730] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.730] GetProcessHeap () returned 0xd20000 [0095.730] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0095.730] WriteFile (in: hFile=0x230, lpBuffer=0xd4dde8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4dde8*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0095.736] GetProcessHeap () returned 0xd20000 [0095.736] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4dde8, Size=0x30) returned 0xd4dde8 [0095.736] GetProcessHeap () returned 0xd20000 [0095.736] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0095.736] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0095.736] GetProcessHeap () returned 0xd20000 [0095.736] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x13160) returned 0xd4de20 [0095.736] ReadFile (in: hFile=0x230, lpBuffer=0xd4de20, nNumberOfBytesToRead=0x13160, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4de20*, lpNumberOfBytesRead=0x299d7e8*=0x13160, lpOverlapped=0x0) returned 1 [0095.739] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0095.739] WriteFile (in: hFile=0x230, lpBuffer=0xd4de20*, nNumberOfBytesToWrite=0x13160, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4de20*, lpNumberOfBytesWritten=0x299d7e4*=0x13160, lpOverlapped=0x0) returned 1 [0095.742] GetProcessHeap () returned 0xd20000 [0095.742] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4de20 | out: hHeap=0xd20000) returned 1 [0095.742] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0095.743] WriteFile (in: hFile=0x230, lpBuffer=0xd4dde8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4dde8*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0095.744] CloseHandle (hObject=0x230) returned 1 [0095.752] GetProcessHeap () returned 0xd20000 [0095.752] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42620 | out: hHeap=0xd20000) returned 1 [0095.752] GetProcessHeap () returned 0xd20000 [0095.752] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c1d8 | out: hHeap=0xd20000) returned 1 [0095.752] GetProcessHeap () returned 0xd20000 [0095.752] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0095.752] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" [0095.752] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm.[ponce.lorena@aol.com]" [0095.752] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ro-ro.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0095.753] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ro-ro.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0095.753] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0095.753] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0095.753] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0095.753] GetProcessHeap () returned 0xd20000 [0095.753] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445d0 | out: hHeap=0xd20000) returned 1 [0095.754] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5cfdc2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5cfdc2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x454cc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_ru-ru.htm", cAlternateFileName="EULA_R~2.HTM")) returned 1 [0095.754] lstrcmpiW (lpString1="EULA_ru-ru.htm", lpString2=".") returned 1 [0095.754] lstrcmpiW (lpString1="EULA_ru-ru.htm", lpString2="..") returned 1 [0095.754] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_ru-ru.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" [0095.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_ru-ru.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0095.754] GetProcessHeap () returned 0xd20000 [0095.754] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd44528 [0095.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_ru-ru.htm", cchWideChar=-1, lpMultiByteStr=0xd44528, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_ru-ru.htm", lpUsedDefaultChar=0x0) returned 15 [0095.754] lstrlenA (lpString="EULA_ru-ru.htm") returned 14 [0095.754] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0095.754] lstrlenA (lpString="EULA_ru-ru.htm") returned 14 [0095.754] lstrlenA (lpString=".dll") returned 4 [0095.754] lstrlenA (lpString=".dll") returned 4 [0095.754] lstrlenA (lpString="EULA_ru-ru.htm") returned 14 [0095.754] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0095.754] lstrlenA (lpString="EULA_ru-ru.htm") returned 14 [0095.754] lstrlenA (lpString=".ini") returned 4 [0095.754] lstrlenA (lpString=".ini") returned 4 [0095.754] lstrlenA (lpString="EULA_ru-ru.htm") returned 14 [0095.755] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0095.755] lstrlenA (lpString="EULA_ru-ru.htm") returned 14 [0095.755] lstrlenA (lpString=".inc") returned 4 [0095.755] lstrlenA (lpString=".inc") returned 4 [0095.755] lstrlenA (lpString="EULA_ru-ru.htm") returned 14 [0095.755] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0095.755] lstrcmpiW (lpString1="EULA_ru-ru.htm", lpString2="HOW_RECOVER.html") returned -1 [0095.755] lstrcmpiW (lpString1="EULA_ru-ru.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0095.755] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0095.755] lstrcmpiW (lpString1="EULA_ru-ru.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0095.755] GetProcessHeap () returned 0xd20000 [0095.755] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd424e0 [0095.755] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0095.756] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=283852) returned 1 [0095.756] GetProcessHeap () returned 0xd20000 [0095.756] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4be18 [0095.756] GetProcessHeap () returned 0xd20000 [0095.756] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0095.756] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm") returned 52 [0095.756] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0095.756] GetProcessHeap () returned 0xd20000 [0095.756] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0095.756] GetProcessHeap () returned 0xd20000 [0095.756] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x384) returned 0xd4de20 [0095.757] lstrlenA (lpString="rsa_encrypt") returned 11 [0095.757] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0095.759] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0095.759] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0095.759] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0095.759] GetProcessHeap () returned 0xd20000 [0095.759] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0095.759] lstrlenA (lpString="010001") returned 6 [0095.759] GetProcessHeap () returned 0xd20000 [0095.759] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0095.759] GetProcessHeap () returned 0xd20000 [0095.759] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0095.760] GetProcessHeap () returned 0xd20000 [0095.760] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4a948 [0095.760] GetProcessHeap () returned 0xd20000 [0095.760] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0095.760] GetProcessHeap () returned 0xd20000 [0095.760] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b6c8 [0095.760] GetProcessHeap () returned 0xd20000 [0095.760] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44e98 [0095.760] GetProcessHeap () returned 0xd20000 [0095.760] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cbf8 [0095.760] GetProcessHeap () returned 0xd20000 [0095.760] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0095.760] GetProcessHeap () returned 0xd20000 [0095.760] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.760] GetProcessHeap () returned 0xd20000 [0095.760] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0095.760] GetProcessHeap () returned 0xd20000 [0095.760] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0095.760] GetProcessHeap () returned 0xd20000 [0095.760] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd451e0 [0095.761] GetProcessHeap () returned 0xd20000 [0095.761] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.761] GetProcessHeap () returned 0xd20000 [0095.761] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44510 [0095.761] GetProcessHeap () returned 0xd20000 [0095.761] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b758 [0095.761] GetProcessHeap () returned 0xd20000 [0095.761] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0095.761] GetProcessHeap () returned 0xd20000 [0095.761] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0095.761] GetProcessHeap () returned 0xd20000 [0095.761] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b758 | out: hHeap=0xd20000) returned 1 [0095.761] GetProcessHeap () returned 0xd20000 [0095.761] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.761] GetProcessHeap () returned 0xd20000 [0095.761] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444c8 [0095.761] GetProcessHeap () returned 0xd20000 [0095.761] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.761] GetProcessHeap () returned 0xd20000 [0095.761] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.762] GetProcessHeap () returned 0xd20000 [0095.762] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.762] GetProcessHeap () returned 0xd20000 [0095.762] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.762] GetProcessHeap () returned 0xd20000 [0095.762] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.762] GetProcessHeap () returned 0xd20000 [0095.762] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.762] GetProcessHeap () returned 0xd20000 [0095.762] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4a9d8 [0095.762] GetProcessHeap () returned 0xd20000 [0095.762] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444c8 | out: hHeap=0xd20000) returned 1 [0095.762] GetProcessHeap () returned 0xd20000 [0095.762] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0095.762] GetProcessHeap () returned 0xd20000 [0095.762] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a9d8 | out: hHeap=0xd20000) returned 1 [0095.762] GetProcessHeap () returned 0xd20000 [0095.762] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.762] GetProcessHeap () returned 0xd20000 [0095.763] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.763] GetProcessHeap () returned 0xd20000 [0095.763] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.763] GetProcessHeap () returned 0xd20000 [0095.763] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.763] GetProcessHeap () returned 0xd20000 [0095.763] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.763] GetProcessHeap () returned 0xd20000 [0095.763] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.763] GetProcessHeap () returned 0xd20000 [0095.763] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.763] GetProcessHeap () returned 0xd20000 [0095.763] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.763] GetProcessHeap () returned 0xd20000 [0095.763] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.763] GetProcessHeap () returned 0xd20000 [0095.763] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.763] GetProcessHeap () returned 0xd20000 [0095.763] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.763] GetProcessHeap () returned 0xd20000 [0095.764] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.764] GetProcessHeap () returned 0xd20000 [0095.764] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.764] GetProcessHeap () returned 0xd20000 [0095.764] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.764] GetProcessHeap () returned 0xd20000 [0095.764] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.764] GetProcessHeap () returned 0xd20000 [0095.764] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.764] GetProcessHeap () returned 0xd20000 [0095.764] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.764] GetProcessHeap () returned 0xd20000 [0095.764] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.764] GetProcessHeap () returned 0xd20000 [0095.764] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.764] GetProcessHeap () returned 0xd20000 [0095.764] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.764] GetProcessHeap () returned 0xd20000 [0095.765] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.765] GetProcessHeap () returned 0xd20000 [0095.765] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.765] GetProcessHeap () returned 0xd20000 [0095.765] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.765] GetProcessHeap () returned 0xd20000 [0095.765] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.765] GetProcessHeap () returned 0xd20000 [0095.765] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.765] GetProcessHeap () returned 0xd20000 [0095.765] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.765] GetProcessHeap () returned 0xd20000 [0095.765] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.765] GetProcessHeap () returned 0xd20000 [0095.765] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.765] GetProcessHeap () returned 0xd20000 [0095.765] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.765] GetProcessHeap () returned 0xd20000 [0095.765] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.765] GetProcessHeap () returned 0xd20000 [0095.766] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.766] GetProcessHeap () returned 0xd20000 [0095.766] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.766] GetProcessHeap () returned 0xd20000 [0095.766] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.766] GetProcessHeap () returned 0xd20000 [0095.766] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.766] GetProcessHeap () returned 0xd20000 [0095.766] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.766] GetProcessHeap () returned 0xd20000 [0095.766] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.766] GetProcessHeap () returned 0xd20000 [0095.766] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.766] GetProcessHeap () returned 0xd20000 [0095.766] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.766] GetProcessHeap () returned 0xd20000 [0095.766] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.767] GetProcessHeap () returned 0xd20000 [0095.767] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.767] GetProcessHeap () returned 0xd20000 [0095.767] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.767] GetProcessHeap () returned 0xd20000 [0095.767] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.767] GetProcessHeap () returned 0xd20000 [0095.767] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.767] GetProcessHeap () returned 0xd20000 [0095.767] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.767] GetProcessHeap () returned 0xd20000 [0095.767] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.767] GetProcessHeap () returned 0xd20000 [0095.767] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.767] GetProcessHeap () returned 0xd20000 [0095.767] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.767] GetProcessHeap () returned 0xd20000 [0095.767] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.767] GetProcessHeap () returned 0xd20000 [0095.767] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.768] GetProcessHeap () returned 0xd20000 [0095.768] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.768] GetProcessHeap () returned 0xd20000 [0095.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.768] GetProcessHeap () returned 0xd20000 [0095.768] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.768] GetProcessHeap () returned 0xd20000 [0095.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.768] GetProcessHeap () returned 0xd20000 [0095.768] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.768] GetProcessHeap () returned 0xd20000 [0095.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.768] GetProcessHeap () returned 0xd20000 [0095.768] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.768] GetProcessHeap () returned 0xd20000 [0095.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0095.768] GetProcessHeap () returned 0xd20000 [0095.768] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0095.768] GetProcessHeap () returned 0xd20000 [0095.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.768] GetProcessHeap () returned 0xd20000 [0095.769] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.769] GetProcessHeap () returned 0xd20000 [0095.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.769] GetProcessHeap () returned 0xd20000 [0095.769] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.769] GetProcessHeap () returned 0xd20000 [0095.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.769] GetProcessHeap () returned 0xd20000 [0095.769] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.769] GetProcessHeap () returned 0xd20000 [0095.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.769] GetProcessHeap () returned 0xd20000 [0095.769] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.769] GetProcessHeap () returned 0xd20000 [0095.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.769] GetProcessHeap () returned 0xd20000 [0095.769] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.769] GetProcessHeap () returned 0xd20000 [0095.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.769] GetProcessHeap () returned 0xd20000 [0095.770] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.770] GetProcessHeap () returned 0xd20000 [0095.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.770] GetProcessHeap () returned 0xd20000 [0095.770] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.770] GetProcessHeap () returned 0xd20000 [0095.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.770] GetProcessHeap () returned 0xd20000 [0095.770] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.770] GetProcessHeap () returned 0xd20000 [0095.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.770] GetProcessHeap () returned 0xd20000 [0095.770] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.770] GetProcessHeap () returned 0xd20000 [0095.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.770] GetProcessHeap () returned 0xd20000 [0095.770] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.770] GetProcessHeap () returned 0xd20000 [0095.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.770] GetProcessHeap () returned 0xd20000 [0095.771] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.771] GetProcessHeap () returned 0xd20000 [0095.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0095.771] GetProcessHeap () returned 0xd20000 [0095.771] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0095.771] GetProcessHeap () returned 0xd20000 [0095.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.771] GetProcessHeap () returned 0xd20000 [0095.771] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.771] GetProcessHeap () returned 0xd20000 [0095.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.771] GetProcessHeap () returned 0xd20000 [0095.771] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.771] GetProcessHeap () returned 0xd20000 [0095.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.771] GetProcessHeap () returned 0xd20000 [0095.771] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.771] GetProcessHeap () returned 0xd20000 [0095.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.771] GetProcessHeap () returned 0xd20000 [0095.772] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.772] GetProcessHeap () returned 0xd20000 [0095.772] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.772] GetProcessHeap () returned 0xd20000 [0095.772] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.772] GetProcessHeap () returned 0xd20000 [0095.772] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.772] GetProcessHeap () returned 0xd20000 [0095.772] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.772] GetProcessHeap () returned 0xd20000 [0095.772] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0095.772] GetProcessHeap () returned 0xd20000 [0095.772] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0095.772] GetProcessHeap () returned 0xd20000 [0095.772] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.772] GetProcessHeap () returned 0xd20000 [0095.772] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.772] GetProcessHeap () returned 0xd20000 [0095.772] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.772] GetProcessHeap () returned 0xd20000 [0095.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.773] GetProcessHeap () returned 0xd20000 [0095.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.773] GetProcessHeap () returned 0xd20000 [0095.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.773] GetProcessHeap () returned 0xd20000 [0095.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.773] GetProcessHeap () returned 0xd20000 [0095.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.773] GetProcessHeap () returned 0xd20000 [0095.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.773] GetProcessHeap () returned 0xd20000 [0095.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.773] GetProcessHeap () returned 0xd20000 [0095.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.773] GetProcessHeap () returned 0xd20000 [0095.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.773] GetProcessHeap () returned 0xd20000 [0095.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.774] GetProcessHeap () returned 0xd20000 [0095.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.774] GetProcessHeap () returned 0xd20000 [0095.774] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.774] GetProcessHeap () returned 0xd20000 [0095.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.774] GetProcessHeap () returned 0xd20000 [0095.774] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.774] GetProcessHeap () returned 0xd20000 [0095.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.774] GetProcessHeap () returned 0xd20000 [0095.774] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.774] GetProcessHeap () returned 0xd20000 [0095.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.774] GetProcessHeap () returned 0xd20000 [0095.774] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.774] GetProcessHeap () returned 0xd20000 [0095.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.774] GetProcessHeap () returned 0xd20000 [0095.774] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.774] GetProcessHeap () returned 0xd20000 [0095.775] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.775] GetProcessHeap () returned 0xd20000 [0095.775] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.775] GetProcessHeap () returned 0xd20000 [0095.775] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.775] GetProcessHeap () returned 0xd20000 [0095.775] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.775] GetProcessHeap () returned 0xd20000 [0095.775] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.775] GetProcessHeap () returned 0xd20000 [0095.775] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.775] GetProcessHeap () returned 0xd20000 [0095.775] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.775] GetProcessHeap () returned 0xd20000 [0095.775] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.775] GetProcessHeap () returned 0xd20000 [0095.775] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.775] GetProcessHeap () returned 0xd20000 [0095.775] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.775] GetProcessHeap () returned 0xd20000 [0095.776] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.776] GetProcessHeap () returned 0xd20000 [0095.776] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.776] GetProcessHeap () returned 0xd20000 [0095.776] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.776] GetProcessHeap () returned 0xd20000 [0095.776] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.776] GetProcessHeap () returned 0xd20000 [0095.776] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.776] GetProcessHeap () returned 0xd20000 [0095.776] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.776] GetProcessHeap () returned 0xd20000 [0095.776] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.776] GetProcessHeap () returned 0xd20000 [0095.776] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.776] GetProcessHeap () returned 0xd20000 [0095.776] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.776] GetProcessHeap () returned 0xd20000 [0095.776] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.776] GetProcessHeap () returned 0xd20000 [0095.777] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.777] GetProcessHeap () returned 0xd20000 [0095.777] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.777] GetProcessHeap () returned 0xd20000 [0095.777] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.777] GetProcessHeap () returned 0xd20000 [0095.777] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.777] GetProcessHeap () returned 0xd20000 [0095.777] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.777] GetProcessHeap () returned 0xd20000 [0095.777] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.777] GetProcessHeap () returned 0xd20000 [0095.777] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.777] GetProcessHeap () returned 0xd20000 [0095.777] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.777] GetProcessHeap () returned 0xd20000 [0095.777] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.777] GetProcessHeap () returned 0xd20000 [0095.777] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.777] GetProcessHeap () returned 0xd20000 [0095.777] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.778] GetProcessHeap () returned 0xd20000 [0095.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.778] GetProcessHeap () returned 0xd20000 [0095.778] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.778] GetProcessHeap () returned 0xd20000 [0095.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.778] GetProcessHeap () returned 0xd20000 [0095.778] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.778] GetProcessHeap () returned 0xd20000 [0095.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.778] GetProcessHeap () returned 0xd20000 [0095.778] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.778] GetProcessHeap () returned 0xd20000 [0095.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.778] GetProcessHeap () returned 0xd20000 [0095.778] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.778] GetProcessHeap () returned 0xd20000 [0095.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.778] GetProcessHeap () returned 0xd20000 [0095.778] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.779] GetProcessHeap () returned 0xd20000 [0095.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.779] GetProcessHeap () returned 0xd20000 [0095.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.779] GetProcessHeap () returned 0xd20000 [0095.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.779] GetProcessHeap () returned 0xd20000 [0095.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.779] GetProcessHeap () returned 0xd20000 [0095.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.779] GetProcessHeap () returned 0xd20000 [0095.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.779] GetProcessHeap () returned 0xd20000 [0095.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.779] GetProcessHeap () returned 0xd20000 [0095.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.779] GetProcessHeap () returned 0xd20000 [0095.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.779] GetProcessHeap () returned 0xd20000 [0095.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.779] GetProcessHeap () returned 0xd20000 [0095.780] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0095.780] GetProcessHeap () returned 0xd20000 [0095.780] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0095.780] GetProcessHeap () returned 0xd20000 [0095.780] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0095.780] GetProcessHeap () returned 0xd20000 [0095.780] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0095.780] GetProcessHeap () returned 0xd20000 [0095.780] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44510 | out: hHeap=0xd20000) returned 1 [0095.780] GetProcessHeap () returned 0xd20000 [0095.780] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b6c8 | out: hHeap=0xd20000) returned 1 [0095.780] GetProcessHeap () returned 0xd20000 [0095.780] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0095.780] GetProcessHeap () returned 0xd20000 [0095.780] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a948 | out: hHeap=0xd20000) returned 1 [0095.780] GetProcessHeap () returned 0xd20000 [0095.780] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0095.780] GetProcessHeap () returned 0xd20000 [0095.780] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.781] GetProcessHeap () returned 0xd20000 [0095.781] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0095.781] WriteFile (in: hFile=0x230, lpBuffer=0xd4de20*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4de20*, lpNumberOfBytesWritten=0x299d864*=0x384, lpOverlapped=0x0) returned 1 [0095.787] GetProcessHeap () returned 0xd20000 [0095.787] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4de20, Size=0x30) returned 0xd4de20 [0095.787] GetProcessHeap () returned 0xd20000 [0095.787] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0095.787] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0095.787] GetProcessHeap () returned 0xd20000 [0095.787] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x454d0) returned 0xd4de58 [0095.792] ReadFile (in: hFile=0x230, lpBuffer=0xd4de58, nNumberOfBytesToRead=0x454d0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4de58*, lpNumberOfBytesRead=0x299d7e8*=0x454d0, lpOverlapped=0x0) returned 1 [0095.800] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0095.800] WriteFile (in: hFile=0x230, lpBuffer=0xd4de58*, nNumberOfBytesToWrite=0x454d0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4de58*, lpNumberOfBytesWritten=0x299d7e4*=0x454d0, lpOverlapped=0x0) returned 1 [0095.805] GetProcessHeap () returned 0xd20000 [0095.805] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4de58 | out: hHeap=0xd20000) returned 1 [0095.805] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0095.805] WriteFile (in: hFile=0x230, lpBuffer=0xd4de20*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4de20*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0095.807] CloseHandle (hObject=0x230) returned 1 [0095.822] GetProcessHeap () returned 0xd20000 [0095.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd424e0 | out: hHeap=0xd20000) returned 1 [0095.822] GetProcessHeap () returned 0xd20000 [0095.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4be18 | out: hHeap=0xd20000) returned 1 [0095.822] GetProcessHeap () returned 0xd20000 [0095.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0095.822] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" [0095.822] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm.[ponce.lorena@aol.com]" [0095.822] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_ru-ru.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0095.823] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_ru-ru.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0095.823] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0095.823] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0095.823] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0095.823] GetProcessHeap () returned 0xd20000 [0095.823] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44528 | out: hHeap=0xd20000) returned 1 [0095.823] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5cfdc2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5cfdc2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x14021, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_sk-sk.htm", cAlternateFileName="EULA_S~1.HTM")) returned 1 [0095.823] lstrcmpiW (lpString1="EULA_sk-sk.htm", lpString2=".") returned 1 [0095.823] lstrcmpiW (lpString1="EULA_sk-sk.htm", lpString2="..") returned 1 [0095.823] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_sk-sk.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" [0095.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_sk-sk.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0095.824] GetProcessHeap () returned 0xd20000 [0095.824] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd44690 [0095.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_sk-sk.htm", cchWideChar=-1, lpMultiByteStr=0xd44690, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_sk-sk.htm", lpUsedDefaultChar=0x0) returned 15 [0095.824] lstrlenA (lpString="EULA_sk-sk.htm") returned 14 [0095.824] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0095.824] lstrlenA (lpString="EULA_sk-sk.htm") returned 14 [0095.824] lstrlenA (lpString=".dll") returned 4 [0095.824] lstrlenA (lpString=".dll") returned 4 [0095.824] lstrlenA (lpString="EULA_sk-sk.htm") returned 14 [0095.824] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0095.824] lstrlenA (lpString="EULA_sk-sk.htm") returned 14 [0095.824] lstrlenA (lpString=".ini") returned 4 [0095.824] lstrlenA (lpString=".ini") returned 4 [0095.824] lstrlenA (lpString="EULA_sk-sk.htm") returned 14 [0095.824] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0095.824] lstrlenA (lpString="EULA_sk-sk.htm") returned 14 [0095.824] lstrlenA (lpString=".inc") returned 4 [0095.824] lstrlenA (lpString=".inc") returned 4 [0095.824] lstrlenA (lpString="EULA_sk-sk.htm") returned 14 [0095.824] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0095.824] lstrcmpiW (lpString1="EULA_sk-sk.htm", lpString2="HOW_RECOVER.html") returned -1 [0095.824] lstrcmpiW (lpString1="EULA_sk-sk.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0095.824] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0095.824] lstrcmpiW (lpString1="EULA_sk-sk.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0095.825] GetProcessHeap () returned 0xd20000 [0095.825] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42828 [0095.825] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0095.825] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=81953) returned 1 [0095.825] GetProcessHeap () returned 0xd20000 [0095.825] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c0e8 [0095.825] GetProcessHeap () returned 0xd20000 [0095.825] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0095.825] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm") returned 52 [0095.825] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0095.826] GetProcessHeap () returned 0xd20000 [0095.826] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0095.826] GetProcessHeap () returned 0xd20000 [0095.826] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x38f) returned 0xd4de58 [0095.826] lstrlenA (lpString="rsa_encrypt") returned 11 [0095.826] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0095.827] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0095.828] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0095.828] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0095.828] GetProcessHeap () returned 0xd20000 [0095.828] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0095.828] lstrlenA (lpString="010001") returned 6 [0095.828] GetProcessHeap () returned 0xd20000 [0095.828] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd98 [0095.828] GetProcessHeap () returned 0xd20000 [0095.828] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0095.828] GetProcessHeap () returned 0xd20000 [0095.828] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b128 [0095.828] GetProcessHeap () returned 0xd20000 [0095.828] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0095.828] GetProcessHeap () returned 0xd20000 [0095.828] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b098 [0095.828] GetProcessHeap () returned 0xd20000 [0095.828] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd451e0 [0095.829] GetProcessHeap () returned 0xd20000 [0095.829] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0095.829] GetProcessHeap () returned 0xd20000 [0095.829] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0095.829] GetProcessHeap () returned 0xd20000 [0095.829] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.829] GetProcessHeap () returned 0xd20000 [0095.829] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0095.829] GetProcessHeap () returned 0xd20000 [0095.829] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0095.829] GetProcessHeap () returned 0xd20000 [0095.829] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44808 [0095.829] GetProcessHeap () returned 0xd20000 [0095.829] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.829] GetProcessHeap () returned 0xd20000 [0095.829] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445b8 [0095.829] GetProcessHeap () returned 0xd20000 [0095.829] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aa68 [0095.829] GetProcessHeap () returned 0xd20000 [0095.829] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0095.829] GetProcessHeap () returned 0xd20000 [0095.829] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0095.829] GetProcessHeap () returned 0xd20000 [0095.829] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aa68 | out: hHeap=0xd20000) returned 1 [0095.830] GetProcessHeap () returned 0xd20000 [0095.830] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.830] GetProcessHeap () returned 0xd20000 [0095.830] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44510 [0095.830] GetProcessHeap () returned 0xd20000 [0095.830] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.830] GetProcessHeap () returned 0xd20000 [0095.830] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.830] GetProcessHeap () returned 0xd20000 [0095.830] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.830] GetProcessHeap () returned 0xd20000 [0095.830] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.830] GetProcessHeap () returned 0xd20000 [0095.830] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.830] GetProcessHeap () returned 0xd20000 [0095.830] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.830] GetProcessHeap () returned 0xd20000 [0095.830] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b7e8 [0095.830] GetProcessHeap () returned 0xd20000 [0095.830] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44510 | out: hHeap=0xd20000) returned 1 [0095.830] GetProcessHeap () returned 0xd20000 [0095.830] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0095.830] GetProcessHeap () returned 0xd20000 [0095.831] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0095.831] GetProcessHeap () returned 0xd20000 [0095.831] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.831] GetProcessHeap () returned 0xd20000 [0095.831] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.831] GetProcessHeap () returned 0xd20000 [0095.831] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.831] GetProcessHeap () returned 0xd20000 [0095.831] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.831] GetProcessHeap () returned 0xd20000 [0095.831] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.831] GetProcessHeap () returned 0xd20000 [0095.831] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.831] GetProcessHeap () returned 0xd20000 [0095.831] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0095.831] GetProcessHeap () returned 0xd20000 [0095.831] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0095.831] GetProcessHeap () returned 0xd20000 [0095.831] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.831] GetProcessHeap () returned 0xd20000 [0095.831] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.831] GetProcessHeap () returned 0xd20000 [0095.832] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.832] GetProcessHeap () returned 0xd20000 [0095.832] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.832] GetProcessHeap () returned 0xd20000 [0095.832] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.832] GetProcessHeap () returned 0xd20000 [0095.832] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.832] GetProcessHeap () returned 0xd20000 [0095.832] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.832] GetProcessHeap () returned 0xd20000 [0095.832] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.832] GetProcessHeap () returned 0xd20000 [0095.832] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.832] GetProcessHeap () returned 0xd20000 [0095.832] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.832] GetProcessHeap () returned 0xd20000 [0095.832] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.832] GetProcessHeap () returned 0xd20000 [0095.832] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.832] GetProcessHeap () returned 0xd20000 [0095.832] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0095.832] GetProcessHeap () returned 0xd20000 [0095.832] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0095.833] GetProcessHeap () returned 0xd20000 [0095.833] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.833] GetProcessHeap () returned 0xd20000 [0095.833] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.833] GetProcessHeap () returned 0xd20000 [0095.833] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.833] GetProcessHeap () returned 0xd20000 [0095.833] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.833] GetProcessHeap () returned 0xd20000 [0095.833] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0095.833] GetProcessHeap () returned 0xd20000 [0095.833] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0095.833] GetProcessHeap () returned 0xd20000 [0095.833] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.833] GetProcessHeap () returned 0xd20000 [0095.833] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.833] GetProcessHeap () returned 0xd20000 [0095.833] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.833] GetProcessHeap () returned 0xd20000 [0095.833] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.833] GetProcessHeap () returned 0xd20000 [0095.833] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.833] GetProcessHeap () returned 0xd20000 [0095.833] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.834] GetProcessHeap () returned 0xd20000 [0095.834] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.834] GetProcessHeap () returned 0xd20000 [0095.834] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.834] GetProcessHeap () returned 0xd20000 [0095.834] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.834] GetProcessHeap () returned 0xd20000 [0095.834] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.834] GetProcessHeap () returned 0xd20000 [0095.834] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0095.834] GetProcessHeap () returned 0xd20000 [0095.834] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0095.834] GetProcessHeap () returned 0xd20000 [0095.834] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.834] GetProcessHeap () returned 0xd20000 [0095.834] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.834] GetProcessHeap () returned 0xd20000 [0095.834] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.834] GetProcessHeap () returned 0xd20000 [0095.834] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.834] GetProcessHeap () returned 0xd20000 [0095.834] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.834] GetProcessHeap () returned 0xd20000 [0095.835] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.835] GetProcessHeap () returned 0xd20000 [0095.835] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.835] GetProcessHeap () returned 0xd20000 [0095.835] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.835] GetProcessHeap () returned 0xd20000 [0095.835] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.835] GetProcessHeap () returned 0xd20000 [0095.835] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.835] GetProcessHeap () returned 0xd20000 [0095.835] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.835] GetProcessHeap () returned 0xd20000 [0095.835] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.835] GetProcessHeap () returned 0xd20000 [0095.835] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.835] GetProcessHeap () returned 0xd20000 [0095.835] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.835] GetProcessHeap () returned 0xd20000 [0095.835] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.835] GetProcessHeap () returned 0xd20000 [0095.835] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.835] GetProcessHeap () returned 0xd20000 [0095.835] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.836] GetProcessHeap () returned 0xd20000 [0095.836] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.836] GetProcessHeap () returned 0xd20000 [0095.836] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.836] GetProcessHeap () returned 0xd20000 [0095.836] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.836] GetProcessHeap () returned 0xd20000 [0095.836] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.836] GetProcessHeap () returned 0xd20000 [0095.836] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.836] GetProcessHeap () returned 0xd20000 [0095.836] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.836] GetProcessHeap () returned 0xd20000 [0095.836] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.836] GetProcessHeap () returned 0xd20000 [0095.836] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.836] GetProcessHeap () returned 0xd20000 [0095.836] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.836] GetProcessHeap () returned 0xd20000 [0095.836] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.836] GetProcessHeap () returned 0xd20000 [0095.836] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.836] GetProcessHeap () returned 0xd20000 [0095.837] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.837] GetProcessHeap () returned 0xd20000 [0095.837] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.837] GetProcessHeap () returned 0xd20000 [0095.837] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.837] GetProcessHeap () returned 0xd20000 [0095.837] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.837] GetProcessHeap () returned 0xd20000 [0095.837] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.837] GetProcessHeap () returned 0xd20000 [0095.837] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.837] GetProcessHeap () returned 0xd20000 [0095.837] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.837] GetProcessHeap () returned 0xd20000 [0095.837] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.837] GetProcessHeap () returned 0xd20000 [0095.837] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.837] GetProcessHeap () returned 0xd20000 [0095.837] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.837] GetProcessHeap () returned 0xd20000 [0095.837] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.837] GetProcessHeap () returned 0xd20000 [0095.837] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.838] GetProcessHeap () returned 0xd20000 [0095.838] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.838] GetProcessHeap () returned 0xd20000 [0095.838] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.838] GetProcessHeap () returned 0xd20000 [0095.838] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.838] GetProcessHeap () returned 0xd20000 [0095.838] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.838] GetProcessHeap () returned 0xd20000 [0095.838] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.838] GetProcessHeap () returned 0xd20000 [0095.838] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.838] GetProcessHeap () returned 0xd20000 [0095.838] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.838] GetProcessHeap () returned 0xd20000 [0095.838] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.838] GetProcessHeap () returned 0xd20000 [0095.838] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.838] GetProcessHeap () returned 0xd20000 [0095.838] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.838] GetProcessHeap () returned 0xd20000 [0095.838] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.838] GetProcessHeap () returned 0xd20000 [0095.838] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.839] GetProcessHeap () returned 0xd20000 [0095.839] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.839] GetProcessHeap () returned 0xd20000 [0095.839] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.839] GetProcessHeap () returned 0xd20000 [0095.839] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.839] GetProcessHeap () returned 0xd20000 [0095.839] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.839] GetProcessHeap () returned 0xd20000 [0095.839] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.839] GetProcessHeap () returned 0xd20000 [0095.839] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.839] GetProcessHeap () returned 0xd20000 [0095.839] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.839] GetProcessHeap () returned 0xd20000 [0095.839] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.839] GetProcessHeap () returned 0xd20000 [0095.839] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.839] GetProcessHeap () returned 0xd20000 [0095.839] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.839] GetProcessHeap () returned 0xd20000 [0095.840] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.840] GetProcessHeap () returned 0xd20000 [0095.840] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.840] GetProcessHeap () returned 0xd20000 [0095.840] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.840] GetProcessHeap () returned 0xd20000 [0095.840] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.840] GetProcessHeap () returned 0xd20000 [0095.840] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.840] GetProcessHeap () returned 0xd20000 [0095.840] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.840] GetProcessHeap () returned 0xd20000 [0095.840] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0095.840] GetProcessHeap () returned 0xd20000 [0095.840] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0095.840] GetProcessHeap () returned 0xd20000 [0095.840] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.840] GetProcessHeap () returned 0xd20000 [0095.840] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.840] GetProcessHeap () returned 0xd20000 [0095.840] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.840] GetProcessHeap () returned 0xd20000 [0095.841] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.841] GetProcessHeap () returned 0xd20000 [0095.841] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.841] GetProcessHeap () returned 0xd20000 [0095.841] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.841] GetProcessHeap () returned 0xd20000 [0095.841] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.841] GetProcessHeap () returned 0xd20000 [0095.841] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.841] GetProcessHeap () returned 0xd20000 [0095.841] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.841] GetProcessHeap () returned 0xd20000 [0095.841] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.841] GetProcessHeap () returned 0xd20000 [0095.841] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.841] GetProcessHeap () returned 0xd20000 [0095.841] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.841] GetProcessHeap () returned 0xd20000 [0095.841] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.841] GetProcessHeap () returned 0xd20000 [0095.841] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.841] GetProcessHeap () returned 0xd20000 [0095.841] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.842] GetProcessHeap () returned 0xd20000 [0095.842] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.842] GetProcessHeap () returned 0xd20000 [0095.842] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.842] GetProcessHeap () returned 0xd20000 [0095.842] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.842] GetProcessHeap () returned 0xd20000 [0095.842] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.842] GetProcessHeap () returned 0xd20000 [0095.842] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.842] GetProcessHeap () returned 0xd20000 [0095.842] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.842] GetProcessHeap () returned 0xd20000 [0095.842] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.842] GetProcessHeap () returned 0xd20000 [0095.842] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.842] GetProcessHeap () returned 0xd20000 [0095.842] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.842] GetProcessHeap () returned 0xd20000 [0095.842] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.842] GetProcessHeap () returned 0xd20000 [0095.842] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.843] GetProcessHeap () returned 0xd20000 [0095.843] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.843] GetProcessHeap () returned 0xd20000 [0095.843] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.843] GetProcessHeap () returned 0xd20000 [0095.843] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.843] GetProcessHeap () returned 0xd20000 [0095.843] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.843] GetProcessHeap () returned 0xd20000 [0095.843] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0095.843] GetProcessHeap () returned 0xd20000 [0095.843] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0095.843] GetProcessHeap () returned 0xd20000 [0095.843] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.843] GetProcessHeap () returned 0xd20000 [0095.843] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.843] GetProcessHeap () returned 0xd20000 [0095.843] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.843] GetProcessHeap () returned 0xd20000 [0095.843] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.843] GetProcessHeap () returned 0xd20000 [0095.843] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.844] GetProcessHeap () returned 0xd20000 [0095.844] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.844] GetProcessHeap () returned 0xd20000 [0095.844] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.844] GetProcessHeap () returned 0xd20000 [0095.844] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.844] GetProcessHeap () returned 0xd20000 [0095.844] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.844] GetProcessHeap () returned 0xd20000 [0095.844] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.844] GetProcessHeap () returned 0xd20000 [0095.844] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.844] GetProcessHeap () returned 0xd20000 [0095.844] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.844] GetProcessHeap () returned 0xd20000 [0095.844] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.844] GetProcessHeap () returned 0xd20000 [0095.844] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.844] GetProcessHeap () returned 0xd20000 [0095.844] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.845] GetProcessHeap () returned 0xd20000 [0095.845] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.845] GetProcessHeap () returned 0xd20000 [0095.845] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.845] GetProcessHeap () returned 0xd20000 [0095.845] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.845] GetProcessHeap () returned 0xd20000 [0095.845] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.845] GetProcessHeap () returned 0xd20000 [0095.845] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.845] GetProcessHeap () returned 0xd20000 [0095.845] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.845] GetProcessHeap () returned 0xd20000 [0095.845] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.845] GetProcessHeap () returned 0xd20000 [0095.845] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.845] GetProcessHeap () returned 0xd20000 [0095.845] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.845] GetProcessHeap () returned 0xd20000 [0095.845] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.845] GetProcessHeap () returned 0xd20000 [0095.845] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.846] GetProcessHeap () returned 0xd20000 [0095.846] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.846] GetProcessHeap () returned 0xd20000 [0095.846] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.846] GetProcessHeap () returned 0xd20000 [0095.846] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0095.846] GetProcessHeap () returned 0xd20000 [0095.846] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0095.846] GetProcessHeap () returned 0xd20000 [0095.846] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0095.846] GetProcessHeap () returned 0xd20000 [0095.846] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0095.846] GetProcessHeap () returned 0xd20000 [0095.846] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445b8 | out: hHeap=0xd20000) returned 1 [0095.846] GetProcessHeap () returned 0xd20000 [0095.846] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b098 | out: hHeap=0xd20000) returned 1 [0095.846] GetProcessHeap () returned 0xd20000 [0095.846] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0095.846] GetProcessHeap () returned 0xd20000 [0095.846] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b128 | out: hHeap=0xd20000) returned 1 [0095.846] GetProcessHeap () returned 0xd20000 [0095.846] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0095.847] GetProcessHeap () returned 0xd20000 [0095.847] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.847] GetProcessHeap () returned 0xd20000 [0095.847] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0095.847] WriteFile (in: hFile=0x230, lpBuffer=0xd4de58*, nNumberOfBytesToWrite=0x38f, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4de58*, lpNumberOfBytesWritten=0x299d864*=0x38f, lpOverlapped=0x0) returned 1 [0095.852] GetProcessHeap () returned 0xd20000 [0095.852] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4de58, Size=0x30) returned 0xd4de58 [0095.852] GetProcessHeap () returned 0xd20000 [0095.852] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0095.853] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0095.853] GetProcessHeap () returned 0xd20000 [0095.853] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x14030) returned 0xd4de90 [0095.853] ReadFile (in: hFile=0x230, lpBuffer=0xd4de90, nNumberOfBytesToRead=0x14030, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4de90*, lpNumberOfBytesRead=0x299d7e8*=0x14030, lpOverlapped=0x0) returned 1 [0095.855] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0095.855] WriteFile (in: hFile=0x230, lpBuffer=0xd4de90*, nNumberOfBytesToWrite=0x14030, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4de90*, lpNumberOfBytesWritten=0x299d7e4*=0x14030, lpOverlapped=0x0) returned 1 [0095.858] GetProcessHeap () returned 0xd20000 [0095.858] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4de90 | out: hHeap=0xd20000) returned 1 [0095.858] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0095.858] WriteFile (in: hFile=0x230, lpBuffer=0xd4de58*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4de58*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0095.860] CloseHandle (hObject=0x230) returned 1 [0095.869] GetProcessHeap () returned 0xd20000 [0095.869] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42828 | out: hHeap=0xd20000) returned 1 [0095.869] GetProcessHeap () returned 0xd20000 [0095.869] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c0e8 | out: hHeap=0xd20000) returned 1 [0095.869] GetProcessHeap () returned 0xd20000 [0095.870] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0095.870] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" [0095.870] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm.[ponce.lorena@aol.com]" [0095.870] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sk-sk.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0095.871] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sk-sk.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0095.871] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0095.871] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0095.871] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0095.871] GetProcessHeap () returned 0xd20000 [0095.871] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44690 | out: hHeap=0xd20000) returned 1 [0095.871] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5cfdc2, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5cfdc2, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1026f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_sl-si.htm", cAlternateFileName="EULA_S~2.HTM")) returned 1 [0095.871] lstrcmpiW (lpString1="EULA_sl-si.htm", lpString2=".") returned 1 [0095.871] lstrcmpiW (lpString1="EULA_sl-si.htm", lpString2="..") returned 1 [0095.872] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_sl-si.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" [0095.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_sl-si.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0095.872] GetProcessHeap () returned 0xd20000 [0095.872] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd44678 [0095.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_sl-si.htm", cchWideChar=-1, lpMultiByteStr=0xd44678, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_sl-si.htm", lpUsedDefaultChar=0x0) returned 15 [0095.872] lstrlenA (lpString="EULA_sl-si.htm") returned 14 [0095.872] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0095.872] lstrlenA (lpString="EULA_sl-si.htm") returned 14 [0095.872] lstrlenA (lpString=".dll") returned 4 [0095.872] lstrlenA (lpString=".dll") returned 4 [0095.872] lstrlenA (lpString="EULA_sl-si.htm") returned 14 [0095.872] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0095.872] lstrlenA (lpString="EULA_sl-si.htm") returned 14 [0095.872] lstrlenA (lpString=".ini") returned 4 [0095.872] lstrlenA (lpString=".ini") returned 4 [0095.872] lstrlenA (lpString="EULA_sl-si.htm") returned 14 [0095.872] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0095.873] lstrlenA (lpString="EULA_sl-si.htm") returned 14 [0095.873] lstrlenA (lpString=".inc") returned 4 [0095.873] lstrlenA (lpString=".inc") returned 4 [0095.873] lstrlenA (lpString="EULA_sl-si.htm") returned 14 [0095.873] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0095.873] lstrcmpiW (lpString1="EULA_sl-si.htm", lpString2="HOW_RECOVER.html") returned -1 [0095.873] lstrcmpiW (lpString1="EULA_sl-si.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0095.873] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0095.873] lstrcmpiW (lpString1="EULA_sl-si.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0095.873] GetProcessHeap () returned 0xd20000 [0095.873] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42530 [0095.873] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0095.892] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=66159) returned 1 [0095.892] GetProcessHeap () returned 0xd20000 [0095.892] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4be90 [0095.892] GetProcessHeap () returned 0xd20000 [0095.892] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0095.892] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm") returned 52 [0095.892] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0095.892] GetProcessHeap () returned 0xd20000 [0095.892] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0095.892] GetProcessHeap () returned 0xd20000 [0095.892] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x381) returned 0xd4de90 [0095.893] lstrlenA (lpString="rsa_encrypt") returned 11 [0095.893] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0095.895] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0095.895] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0095.895] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0095.895] GetProcessHeap () returned 0xd20000 [0095.895] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0095.895] lstrlenA (lpString="010001") returned 6 [0095.895] GetProcessHeap () returned 0xd20000 [0095.895] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc48 [0095.895] GetProcessHeap () returned 0xd20000 [0095.895] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0095.895] GetProcessHeap () returned 0xd20000 [0095.895] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b638 [0095.895] GetProcessHeap () returned 0xd20000 [0095.895] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0095.895] GetProcessHeap () returned 0xd20000 [0095.895] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4a948 [0095.895] GetProcessHeap () returned 0xd20000 [0095.895] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd452f8 [0095.895] GetProcessHeap () returned 0xd20000 [0095.896] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0095.896] GetProcessHeap () returned 0xd20000 [0095.896] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44c68 [0095.896] GetProcessHeap () returned 0xd20000 [0095.896] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.896] GetProcessHeap () returned 0xd20000 [0095.896] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0095.896] GetProcessHeap () returned 0xd20000 [0095.896] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0095.896] GetProcessHeap () returned 0xd20000 [0095.896] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd45410 [0095.896] GetProcessHeap () returned 0xd20000 [0095.896] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.896] GetProcessHeap () returned 0xd20000 [0095.896] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44468 [0095.896] GetProcessHeap () returned 0xd20000 [0095.896] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aca8 [0095.896] GetProcessHeap () returned 0xd20000 [0095.896] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0095.896] GetProcessHeap () returned 0xd20000 [0095.897] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0095.897] GetProcessHeap () returned 0xd20000 [0095.897] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aca8 | out: hHeap=0xd20000) returned 1 [0095.897] GetProcessHeap () returned 0xd20000 [0095.897] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.897] GetProcessHeap () returned 0xd20000 [0095.897] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44690 [0095.897] GetProcessHeap () returned 0xd20000 [0095.897] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.897] GetProcessHeap () returned 0xd20000 [0095.897] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.897] GetProcessHeap () returned 0xd20000 [0095.897] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.897] GetProcessHeap () returned 0xd20000 [0095.897] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.897] GetProcessHeap () returned 0xd20000 [0095.897] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.897] GetProcessHeap () returned 0xd20000 [0095.898] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.898] GetProcessHeap () returned 0xd20000 [0095.898] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4aca8 [0095.898] GetProcessHeap () returned 0xd20000 [0095.898] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44690 | out: hHeap=0xd20000) returned 1 [0095.898] GetProcessHeap () returned 0xd20000 [0095.898] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0095.898] GetProcessHeap () returned 0xd20000 [0095.898] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aca8 | out: hHeap=0xd20000) returned 1 [0095.898] GetProcessHeap () returned 0xd20000 [0095.898] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.898] GetProcessHeap () returned 0xd20000 [0095.898] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.898] GetProcessHeap () returned 0xd20000 [0095.898] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.898] GetProcessHeap () returned 0xd20000 [0095.898] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.898] GetProcessHeap () returned 0xd20000 [0095.898] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.898] GetProcessHeap () returned 0xd20000 [0095.899] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.899] GetProcessHeap () returned 0xd20000 [0095.899] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.899] GetProcessHeap () returned 0xd20000 [0095.899] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.899] GetProcessHeap () returned 0xd20000 [0095.899] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.899] GetProcessHeap () returned 0xd20000 [0095.899] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.899] GetProcessHeap () returned 0xd20000 [0095.899] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.899] GetProcessHeap () returned 0xd20000 [0095.899] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.899] GetProcessHeap () returned 0xd20000 [0095.899] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.899] GetProcessHeap () returned 0xd20000 [0095.899] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.899] GetProcessHeap () returned 0xd20000 [0095.899] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.899] GetProcessHeap () returned 0xd20000 [0095.900] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.900] GetProcessHeap () returned 0xd20000 [0095.900] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.900] GetProcessHeap () returned 0xd20000 [0095.900] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.900] GetProcessHeap () returned 0xd20000 [0095.900] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.900] GetProcessHeap () returned 0xd20000 [0095.900] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.900] GetProcessHeap () returned 0xd20000 [0095.900] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.900] GetProcessHeap () returned 0xd20000 [0095.900] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.900] GetProcessHeap () returned 0xd20000 [0095.900] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.900] GetProcessHeap () returned 0xd20000 [0095.900] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.900] GetProcessHeap () returned 0xd20000 [0095.900] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.900] GetProcessHeap () returned 0xd20000 [0095.901] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.901] GetProcessHeap () returned 0xd20000 [0095.901] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.901] GetProcessHeap () returned 0xd20000 [0095.901] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.901] GetProcessHeap () returned 0xd20000 [0095.901] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0095.901] GetProcessHeap () returned 0xd20000 [0095.901] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0095.901] GetProcessHeap () returned 0xd20000 [0095.901] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.901] GetProcessHeap () returned 0xd20000 [0095.901] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.901] GetProcessHeap () returned 0xd20000 [0095.901] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.901] GetProcessHeap () returned 0xd20000 [0095.901] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.901] GetProcessHeap () returned 0xd20000 [0095.901] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.901] GetProcessHeap () returned 0xd20000 [0095.901] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.902] GetProcessHeap () returned 0xd20000 [0095.902] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.902] GetProcessHeap () returned 0xd20000 [0095.902] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.902] GetProcessHeap () returned 0xd20000 [0095.902] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.902] GetProcessHeap () returned 0xd20000 [0095.902] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.902] GetProcessHeap () returned 0xd20000 [0095.902] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.902] GetProcessHeap () returned 0xd20000 [0095.902] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.902] GetProcessHeap () returned 0xd20000 [0095.902] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.902] GetProcessHeap () returned 0xd20000 [0095.902] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.902] GetProcessHeap () returned 0xd20000 [0095.902] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.902] GetProcessHeap () returned 0xd20000 [0095.902] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.902] GetProcessHeap () returned 0xd20000 [0095.903] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.903] GetProcessHeap () returned 0xd20000 [0095.903] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.903] GetProcessHeap () returned 0xd20000 [0095.903] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.903] GetProcessHeap () returned 0xd20000 [0095.903] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.903] GetProcessHeap () returned 0xd20000 [0095.903] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.903] GetProcessHeap () returned 0xd20000 [0095.903] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.903] GetProcessHeap () returned 0xd20000 [0095.903] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0095.903] GetProcessHeap () returned 0xd20000 [0095.903] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0095.903] GetProcessHeap () returned 0xd20000 [0095.903] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.903] GetProcessHeap () returned 0xd20000 [0095.903] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.903] GetProcessHeap () returned 0xd20000 [0095.904] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.904] GetProcessHeap () returned 0xd20000 [0095.904] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.904] GetProcessHeap () returned 0xd20000 [0095.904] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.904] GetProcessHeap () returned 0xd20000 [0095.904] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.904] GetProcessHeap () returned 0xd20000 [0095.904] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.904] GetProcessHeap () returned 0xd20000 [0095.904] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.904] GetProcessHeap () returned 0xd20000 [0095.904] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.904] GetProcessHeap () returned 0xd20000 [0095.904] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.904] GetProcessHeap () returned 0xd20000 [0095.904] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.904] GetProcessHeap () returned 0xd20000 [0095.904] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.904] GetProcessHeap () returned 0xd20000 [0095.904] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0095.905] GetProcessHeap () returned 0xd20000 [0095.905] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0095.905] GetProcessHeap () returned 0xd20000 [0095.905] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.905] GetProcessHeap () returned 0xd20000 [0095.905] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.905] GetProcessHeap () returned 0xd20000 [0095.905] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.905] GetProcessHeap () returned 0xd20000 [0095.905] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.905] GetProcessHeap () returned 0xd20000 [0095.905] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.905] GetProcessHeap () returned 0xd20000 [0095.905] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.905] GetProcessHeap () returned 0xd20000 [0095.905] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.905] GetProcessHeap () returned 0xd20000 [0095.905] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.905] GetProcessHeap () returned 0xd20000 [0095.905] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.906] GetProcessHeap () returned 0xd20000 [0095.906] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.906] GetProcessHeap () returned 0xd20000 [0095.906] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.906] GetProcessHeap () returned 0xd20000 [0095.906] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.906] GetProcessHeap () returned 0xd20000 [0095.906] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.906] GetProcessHeap () returned 0xd20000 [0095.906] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.906] GetProcessHeap () returned 0xd20000 [0095.906] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.906] GetProcessHeap () returned 0xd20000 [0095.906] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.906] GetProcessHeap () returned 0xd20000 [0095.906] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.906] GetProcessHeap () returned 0xd20000 [0095.907] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.907] GetProcessHeap () returned 0xd20000 [0095.907] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.907] GetProcessHeap () returned 0xd20000 [0095.907] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.907] GetProcessHeap () returned 0xd20000 [0095.907] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.907] GetProcessHeap () returned 0xd20000 [0095.907] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.907] GetProcessHeap () returned 0xd20000 [0095.907] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.907] GetProcessHeap () returned 0xd20000 [0095.907] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.907] GetProcessHeap () returned 0xd20000 [0095.907] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.907] GetProcessHeap () returned 0xd20000 [0095.907] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.907] GetProcessHeap () returned 0xd20000 [0095.907] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.907] GetProcessHeap () returned 0xd20000 [0095.908] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.908] GetProcessHeap () returned 0xd20000 [0095.908] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.908] GetProcessHeap () returned 0xd20000 [0095.908] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.908] GetProcessHeap () returned 0xd20000 [0095.908] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.908] GetProcessHeap () returned 0xd20000 [0095.908] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.908] GetProcessHeap () returned 0xd20000 [0095.908] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.908] GetProcessHeap () returned 0xd20000 [0095.908] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.908] GetProcessHeap () returned 0xd20000 [0095.908] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.908] GetProcessHeap () returned 0xd20000 [0095.908] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.908] GetProcessHeap () returned 0xd20000 [0095.908] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.909] GetProcessHeap () returned 0xd20000 [0095.909] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.909] GetProcessHeap () returned 0xd20000 [0095.909] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.909] GetProcessHeap () returned 0xd20000 [0095.909] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.909] GetProcessHeap () returned 0xd20000 [0095.909] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.909] GetProcessHeap () returned 0xd20000 [0095.909] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.909] GetProcessHeap () returned 0xd20000 [0095.909] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.909] GetProcessHeap () returned 0xd20000 [0095.909] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.909] GetProcessHeap () returned 0xd20000 [0095.909] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.909] GetProcessHeap () returned 0xd20000 [0095.909] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.909] GetProcessHeap () returned 0xd20000 [0095.909] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.910] GetProcessHeap () returned 0xd20000 [0095.910] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.910] GetProcessHeap () returned 0xd20000 [0095.910] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.910] GetProcessHeap () returned 0xd20000 [0095.910] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.910] GetProcessHeap () returned 0xd20000 [0095.910] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.910] GetProcessHeap () returned 0xd20000 [0095.910] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.910] GetProcessHeap () returned 0xd20000 [0095.910] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.910] GetProcessHeap () returned 0xd20000 [0095.910] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.910] GetProcessHeap () returned 0xd20000 [0095.910] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.910] GetProcessHeap () returned 0xd20000 [0095.910] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.910] GetProcessHeap () returned 0xd20000 [0095.911] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.911] GetProcessHeap () returned 0xd20000 [0095.911] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.911] GetProcessHeap () returned 0xd20000 [0095.911] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.911] GetProcessHeap () returned 0xd20000 [0095.911] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.911] GetProcessHeap () returned 0xd20000 [0095.911] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.911] GetProcessHeap () returned 0xd20000 [0095.911] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.911] GetProcessHeap () returned 0xd20000 [0095.911] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.911] GetProcessHeap () returned 0xd20000 [0095.911] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.911] GetProcessHeap () returned 0xd20000 [0095.911] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.911] GetProcessHeap () returned 0xd20000 [0095.911] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.911] GetProcessHeap () returned 0xd20000 [0095.912] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.912] GetProcessHeap () returned 0xd20000 [0095.912] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.912] GetProcessHeap () returned 0xd20000 [0095.912] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.912] GetProcessHeap () returned 0xd20000 [0095.912] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.912] GetProcessHeap () returned 0xd20000 [0095.912] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.912] GetProcessHeap () returned 0xd20000 [0095.912] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.912] GetProcessHeap () returned 0xd20000 [0095.912] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.912] GetProcessHeap () returned 0xd20000 [0095.912] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.912] GetProcessHeap () returned 0xd20000 [0095.912] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.912] GetProcessHeap () returned 0xd20000 [0095.912] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.912] GetProcessHeap () returned 0xd20000 [0095.912] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.913] GetProcessHeap () returned 0xd20000 [0095.913] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.913] GetProcessHeap () returned 0xd20000 [0095.913] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.913] GetProcessHeap () returned 0xd20000 [0095.913] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.913] GetProcessHeap () returned 0xd20000 [0095.913] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.913] GetProcessHeap () returned 0xd20000 [0095.913] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.913] GetProcessHeap () returned 0xd20000 [0095.913] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0095.913] GetProcessHeap () returned 0xd20000 [0095.913] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0095.913] GetProcessHeap () returned 0xd20000 [0095.913] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.913] GetProcessHeap () returned 0xd20000 [0095.913] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.913] GetProcessHeap () returned 0xd20000 [0095.913] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0095.913] GetProcessHeap () returned 0xd20000 [0095.914] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.914] GetProcessHeap () returned 0xd20000 [0095.914] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.914] GetProcessHeap () returned 0xd20000 [0095.914] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.914] GetProcessHeap () returned 0xd20000 [0095.914] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.914] GetProcessHeap () returned 0xd20000 [0095.914] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.914] GetProcessHeap () returned 0xd20000 [0095.914] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.914] GetProcessHeap () returned 0xd20000 [0095.914] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.914] GetProcessHeap () returned 0xd20000 [0095.914] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.914] GetProcessHeap () returned 0xd20000 [0095.914] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.914] GetProcessHeap () returned 0xd20000 [0095.914] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.914] GetProcessHeap () returned 0xd20000 [0095.915] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.915] GetProcessHeap () returned 0xd20000 [0095.915] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.915] GetProcessHeap () returned 0xd20000 [0095.915] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.915] GetProcessHeap () returned 0xd20000 [0095.915] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.915] GetProcessHeap () returned 0xd20000 [0095.915] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.915] GetProcessHeap () returned 0xd20000 [0095.915] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0095.915] GetProcessHeap () returned 0xd20000 [0095.915] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0095.915] GetProcessHeap () returned 0xd20000 [0095.915] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0095.915] GetProcessHeap () returned 0xd20000 [0095.915] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0095.915] GetProcessHeap () returned 0xd20000 [0095.915] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44468 | out: hHeap=0xd20000) returned 1 [0095.915] GetProcessHeap () returned 0xd20000 [0095.916] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a948 | out: hHeap=0xd20000) returned 1 [0095.916] GetProcessHeap () returned 0xd20000 [0095.916] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0095.916] GetProcessHeap () returned 0xd20000 [0095.916] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b638 | out: hHeap=0xd20000) returned 1 [0095.916] GetProcessHeap () returned 0xd20000 [0095.916] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0095.916] GetProcessHeap () returned 0xd20000 [0095.916] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.916] GetProcessHeap () returned 0xd20000 [0095.916] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0095.916] WriteFile (in: hFile=0x230, lpBuffer=0xd4de90*, nNumberOfBytesToWrite=0x381, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4de90*, lpNumberOfBytesWritten=0x299d864*=0x381, lpOverlapped=0x0) returned 1 [0095.923] GetProcessHeap () returned 0xd20000 [0095.923] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4de90, Size=0x30) returned 0xd4de90 [0095.923] GetProcessHeap () returned 0xd20000 [0095.923] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0095.923] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0095.923] GetProcessHeap () returned 0xd20000 [0095.923] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10270) returned 0xd4dec8 [0095.925] ReadFile (in: hFile=0x230, lpBuffer=0xd4dec8, nNumberOfBytesToRead=0x10270, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4dec8*, lpNumberOfBytesRead=0x299d7e8*=0x10270, lpOverlapped=0x0) returned 1 [0095.927] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0095.927] WriteFile (in: hFile=0x230, lpBuffer=0xd4dec8*, nNumberOfBytesToWrite=0x10270, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4dec8*, lpNumberOfBytesWritten=0x299d7e4*=0x10270, lpOverlapped=0x0) returned 1 [0095.930] GetProcessHeap () returned 0xd20000 [0095.930] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4dec8 | out: hHeap=0xd20000) returned 1 [0095.930] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0095.930] WriteFile (in: hFile=0x230, lpBuffer=0xd4de90*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4de90*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0095.932] CloseHandle (hObject=0x230) returned 1 [0095.937] GetProcessHeap () returned 0xd20000 [0095.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42530 | out: hHeap=0xd20000) returned 1 [0095.937] GetProcessHeap () returned 0xd20000 [0095.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4be90 | out: hHeap=0xd20000) returned 1 [0095.937] GetProcessHeap () returned 0xd20000 [0095.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0095.937] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" [0095.937] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm.[ponce.lorena@aol.com]" [0095.937] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sl-si.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0095.938] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sl-si.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0095.938] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0095.939] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0095.939] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0095.939] GetProcessHeap () returned 0xd20000 [0095.939] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44678 | out: hHeap=0xd20000) returned 1 [0095.939] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e364e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5e364e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x12720, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_sr-latn-cs.htm", cAlternateFileName="EULA_S~3.HTM")) returned 1 [0095.939] lstrcmpiW (lpString1="EULA_sr-latn-cs.htm", lpString2=".") returned 1 [0095.939] lstrcmpiW (lpString1="EULA_sr-latn-cs.htm", lpString2="..") returned 1 [0095.939] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_sr-latn-cs.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" [0095.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_sr-latn-cs.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0095.939] GetProcessHeap () returned 0xd20000 [0095.939] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x14) returned 0xd36568 [0095.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_sr-latn-cs.htm", cchWideChar=-1, lpMultiByteStr=0xd36568, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_sr-latn-cs.htm", lpUsedDefaultChar=0x0) returned 20 [0095.939] lstrlenA (lpString="EULA_sr-latn-cs.htm") returned 19 [0095.939] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0095.940] lstrlenA (lpString="EULA_sr-latn-cs.htm") returned 19 [0095.940] lstrlenA (lpString=".dll") returned 4 [0095.940] lstrlenA (lpString=".dll") returned 4 [0095.940] lstrlenA (lpString="EULA_sr-latn-cs.htm") returned 19 [0095.940] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0095.940] lstrlenA (lpString="EULA_sr-latn-cs.htm") returned 19 [0095.940] lstrlenA (lpString=".ini") returned 4 [0095.940] lstrlenA (lpString=".ini") returned 4 [0095.940] lstrlenA (lpString="EULA_sr-latn-cs.htm") returned 19 [0095.940] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0095.940] lstrlenA (lpString="EULA_sr-latn-cs.htm") returned 19 [0095.940] lstrlenA (lpString=".inc") returned 4 [0095.940] lstrlenA (lpString=".inc") returned 4 [0095.940] lstrlenA (lpString="EULA_sr-latn-cs.htm") returned 19 [0095.940] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0095.940] lstrcmpiW (lpString1="EULA_sr-latn-cs.htm", lpString2="HOW_RECOVER.html") returned -1 [0095.940] lstrcmpiW (lpString1="EULA_sr-latn-cs.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0095.940] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0095.940] lstrcmpiW (lpString1="EULA_sr-latn-cs.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0095.940] GetProcessHeap () returned 0xd20000 [0095.941] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42760 [0095.941] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0095.944] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=75552) returned 1 [0095.944] GetProcessHeap () returned 0xd20000 [0095.944] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c160 [0095.944] GetProcessHeap () returned 0xd20000 [0095.944] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0095.944] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm") returned 57 [0095.944] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0095.944] GetProcessHeap () returned 0xd20000 [0095.944] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0095.944] GetProcessHeap () returned 0xd20000 [0095.944] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4dec8 [0095.944] lstrlenA (lpString="rsa_encrypt") returned 11 [0095.944] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0095.946] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0095.946] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0095.946] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0095.946] GetProcessHeap () returned 0xd20000 [0095.946] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0095.947] lstrlenA (lpString="010001") returned 6 [0095.947] GetProcessHeap () returned 0xd20000 [0095.947] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc98 [0095.947] GetProcessHeap () returned 0xd20000 [0095.947] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0095.947] GetProcessHeap () returned 0xd20000 [0095.947] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b248 [0095.947] GetProcessHeap () returned 0xd20000 [0095.947] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0095.947] GetProcessHeap () returned 0xd20000 [0095.947] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ac18 [0095.947] GetProcessHeap () returned 0xd20000 [0095.947] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45640 [0095.947] GetProcessHeap () returned 0xd20000 [0095.947] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0095.947] GetProcessHeap () returned 0xd20000 [0095.947] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0095.947] GetProcessHeap () returned 0xd20000 [0095.947] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.947] GetProcessHeap () returned 0xd20000 [0095.947] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0095.948] GetProcessHeap () returned 0xd20000 [0095.948] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0095.948] GetProcessHeap () returned 0xd20000 [0095.948] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd45410 [0095.948] GetProcessHeap () returned 0xd20000 [0095.948] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0095.948] GetProcessHeap () returned 0xd20000 [0095.948] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446a8 [0095.948] GetProcessHeap () returned 0xd20000 [0095.948] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b5a8 [0095.948] GetProcessHeap () returned 0xd20000 [0095.948] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0095.948] GetProcessHeap () returned 0xd20000 [0095.948] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0095.948] GetProcessHeap () returned 0xd20000 [0095.948] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b5a8 | out: hHeap=0xd20000) returned 1 [0095.948] GetProcessHeap () returned 0xd20000 [0095.948] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.948] GetProcessHeap () returned 0xd20000 [0095.948] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44570 [0095.948] GetProcessHeap () returned 0xd20000 [0095.948] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0095.949] GetProcessHeap () returned 0xd20000 [0095.949] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.949] GetProcessHeap () returned 0xd20000 [0095.949] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.949] GetProcessHeap () returned 0xd20000 [0095.949] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.949] GetProcessHeap () returned 0xd20000 [0095.949] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0095.949] GetProcessHeap () returned 0xd20000 [0095.949] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0095.949] GetProcessHeap () returned 0xd20000 [0095.949] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4a948 [0095.949] GetProcessHeap () returned 0xd20000 [0095.949] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44570 | out: hHeap=0xd20000) returned 1 [0095.949] GetProcessHeap () returned 0xd20000 [0095.949] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0095.949] GetProcessHeap () returned 0xd20000 [0095.949] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a948 | out: hHeap=0xd20000) returned 1 [0095.949] GetProcessHeap () returned 0xd20000 [0095.949] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0095.949] GetProcessHeap () returned 0xd20000 [0095.949] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0095.950] GetProcessHeap () returned 0xd20000 [0095.950] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.950] GetProcessHeap () returned 0xd20000 [0095.950] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.950] GetProcessHeap () returned 0xd20000 [0095.950] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.950] GetProcessHeap () returned 0xd20000 [0095.950] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.950] GetProcessHeap () returned 0xd20000 [0095.950] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.950] GetProcessHeap () returned 0xd20000 [0095.950] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.950] GetProcessHeap () returned 0xd20000 [0095.950] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.950] GetProcessHeap () returned 0xd20000 [0095.950] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.950] GetProcessHeap () returned 0xd20000 [0095.950] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.950] GetProcessHeap () returned 0xd20000 [0095.950] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.950] GetProcessHeap () returned 0xd20000 [0095.950] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0095.951] GetProcessHeap () returned 0xd20000 [0095.951] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0095.951] GetProcessHeap () returned 0xd20000 [0095.951] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.951] GetProcessHeap () returned 0xd20000 [0095.951] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.951] GetProcessHeap () returned 0xd20000 [0095.951] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.951] GetProcessHeap () returned 0xd20000 [0095.951] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.951] GetProcessHeap () returned 0xd20000 [0095.951] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.951] GetProcessHeap () returned 0xd20000 [0095.951] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.951] GetProcessHeap () returned 0xd20000 [0095.951] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.951] GetProcessHeap () returned 0xd20000 [0095.951] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.951] GetProcessHeap () returned 0xd20000 [0095.951] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.951] GetProcessHeap () returned 0xd20000 [0095.952] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.952] GetProcessHeap () returned 0xd20000 [0095.952] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.952] GetProcessHeap () returned 0xd20000 [0095.952] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.952] GetProcessHeap () returned 0xd20000 [0095.952] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.952] GetProcessHeap () returned 0xd20000 [0095.952] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.952] GetProcessHeap () returned 0xd20000 [0095.952] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.952] GetProcessHeap () returned 0xd20000 [0095.952] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.952] GetProcessHeap () returned 0xd20000 [0095.952] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.952] GetProcessHeap () returned 0xd20000 [0095.952] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.952] GetProcessHeap () returned 0xd20000 [0095.952] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.952] GetProcessHeap () returned 0xd20000 [0095.952] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.952] GetProcessHeap () returned 0xd20000 [0095.952] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0095.953] GetProcessHeap () returned 0xd20000 [0095.953] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0095.953] GetProcessHeap () returned 0xd20000 [0095.953] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.953] GetProcessHeap () returned 0xd20000 [0095.953] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.953] GetProcessHeap () returned 0xd20000 [0095.953] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.953] GetProcessHeap () returned 0xd20000 [0095.953] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.953] GetProcessHeap () returned 0xd20000 [0095.953] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.953] GetProcessHeap () returned 0xd20000 [0095.953] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.953] GetProcessHeap () returned 0xd20000 [0095.954] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.954] GetProcessHeap () returned 0xd20000 [0095.954] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.954] GetProcessHeap () returned 0xd20000 [0095.954] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.954] GetProcessHeap () returned 0xd20000 [0095.954] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.955] GetProcessHeap () returned 0xd20000 [0095.955] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.955] GetProcessHeap () returned 0xd20000 [0095.955] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.955] GetProcessHeap () returned 0xd20000 [0095.955] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.955] GetProcessHeap () returned 0xd20000 [0095.955] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.955] GetProcessHeap () returned 0xd20000 [0095.955] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.955] GetProcessHeap () returned 0xd20000 [0095.955] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.955] GetProcessHeap () returned 0xd20000 [0095.955] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.955] GetProcessHeap () returned 0xd20000 [0095.955] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.955] GetProcessHeap () returned 0xd20000 [0095.955] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.955] GetProcessHeap () returned 0xd20000 [0095.955] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.955] GetProcessHeap () returned 0xd20000 [0095.956] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.956] GetProcessHeap () returned 0xd20000 [0095.956] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.956] GetProcessHeap () returned 0xd20000 [0095.956] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.956] GetProcessHeap () returned 0xd20000 [0095.956] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.956] GetProcessHeap () returned 0xd20000 [0095.956] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.956] GetProcessHeap () returned 0xd20000 [0095.956] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.956] GetProcessHeap () returned 0xd20000 [0095.956] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.956] GetProcessHeap () returned 0xd20000 [0095.956] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.956] GetProcessHeap () returned 0xd20000 [0095.956] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.956] GetProcessHeap () returned 0xd20000 [0095.956] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.956] GetProcessHeap () returned 0xd20000 [0095.956] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.956] GetProcessHeap () returned 0xd20000 [0095.957] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.957] GetProcessHeap () returned 0xd20000 [0095.957] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.957] GetProcessHeap () returned 0xd20000 [0095.957] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.957] GetProcessHeap () returned 0xd20000 [0095.957] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.957] GetProcessHeap () returned 0xd20000 [0095.957] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.957] GetProcessHeap () returned 0xd20000 [0095.957] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.957] GetProcessHeap () returned 0xd20000 [0095.957] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.957] GetProcessHeap () returned 0xd20000 [0095.957] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.957] GetProcessHeap () returned 0xd20000 [0095.957] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.957] GetProcessHeap () returned 0xd20000 [0095.957] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.957] GetProcessHeap () returned 0xd20000 [0095.957] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.957] GetProcessHeap () returned 0xd20000 [0095.957] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.957] GetProcessHeap () returned 0xd20000 [0095.958] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.958] GetProcessHeap () returned 0xd20000 [0095.958] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.958] GetProcessHeap () returned 0xd20000 [0095.958] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.958] GetProcessHeap () returned 0xd20000 [0095.958] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0095.958] GetProcessHeap () returned 0xd20000 [0095.958] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0095.958] GetProcessHeap () returned 0xd20000 [0095.958] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.958] GetProcessHeap () returned 0xd20000 [0095.958] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.958] GetProcessHeap () returned 0xd20000 [0095.958] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.958] GetProcessHeap () returned 0xd20000 [0095.958] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.958] GetProcessHeap () returned 0xd20000 [0095.958] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.958] GetProcessHeap () returned 0xd20000 [0095.958] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.958] GetProcessHeap () returned 0xd20000 [0095.959] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.959] GetProcessHeap () returned 0xd20000 [0095.959] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.959] GetProcessHeap () returned 0xd20000 [0095.959] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0095.959] GetProcessHeap () returned 0xd20000 [0095.959] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0095.959] GetProcessHeap () returned 0xd20000 [0095.959] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.959] GetProcessHeap () returned 0xd20000 [0095.959] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.959] GetProcessHeap () returned 0xd20000 [0095.959] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.959] GetProcessHeap () returned 0xd20000 [0095.959] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.959] GetProcessHeap () returned 0xd20000 [0095.959] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.959] GetProcessHeap () returned 0xd20000 [0095.959] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.959] GetProcessHeap () returned 0xd20000 [0095.959] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.959] GetProcessHeap () returned 0xd20000 [0095.959] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.960] GetProcessHeap () returned 0xd20000 [0095.960] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.960] GetProcessHeap () returned 0xd20000 [0095.960] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.960] GetProcessHeap () returned 0xd20000 [0095.960] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.960] GetProcessHeap () returned 0xd20000 [0095.960] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.960] GetProcessHeap () returned 0xd20000 [0095.960] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.960] GetProcessHeap () returned 0xd20000 [0095.960] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.960] GetProcessHeap () returned 0xd20000 [0095.960] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.960] GetProcessHeap () returned 0xd20000 [0095.960] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.960] GetProcessHeap () returned 0xd20000 [0095.960] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.960] GetProcessHeap () returned 0xd20000 [0095.960] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.961] GetProcessHeap () returned 0xd20000 [0095.961] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.961] GetProcessHeap () returned 0xd20000 [0095.961] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.961] GetProcessHeap () returned 0xd20000 [0095.961] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0095.961] GetProcessHeap () returned 0xd20000 [0095.961] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0095.961] GetProcessHeap () returned 0xd20000 [0095.961] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.961] GetProcessHeap () returned 0xd20000 [0095.961] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.961] GetProcessHeap () returned 0xd20000 [0095.961] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.961] GetProcessHeap () returned 0xd20000 [0095.961] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.961] GetProcessHeap () returned 0xd20000 [0095.961] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.961] GetProcessHeap () returned 0xd20000 [0095.961] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.961] GetProcessHeap () returned 0xd20000 [0095.962] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0095.962] GetProcessHeap () returned 0xd20000 [0095.962] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.962] GetProcessHeap () returned 0xd20000 [0095.962] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.962] GetProcessHeap () returned 0xd20000 [0095.962] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.962] GetProcessHeap () returned 0xd20000 [0095.962] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.962] GetProcessHeap () returned 0xd20000 [0095.962] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.962] GetProcessHeap () returned 0xd20000 [0095.962] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0095.962] GetProcessHeap () returned 0xd20000 [0095.962] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0095.962] GetProcessHeap () returned 0xd20000 [0095.962] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.962] GetProcessHeap () returned 0xd20000 [0095.962] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.962] GetProcessHeap () returned 0xd20000 [0095.962] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.963] GetProcessHeap () returned 0xd20000 [0095.963] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.963] GetProcessHeap () returned 0xd20000 [0095.963] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.963] GetProcessHeap () returned 0xd20000 [0095.963] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.963] GetProcessHeap () returned 0xd20000 [0095.963] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.963] GetProcessHeap () returned 0xd20000 [0095.963] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.963] GetProcessHeap () returned 0xd20000 [0095.963] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.963] GetProcessHeap () returned 0xd20000 [0095.963] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.963] GetProcessHeap () returned 0xd20000 [0095.963] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.963] GetProcessHeap () returned 0xd20000 [0095.963] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.963] GetProcessHeap () returned 0xd20000 [0095.963] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.963] GetProcessHeap () returned 0xd20000 [0095.963] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.964] GetProcessHeap () returned 0xd20000 [0095.964] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.964] GetProcessHeap () returned 0xd20000 [0095.964] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.964] GetProcessHeap () returned 0xd20000 [0095.964] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.964] GetProcessHeap () returned 0xd20000 [0095.964] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.964] GetProcessHeap () returned 0xd20000 [0095.964] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.964] GetProcessHeap () returned 0xd20000 [0095.964] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.964] GetProcessHeap () returned 0xd20000 [0095.964] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0095.964] GetProcessHeap () returned 0xd20000 [0095.964] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0095.964] GetProcessHeap () returned 0xd20000 [0095.964] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.964] GetProcessHeap () returned 0xd20000 [0095.964] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.964] GetProcessHeap () returned 0xd20000 [0095.964] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.965] GetProcessHeap () returned 0xd20000 [0095.965] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.965] GetProcessHeap () returned 0xd20000 [0095.965] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.965] GetProcessHeap () returned 0xd20000 [0095.965] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.965] GetProcessHeap () returned 0xd20000 [0095.965] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0095.965] GetProcessHeap () returned 0xd20000 [0095.965] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0095.965] GetProcessHeap () returned 0xd20000 [0095.965] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.965] GetProcessHeap () returned 0xd20000 [0095.965] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.965] GetProcessHeap () returned 0xd20000 [0095.965] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0095.965] GetProcessHeap () returned 0xd20000 [0095.965] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0095.965] GetProcessHeap () returned 0xd20000 [0095.965] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.966] GetProcessHeap () returned 0xd20000 [0095.966] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0095.966] GetProcessHeap () returned 0xd20000 [0095.966] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0095.966] GetProcessHeap () returned 0xd20000 [0095.966] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0095.966] GetProcessHeap () returned 0xd20000 [0095.966] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0095.966] GetProcessHeap () returned 0xd20000 [0095.966] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0095.966] GetProcessHeap () returned 0xd20000 [0095.966] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0095.966] GetProcessHeap () returned 0xd20000 [0095.966] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0095.966] GetProcessHeap () returned 0xd20000 [0095.966] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0095.966] GetProcessHeap () returned 0xd20000 [0095.966] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0095.966] GetProcessHeap () returned 0xd20000 [0095.966] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446a8 | out: hHeap=0xd20000) returned 1 [0095.967] GetProcessHeap () returned 0xd20000 [0095.967] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ac18 | out: hHeap=0xd20000) returned 1 [0095.967] GetProcessHeap () returned 0xd20000 [0095.967] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0095.967] GetProcessHeap () returned 0xd20000 [0095.967] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b248 | out: hHeap=0xd20000) returned 1 [0095.967] GetProcessHeap () returned 0xd20000 [0095.967] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0095.967] GetProcessHeap () returned 0xd20000 [0095.967] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0095.967] GetProcessHeap () returned 0xd20000 [0095.967] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0095.967] WriteFile (in: hFile=0x230, lpBuffer=0xd4dec8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4dec8*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0095.975] GetProcessHeap () returned 0xd20000 [0095.975] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4dec8, Size=0x30) returned 0xd4dec8 [0095.975] GetProcessHeap () returned 0xd20000 [0095.975] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0095.975] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0095.975] GetProcessHeap () returned 0xd20000 [0095.975] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x12720) returned 0xd4df00 [0095.975] ReadFile (in: hFile=0x230, lpBuffer=0xd4df00, nNumberOfBytesToRead=0x12720, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4df00*, lpNumberOfBytesRead=0x299d7e8*=0x12720, lpOverlapped=0x0) returned 1 [0095.978] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0095.978] WriteFile (in: hFile=0x230, lpBuffer=0xd4df00*, nNumberOfBytesToWrite=0x12720, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4df00*, lpNumberOfBytesWritten=0x299d7e4*=0x12720, lpOverlapped=0x0) returned 1 [0095.981] GetProcessHeap () returned 0xd20000 [0095.981] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4df00 | out: hHeap=0xd20000) returned 1 [0095.981] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0095.981] WriteFile (in: hFile=0x230, lpBuffer=0xd4dec8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4dec8*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0095.983] CloseHandle (hObject=0x230) returned 1 [0095.989] GetProcessHeap () returned 0xd20000 [0095.989] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42760 | out: hHeap=0xd20000) returned 1 [0095.989] GetProcessHeap () returned 0xd20000 [0095.989] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c160 | out: hHeap=0xd20000) returned 1 [0095.989] GetProcessHeap () returned 0xd20000 [0095.989] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0095.989] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" [0095.989] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm.[ponce.lorena@aol.com]" [0095.989] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sr-latn-cs.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0095.990] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sr-latn-cs.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0095.990] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0095.991] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0095.991] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0095.991] GetProcessHeap () returned 0xd20000 [0095.991] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36568 | out: hHeap=0xd20000) returned 1 [0095.991] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e364e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5e364e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x112f7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_sv-se.htm", cAlternateFileName="EULA_S~4.HTM")) returned 1 [0095.991] lstrcmpiW (lpString1="EULA_sv-se.htm", lpString2=".") returned 1 [0095.991] lstrcmpiW (lpString1="EULA_sv-se.htm", lpString2="..") returned 1 [0095.991] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_sv-se.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" [0095.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_sv-se.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0095.991] GetProcessHeap () returned 0xd20000 [0095.991] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd445b8 [0095.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_sv-se.htm", cchWideChar=-1, lpMultiByteStr=0xd445b8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_sv-se.htm", lpUsedDefaultChar=0x0) returned 15 [0095.991] lstrlenA (lpString="EULA_sv-se.htm") returned 14 [0095.991] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0095.991] lstrlenA (lpString="EULA_sv-se.htm") returned 14 [0095.992] lstrlenA (lpString=".dll") returned 4 [0095.992] lstrlenA (lpString=".dll") returned 4 [0095.992] lstrlenA (lpString="EULA_sv-se.htm") returned 14 [0095.992] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0095.992] lstrlenA (lpString="EULA_sv-se.htm") returned 14 [0095.992] lstrlenA (lpString=".ini") returned 4 [0095.992] lstrlenA (lpString=".ini") returned 4 [0095.992] lstrlenA (lpString="EULA_sv-se.htm") returned 14 [0095.992] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0095.992] lstrlenA (lpString="EULA_sv-se.htm") returned 14 [0095.992] lstrlenA (lpString=".inc") returned 4 [0095.992] lstrlenA (lpString=".inc") returned 4 [0095.992] lstrlenA (lpString="EULA_sv-se.htm") returned 14 [0095.992] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0095.992] lstrcmpiW (lpString1="EULA_sv-se.htm", lpString2="HOW_RECOVER.html") returned -1 [0095.992] lstrcmpiW (lpString1="EULA_sv-se.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0095.992] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0095.992] lstrcmpiW (lpString1="EULA_sv-se.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0095.993] GetProcessHeap () returned 0xd20000 [0095.993] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42788 [0095.993] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0095.993] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=70391) returned 1 [0095.993] GetProcessHeap () returned 0xd20000 [0095.993] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bcb0 [0095.993] GetProcessHeap () returned 0xd20000 [0095.993] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0095.994] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm") returned 52 [0095.994] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0095.994] GetProcessHeap () returned 0xd20000 [0095.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0095.994] GetProcessHeap () returned 0xd20000 [0095.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x389) returned 0xd4df00 [0095.994] lstrlenA (lpString="rsa_encrypt") returned 11 [0095.994] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0095.997] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0095.997] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0095.997] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0095.997] GetProcessHeap () returned 0xd20000 [0095.997] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0095.997] lstrlenA (lpString="010001") returned 6 [0095.997] GetProcessHeap () returned 0xd20000 [0095.997] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc38 [0095.997] GetProcessHeap () returned 0xd20000 [0095.997] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0095.997] GetProcessHeap () returned 0xd20000 [0095.997] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b638 [0095.997] GetProcessHeap () returned 0xd20000 [0095.997] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0095.997] GetProcessHeap () returned 0xd20000 [0095.998] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b878 [0095.998] GetProcessHeap () returned 0xd20000 [0095.998] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45640 [0095.998] GetProcessHeap () returned 0xd20000 [0095.998] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc28 [0095.998] GetProcessHeap () returned 0xd20000 [0095.998] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0095.998] GetProcessHeap () returned 0xd20000 [0095.998] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0095.998] GetProcessHeap () returned 0xd20000 [0095.998] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0095.998] GetProcessHeap () returned 0xd20000 [0095.998] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0095.998] GetProcessHeap () returned 0xd20000 [0095.998] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44920 [0095.998] GetProcessHeap () returned 0xd20000 [0095.998] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0095.998] GetProcessHeap () returned 0xd20000 [0095.998] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445a0 [0095.999] GetProcessHeap () returned 0xd20000 [0095.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aaf8 [0095.999] GetProcessHeap () returned 0xd20000 [0095.999] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0095.999] GetProcessHeap () returned 0xd20000 [0095.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0095.999] GetProcessHeap () returned 0xd20000 [0095.999] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aaf8 | out: hHeap=0xd20000) returned 1 [0095.999] GetProcessHeap () returned 0xd20000 [0095.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0095.999] GetProcessHeap () returned 0xd20000 [0095.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44558 [0095.999] GetProcessHeap () returned 0xd20000 [0095.999] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0095.999] GetProcessHeap () returned 0xd20000 [0095.999] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0095.999] GetProcessHeap () returned 0xd20000 [0095.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0095.999] GetProcessHeap () returned 0xd20000 [0096.000] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.000] GetProcessHeap () returned 0xd20000 [0096.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.000] GetProcessHeap () returned 0xd20000 [0096.000] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.000] GetProcessHeap () returned 0xd20000 [0096.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b518 [0096.000] GetProcessHeap () returned 0xd20000 [0096.000] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44558 | out: hHeap=0xd20000) returned 1 [0096.000] GetProcessHeap () returned 0xd20000 [0096.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0096.001] GetProcessHeap () returned 0xd20000 [0096.001] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0096.002] GetProcessHeap () returned 0xd20000 [0096.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.002] GetProcessHeap () returned 0xd20000 [0096.002] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.002] GetProcessHeap () returned 0xd20000 [0096.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.002] GetProcessHeap () returned 0xd20000 [0096.002] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.002] GetProcessHeap () returned 0xd20000 [0096.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0096.002] GetProcessHeap () returned 0xd20000 [0096.002] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0096.002] GetProcessHeap () returned 0xd20000 [0096.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.002] GetProcessHeap () returned 0xd20000 [0096.002] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.002] GetProcessHeap () returned 0xd20000 [0096.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.002] GetProcessHeap () returned 0xd20000 [0096.003] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.003] GetProcessHeap () returned 0xd20000 [0096.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.003] GetProcessHeap () returned 0xd20000 [0096.003] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.003] GetProcessHeap () returned 0xd20000 [0096.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0096.003] GetProcessHeap () returned 0xd20000 [0096.003] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0096.003] GetProcessHeap () returned 0xd20000 [0096.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.003] GetProcessHeap () returned 0xd20000 [0096.003] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.003] GetProcessHeap () returned 0xd20000 [0096.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0096.003] GetProcessHeap () returned 0xd20000 [0096.003] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0096.003] GetProcessHeap () returned 0xd20000 [0096.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.004] GetProcessHeap () returned 0xd20000 [0096.004] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.004] GetProcessHeap () returned 0xd20000 [0096.004] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.004] GetProcessHeap () returned 0xd20000 [0096.004] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.004] GetProcessHeap () returned 0xd20000 [0096.004] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.004] GetProcessHeap () returned 0xd20000 [0096.004] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.004] GetProcessHeap () returned 0xd20000 [0096.004] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.004] GetProcessHeap () returned 0xd20000 [0096.004] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.004] GetProcessHeap () returned 0xd20000 [0096.004] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0096.004] GetProcessHeap () returned 0xd20000 [0096.004] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0096.005] GetProcessHeap () returned 0xd20000 [0096.005] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0096.005] GetProcessHeap () returned 0xd20000 [0096.005] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0096.005] GetProcessHeap () returned 0xd20000 [0096.005] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.005] GetProcessHeap () returned 0xd20000 [0096.005] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.005] GetProcessHeap () returned 0xd20000 [0096.005] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0096.005] GetProcessHeap () returned 0xd20000 [0096.005] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0096.005] GetProcessHeap () returned 0xd20000 [0096.005] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.005] GetProcessHeap () returned 0xd20000 [0096.005] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.005] GetProcessHeap () returned 0xd20000 [0096.005] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.005] GetProcessHeap () returned 0xd20000 [0096.005] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.006] GetProcessHeap () returned 0xd20000 [0096.006] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.006] GetProcessHeap () returned 0xd20000 [0096.006] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.006] GetProcessHeap () returned 0xd20000 [0096.006] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.006] GetProcessHeap () returned 0xd20000 [0096.006] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.006] GetProcessHeap () returned 0xd20000 [0096.006] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0096.006] GetProcessHeap () returned 0xd20000 [0096.006] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0096.006] GetProcessHeap () returned 0xd20000 [0096.006] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0096.006] GetProcessHeap () returned 0xd20000 [0096.006] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0096.006] GetProcessHeap () returned 0xd20000 [0096.006] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0096.007] GetProcessHeap () returned 0xd20000 [0096.007] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0096.007] GetProcessHeap () returned 0xd20000 [0096.007] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.007] GetProcessHeap () returned 0xd20000 [0096.007] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.007] GetProcessHeap () returned 0xd20000 [0096.007] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0096.007] GetProcessHeap () returned 0xd20000 [0096.007] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0096.007] GetProcessHeap () returned 0xd20000 [0096.007] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.007] GetProcessHeap () returned 0xd20000 [0096.007] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.007] GetProcessHeap () returned 0xd20000 [0096.007] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0096.007] GetProcessHeap () returned 0xd20000 [0096.007] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0096.008] GetProcessHeap () returned 0xd20000 [0096.008] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0096.008] GetProcessHeap () returned 0xd20000 [0096.008] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0096.008] GetProcessHeap () returned 0xd20000 [0096.008] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.008] GetProcessHeap () returned 0xd20000 [0096.008] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.008] GetProcessHeap () returned 0xd20000 [0096.008] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0096.008] GetProcessHeap () returned 0xd20000 [0096.008] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0096.008] GetProcessHeap () returned 0xd20000 [0096.008] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0096.008] GetProcessHeap () returned 0xd20000 [0096.008] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0096.008] GetProcessHeap () returned 0xd20000 [0096.008] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.008] GetProcessHeap () returned 0xd20000 [0096.009] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.009] GetProcessHeap () returned 0xd20000 [0096.009] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.009] GetProcessHeap () returned 0xd20000 [0096.009] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.009] GetProcessHeap () returned 0xd20000 [0096.009] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.009] GetProcessHeap () returned 0xd20000 [0096.009] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.009] GetProcessHeap () returned 0xd20000 [0096.009] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0096.009] GetProcessHeap () returned 0xd20000 [0096.009] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0096.009] GetProcessHeap () returned 0xd20000 [0096.009] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.009] GetProcessHeap () returned 0xd20000 [0096.009] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.009] GetProcessHeap () returned 0xd20000 [0096.009] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.010] GetProcessHeap () returned 0xd20000 [0096.010] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.010] GetProcessHeap () returned 0xd20000 [0096.010] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.010] GetProcessHeap () returned 0xd20000 [0096.010] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.010] GetProcessHeap () returned 0xd20000 [0096.010] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0096.010] GetProcessHeap () returned 0xd20000 [0096.010] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0096.010] GetProcessHeap () returned 0xd20000 [0096.010] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.010] GetProcessHeap () returned 0xd20000 [0096.010] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.010] GetProcessHeap () returned 0xd20000 [0096.010] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.010] GetProcessHeap () returned 0xd20000 [0096.010] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.010] GetProcessHeap () returned 0xd20000 [0096.010] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0096.011] GetProcessHeap () returned 0xd20000 [0096.011] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0096.011] GetProcessHeap () returned 0xd20000 [0096.011] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.011] GetProcessHeap () returned 0xd20000 [0096.011] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.011] GetProcessHeap () returned 0xd20000 [0096.011] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.011] GetProcessHeap () returned 0xd20000 [0096.011] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.011] GetProcessHeap () returned 0xd20000 [0096.011] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0096.011] GetProcessHeap () returned 0xd20000 [0096.011] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0096.011] GetProcessHeap () returned 0xd20000 [0096.011] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.011] GetProcessHeap () returned 0xd20000 [0096.011] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.011] GetProcessHeap () returned 0xd20000 [0096.012] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.012] GetProcessHeap () returned 0xd20000 [0096.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.012] GetProcessHeap () returned 0xd20000 [0096.012] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.012] GetProcessHeap () returned 0xd20000 [0096.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.012] GetProcessHeap () returned 0xd20000 [0096.012] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.012] GetProcessHeap () returned 0xd20000 [0096.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.012] GetProcessHeap () returned 0xd20000 [0096.012] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.012] GetProcessHeap () returned 0xd20000 [0096.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.012] GetProcessHeap () returned 0xd20000 [0096.012] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.012] GetProcessHeap () returned 0xd20000 [0096.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.013] GetProcessHeap () returned 0xd20000 [0096.013] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0096.013] GetProcessHeap () returned 0xd20000 [0096.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0096.013] GetProcessHeap () returned 0xd20000 [0096.013] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.013] GetProcessHeap () returned 0xd20000 [0096.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.013] GetProcessHeap () returned 0xd20000 [0096.013] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.013] GetProcessHeap () returned 0xd20000 [0096.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.013] GetProcessHeap () returned 0xd20000 [0096.013] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.013] GetProcessHeap () returned 0xd20000 [0096.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.013] GetProcessHeap () returned 0xd20000 [0096.013] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.013] GetProcessHeap () returned 0xd20000 [0096.014] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.014] GetProcessHeap () returned 0xd20000 [0096.014] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.014] GetProcessHeap () returned 0xd20000 [0096.014] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.014] GetProcessHeap () returned 0xd20000 [0096.014] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.014] GetProcessHeap () returned 0xd20000 [0096.014] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.014] GetProcessHeap () returned 0xd20000 [0096.014] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0096.014] GetProcessHeap () returned 0xd20000 [0096.014] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0096.014] GetProcessHeap () returned 0xd20000 [0096.014] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.014] GetProcessHeap () returned 0xd20000 [0096.014] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.014] GetProcessHeap () returned 0xd20000 [0096.015] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.015] GetProcessHeap () returned 0xd20000 [0096.015] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.015] GetProcessHeap () returned 0xd20000 [0096.015] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.015] GetProcessHeap () returned 0xd20000 [0096.015] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.015] GetProcessHeap () returned 0xd20000 [0096.015] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0096.015] GetProcessHeap () returned 0xd20000 [0096.015] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0096.015] GetProcessHeap () returned 0xd20000 [0096.015] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.015] GetProcessHeap () returned 0xd20000 [0096.015] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.015] GetProcessHeap () returned 0xd20000 [0096.015] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.015] GetProcessHeap () returned 0xd20000 [0096.015] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.016] GetProcessHeap () returned 0xd20000 [0096.016] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.016] GetProcessHeap () returned 0xd20000 [0096.016] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.016] GetProcessHeap () returned 0xd20000 [0096.016] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0096.016] GetProcessHeap () returned 0xd20000 [0096.016] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0096.016] GetProcessHeap () returned 0xd20000 [0096.017] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.017] GetProcessHeap () returned 0xd20000 [0096.017] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.017] GetProcessHeap () returned 0xd20000 [0096.017] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.017] GetProcessHeap () returned 0xd20000 [0096.017] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.017] GetProcessHeap () returned 0xd20000 [0096.017] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.017] GetProcessHeap () returned 0xd20000 [0096.017] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.017] GetProcessHeap () returned 0xd20000 [0096.017] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0096.017] GetProcessHeap () returned 0xd20000 [0096.017] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0096.017] GetProcessHeap () returned 0xd20000 [0096.017] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.017] GetProcessHeap () returned 0xd20000 [0096.017] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.018] GetProcessHeap () returned 0xd20000 [0096.018] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0096.018] GetProcessHeap () returned 0xd20000 [0096.018] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0096.018] GetProcessHeap () returned 0xd20000 [0096.018] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.018] GetProcessHeap () returned 0xd20000 [0096.018] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.018] GetProcessHeap () returned 0xd20000 [0096.018] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.018] GetProcessHeap () returned 0xd20000 [0096.018] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.018] GetProcessHeap () returned 0xd20000 [0096.018] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.018] GetProcessHeap () returned 0xd20000 [0096.018] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.018] GetProcessHeap () returned 0xd20000 [0096.018] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.018] GetProcessHeap () returned 0xd20000 [0096.019] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.019] GetProcessHeap () returned 0xd20000 [0096.019] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0096.019] GetProcessHeap () returned 0xd20000 [0096.019] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0096.019] GetProcessHeap () returned 0xd20000 [0096.019] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.019] GetProcessHeap () returned 0xd20000 [0096.019] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.019] GetProcessHeap () returned 0xd20000 [0096.019] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.019] GetProcessHeap () returned 0xd20000 [0096.019] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.019] GetProcessHeap () returned 0xd20000 [0096.019] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.019] GetProcessHeap () returned 0xd20000 [0096.019] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.019] GetProcessHeap () returned 0xd20000 [0096.019] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.020] GetProcessHeap () returned 0xd20000 [0096.020] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.020] GetProcessHeap () returned 0xd20000 [0096.020] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0096.020] GetProcessHeap () returned 0xd20000 [0096.020] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0096.020] GetProcessHeap () returned 0xd20000 [0096.020] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.020] GetProcessHeap () returned 0xd20000 [0096.020] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.020] GetProcessHeap () returned 0xd20000 [0096.020] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0096.020] GetProcessHeap () returned 0xd20000 [0096.020] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0096.020] GetProcessHeap () returned 0xd20000 [0096.020] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0096.020] GetProcessHeap () returned 0xd20000 [0096.020] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0096.020] GetProcessHeap () returned 0xd20000 [0096.021] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445a0 | out: hHeap=0xd20000) returned 1 [0096.021] GetProcessHeap () returned 0xd20000 [0096.021] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b878 | out: hHeap=0xd20000) returned 1 [0096.021] GetProcessHeap () returned 0xd20000 [0096.021] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0096.021] GetProcessHeap () returned 0xd20000 [0096.021] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b638 | out: hHeap=0xd20000) returned 1 [0096.021] GetProcessHeap () returned 0xd20000 [0096.021] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0096.021] GetProcessHeap () returned 0xd20000 [0096.021] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0096.021] GetProcessHeap () returned 0xd20000 [0096.021] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0096.021] WriteFile (in: hFile=0x230, lpBuffer=0xd4df00*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4df00*, lpNumberOfBytesWritten=0x299d864*=0x389, lpOverlapped=0x0) returned 1 [0096.033] GetProcessHeap () returned 0xd20000 [0096.033] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4df00, Size=0x30) returned 0xd4df00 [0096.033] GetProcessHeap () returned 0xd20000 [0096.033] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0096.033] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0096.033] GetProcessHeap () returned 0xd20000 [0096.033] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x11300) returned 0xd4df38 [0096.035] ReadFile (in: hFile=0x230, lpBuffer=0xd4df38, nNumberOfBytesToRead=0x11300, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4df38*, lpNumberOfBytesRead=0x299d7e8*=0x11300, lpOverlapped=0x0) returned 1 [0096.037] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0096.038] WriteFile (in: hFile=0x230, lpBuffer=0xd4df38*, nNumberOfBytesToWrite=0x11300, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4df38*, lpNumberOfBytesWritten=0x299d7e4*=0x11300, lpOverlapped=0x0) returned 1 [0096.040] GetProcessHeap () returned 0xd20000 [0096.040] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4df38 | out: hHeap=0xd20000) returned 1 [0096.040] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0096.040] WriteFile (in: hFile=0x230, lpBuffer=0xd4df00*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4df00*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0096.042] CloseHandle (hObject=0x230) returned 1 [0096.049] GetProcessHeap () returned 0xd20000 [0096.049] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42788 | out: hHeap=0xd20000) returned 1 [0096.049] GetProcessHeap () returned 0xd20000 [0096.049] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bcb0 | out: hHeap=0xd20000) returned 1 [0096.049] GetProcessHeap () returned 0xd20000 [0096.050] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0096.050] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" [0096.050] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm.[ponce.lorena@aol.com]" [0096.050] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_sv-se.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0096.051] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_sv-se.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0096.051] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0096.051] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0096.051] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0096.051] GetProcessHeap () returned 0xd20000 [0096.051] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445b8 | out: hHeap=0xd20000) returned 1 [0096.051] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e364e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5e364e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x3e0c1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_th-th.htm", cAlternateFileName="EULA_T~1.HTM")) returned 1 [0096.051] lstrcmpiW (lpString1="EULA_th-th.htm", lpString2=".") returned 1 [0096.051] lstrcmpiW (lpString1="EULA_th-th.htm", lpString2="..") returned 1 [0096.051] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_th-th.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" [0096.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_th-th.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0096.051] GetProcessHeap () returned 0xd20000 [0096.051] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd446c0 [0096.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_th-th.htm", cchWideChar=-1, lpMultiByteStr=0xd446c0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_th-th.htm", lpUsedDefaultChar=0x0) returned 15 [0096.052] lstrlenA (lpString="EULA_th-th.htm") returned 14 [0096.052] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0096.052] lstrlenA (lpString="EULA_th-th.htm") returned 14 [0096.052] lstrlenA (lpString=".dll") returned 4 [0096.052] lstrlenA (lpString=".dll") returned 4 [0096.052] lstrlenA (lpString="EULA_th-th.htm") returned 14 [0096.052] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0096.052] lstrlenA (lpString="EULA_th-th.htm") returned 14 [0096.052] lstrlenA (lpString=".ini") returned 4 [0096.052] lstrlenA (lpString=".ini") returned 4 [0096.052] lstrlenA (lpString="EULA_th-th.htm") returned 14 [0096.052] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0096.052] lstrlenA (lpString="EULA_th-th.htm") returned 14 [0096.052] lstrlenA (lpString=".inc") returned 4 [0096.052] lstrlenA (lpString=".inc") returned 4 [0096.052] lstrlenA (lpString="EULA_th-th.htm") returned 14 [0096.052] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0096.052] lstrcmpiW (lpString1="EULA_th-th.htm", lpString2="HOW_RECOVER.html") returned -1 [0096.053] lstrcmpiW (lpString1="EULA_th-th.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0096.053] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0096.053] lstrcmpiW (lpString1="EULA_th-th.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0096.053] GetProcessHeap () returned 0xd20000 [0096.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42738 [0096.053] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0096.053] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=254145) returned 1 [0096.053] GetProcessHeap () returned 0xd20000 [0096.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c1d8 [0096.053] GetProcessHeap () returned 0xd20000 [0096.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0096.054] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm") returned 52 [0096.054] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0096.054] GetProcessHeap () returned 0xd20000 [0096.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0096.054] GetProcessHeap () returned 0xd20000 [0096.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4df38 [0096.054] lstrlenA (lpString="rsa_encrypt") returned 11 [0096.054] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0096.059] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0096.059] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0096.059] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0096.059] GetProcessHeap () returned 0xd20000 [0096.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0096.059] lstrlenA (lpString="010001") returned 6 [0096.059] GetProcessHeap () returned 0xd20000 [0096.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0096.059] GetProcessHeap () returned 0xd20000 [0096.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0096.060] GetProcessHeap () returned 0xd20000 [0096.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b7e8 [0096.060] GetProcessHeap () returned 0xd20000 [0096.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0096.060] GetProcessHeap () returned 0xd20000 [0096.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ab88 [0096.060] GetProcessHeap () returned 0xd20000 [0096.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44808 [0096.060] GetProcessHeap () returned 0xd20000 [0096.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc98 [0096.060] GetProcessHeap () returned 0xd20000 [0096.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0096.060] GetProcessHeap () returned 0xd20000 [0096.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.060] GetProcessHeap () returned 0xd20000 [0096.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44c68 [0096.060] GetProcessHeap () returned 0xd20000 [0096.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0096.060] GetProcessHeap () returned 0xd20000 [0096.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44920 [0096.061] GetProcessHeap () returned 0xd20000 [0096.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.061] GetProcessHeap () returned 0xd20000 [0096.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444e0 [0096.061] GetProcessHeap () returned 0xd20000 [0096.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b878 [0096.061] GetProcessHeap () returned 0xd20000 [0096.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0096.061] GetProcessHeap () returned 0xd20000 [0096.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0096.061] GetProcessHeap () returned 0xd20000 [0096.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b878 | out: hHeap=0xd20000) returned 1 [0096.061] GetProcessHeap () returned 0xd20000 [0096.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.061] GetProcessHeap () returned 0xd20000 [0096.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445b8 [0096.061] GetProcessHeap () returned 0xd20000 [0096.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.061] GetProcessHeap () returned 0xd20000 [0096.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.062] GetProcessHeap () returned 0xd20000 [0096.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.062] GetProcessHeap () returned 0xd20000 [0096.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.062] GetProcessHeap () returned 0xd20000 [0096.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.062] GetProcessHeap () returned 0xd20000 [0096.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.062] GetProcessHeap () returned 0xd20000 [0096.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b878 [0096.062] GetProcessHeap () returned 0xd20000 [0096.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445b8 | out: hHeap=0xd20000) returned 1 [0096.062] GetProcessHeap () returned 0xd20000 [0096.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0096.062] GetProcessHeap () returned 0xd20000 [0096.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b878 | out: hHeap=0xd20000) returned 1 [0096.062] GetProcessHeap () returned 0xd20000 [0096.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.062] GetProcessHeap () returned 0xd20000 [0096.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.063] GetProcessHeap () returned 0xd20000 [0096.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.063] GetProcessHeap () returned 0xd20000 [0096.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.063] GetProcessHeap () returned 0xd20000 [0096.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0096.063] GetProcessHeap () returned 0xd20000 [0096.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0096.063] GetProcessHeap () returned 0xd20000 [0096.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.063] GetProcessHeap () returned 0xd20000 [0096.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.063] GetProcessHeap () returned 0xd20000 [0096.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0096.064] GetProcessHeap () returned 0xd20000 [0096.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0096.064] GetProcessHeap () returned 0xd20000 [0096.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.064] GetProcessHeap () returned 0xd20000 [0096.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.064] GetProcessHeap () returned 0xd20000 [0096.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.064] GetProcessHeap () returned 0xd20000 [0096.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.064] GetProcessHeap () returned 0xd20000 [0096.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.064] GetProcessHeap () returned 0xd20000 [0096.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.064] GetProcessHeap () returned 0xd20000 [0096.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0096.064] GetProcessHeap () returned 0xd20000 [0096.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0096.064] GetProcessHeap () returned 0xd20000 [0096.065] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0096.065] GetProcessHeap () returned 0xd20000 [0096.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0096.065] GetProcessHeap () returned 0xd20000 [0096.065] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.065] GetProcessHeap () returned 0xd20000 [0096.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.065] GetProcessHeap () returned 0xd20000 [0096.065] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.065] GetProcessHeap () returned 0xd20000 [0096.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.065] GetProcessHeap () returned 0xd20000 [0096.065] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.065] GetProcessHeap () returned 0xd20000 [0096.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.065] GetProcessHeap () returned 0xd20000 [0096.065] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.065] GetProcessHeap () returned 0xd20000 [0096.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.066] GetProcessHeap () returned 0xd20000 [0096.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.066] GetProcessHeap () returned 0xd20000 [0096.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.066] GetProcessHeap () returned 0xd20000 [0096.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.066] GetProcessHeap () returned 0xd20000 [0096.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.066] GetProcessHeap () returned 0xd20000 [0096.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0096.066] GetProcessHeap () returned 0xd20000 [0096.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0096.066] GetProcessHeap () returned 0xd20000 [0096.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.066] GetProcessHeap () returned 0xd20000 [0096.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.066] GetProcessHeap () returned 0xd20000 [0096.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0096.066] GetProcessHeap () returned 0xd20000 [0096.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0096.067] GetProcessHeap () returned 0xd20000 [0096.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.067] GetProcessHeap () returned 0xd20000 [0096.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.067] GetProcessHeap () returned 0xd20000 [0096.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.067] GetProcessHeap () returned 0xd20000 [0096.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.067] GetProcessHeap () returned 0xd20000 [0096.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.067] GetProcessHeap () returned 0xd20000 [0096.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.067] GetProcessHeap () returned 0xd20000 [0096.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.067] GetProcessHeap () returned 0xd20000 [0096.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.067] GetProcessHeap () returned 0xd20000 [0096.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0096.067] GetProcessHeap () returned 0xd20000 [0096.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0096.068] GetProcessHeap () returned 0xd20000 [0096.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0096.068] GetProcessHeap () returned 0xd20000 [0096.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0096.068] GetProcessHeap () returned 0xd20000 [0096.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0096.068] GetProcessHeap () returned 0xd20000 [0096.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0096.068] GetProcessHeap () returned 0xd20000 [0096.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.068] GetProcessHeap () returned 0xd20000 [0096.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.068] GetProcessHeap () returned 0xd20000 [0096.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.068] GetProcessHeap () returned 0xd20000 [0096.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.068] GetProcessHeap () returned 0xd20000 [0096.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0096.069] GetProcessHeap () returned 0xd20000 [0096.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0096.069] GetProcessHeap () returned 0xd20000 [0096.069] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.069] GetProcessHeap () returned 0xd20000 [0096.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.069] GetProcessHeap () returned 0xd20000 [0096.069] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.069] GetProcessHeap () returned 0xd20000 [0096.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.069] GetProcessHeap () returned 0xd20000 [0096.069] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0096.069] GetProcessHeap () returned 0xd20000 [0096.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0096.069] GetProcessHeap () returned 0xd20000 [0096.069] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.069] GetProcessHeap () returned 0xd20000 [0096.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.069] GetProcessHeap () returned 0xd20000 [0096.070] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0096.070] GetProcessHeap () returned 0xd20000 [0096.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0096.070] GetProcessHeap () returned 0xd20000 [0096.070] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.070] GetProcessHeap () returned 0xd20000 [0096.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.070] GetProcessHeap () returned 0xd20000 [0096.070] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.070] GetProcessHeap () returned 0xd20000 [0096.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.070] GetProcessHeap () returned 0xd20000 [0096.070] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.070] GetProcessHeap () returned 0xd20000 [0096.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.070] GetProcessHeap () returned 0xd20000 [0096.070] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.070] GetProcessHeap () returned 0xd20000 [0096.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.070] GetProcessHeap () returned 0xd20000 [0096.071] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.071] GetProcessHeap () returned 0xd20000 [0096.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.071] GetProcessHeap () returned 0xd20000 [0096.071] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.071] GetProcessHeap () returned 0xd20000 [0096.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.071] GetProcessHeap () returned 0xd20000 [0096.071] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.071] GetProcessHeap () returned 0xd20000 [0096.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.071] GetProcessHeap () returned 0xd20000 [0096.071] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.071] GetProcessHeap () returned 0xd20000 [0096.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.071] GetProcessHeap () returned 0xd20000 [0096.071] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0096.071] GetProcessHeap () returned 0xd20000 [0096.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0096.071] GetProcessHeap () returned 0xd20000 [0096.072] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.072] GetProcessHeap () returned 0xd20000 [0096.072] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.072] GetProcessHeap () returned 0xd20000 [0096.072] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0096.072] GetProcessHeap () returned 0xd20000 [0096.072] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0096.072] GetProcessHeap () returned 0xd20000 [0096.072] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.072] GetProcessHeap () returned 0xd20000 [0096.072] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.072] GetProcessHeap () returned 0xd20000 [0096.072] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.072] GetProcessHeap () returned 0xd20000 [0096.072] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.072] GetProcessHeap () returned 0xd20000 [0096.072] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.072] GetProcessHeap () returned 0xd20000 [0096.072] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.072] GetProcessHeap () returned 0xd20000 [0096.073] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0096.073] GetProcessHeap () returned 0xd20000 [0096.073] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0096.073] GetProcessHeap () returned 0xd20000 [0096.073] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.073] GetProcessHeap () returned 0xd20000 [0096.073] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.073] GetProcessHeap () returned 0xd20000 [0096.073] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.073] GetProcessHeap () returned 0xd20000 [0096.073] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.073] GetProcessHeap () returned 0xd20000 [0096.073] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.073] GetProcessHeap () returned 0xd20000 [0096.073] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.073] GetProcessHeap () returned 0xd20000 [0096.073] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.073] GetProcessHeap () returned 0xd20000 [0096.073] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.073] GetProcessHeap () returned 0xd20000 [0096.074] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.074] GetProcessHeap () returned 0xd20000 [0096.074] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.074] GetProcessHeap () returned 0xd20000 [0096.074] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.074] GetProcessHeap () returned 0xd20000 [0096.074] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.074] GetProcessHeap () returned 0xd20000 [0096.074] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.074] GetProcessHeap () returned 0xd20000 [0096.074] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.074] GetProcessHeap () returned 0xd20000 [0096.074] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.074] GetProcessHeap () returned 0xd20000 [0096.074] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.074] GetProcessHeap () returned 0xd20000 [0096.074] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.074] GetProcessHeap () returned 0xd20000 [0096.074] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.074] GetProcessHeap () returned 0xd20000 [0096.075] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.075] GetProcessHeap () returned 0xd20000 [0096.075] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.075] GetProcessHeap () returned 0xd20000 [0096.075] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.075] GetProcessHeap () returned 0xd20000 [0096.075] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.075] GetProcessHeap () returned 0xd20000 [0096.075] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.075] GetProcessHeap () returned 0xd20000 [0096.075] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.075] GetProcessHeap () returned 0xd20000 [0096.075] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.075] GetProcessHeap () returned 0xd20000 [0096.075] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.075] GetProcessHeap () returned 0xd20000 [0096.075] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0096.075] GetProcessHeap () returned 0xd20000 [0096.075] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0096.075] GetProcessHeap () returned 0xd20000 [0096.076] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.076] GetProcessHeap () returned 0xd20000 [0096.076] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.076] GetProcessHeap () returned 0xd20000 [0096.076] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.076] GetProcessHeap () returned 0xd20000 [0096.076] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.076] GetProcessHeap () returned 0xd20000 [0096.076] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.076] GetProcessHeap () returned 0xd20000 [0096.076] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.076] GetProcessHeap () returned 0xd20000 [0096.076] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.076] GetProcessHeap () returned 0xd20000 [0096.076] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.076] GetProcessHeap () returned 0xd20000 [0096.076] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.076] GetProcessHeap () returned 0xd20000 [0096.076] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.076] GetProcessHeap () returned 0xd20000 [0096.077] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.077] GetProcessHeap () returned 0xd20000 [0096.077] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.077] GetProcessHeap () returned 0xd20000 [0096.077] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.077] GetProcessHeap () returned 0xd20000 [0096.077] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.077] GetProcessHeap () returned 0xd20000 [0096.077] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0096.077] GetProcessHeap () returned 0xd20000 [0096.077] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0096.077] GetProcessHeap () returned 0xd20000 [0096.077] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0096.077] GetProcessHeap () returned 0xd20000 [0096.077] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0096.077] GetProcessHeap () returned 0xd20000 [0096.077] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.077] GetProcessHeap () returned 0xd20000 [0096.077] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.078] GetProcessHeap () returned 0xd20000 [0096.078] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.078] GetProcessHeap () returned 0xd20000 [0096.078] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.078] GetProcessHeap () returned 0xd20000 [0096.078] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0096.078] GetProcessHeap () returned 0xd20000 [0096.078] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0096.078] GetProcessHeap () returned 0xd20000 [0096.078] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.078] GetProcessHeap () returned 0xd20000 [0096.078] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.078] GetProcessHeap () returned 0xd20000 [0096.078] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0096.079] GetProcessHeap () returned 0xd20000 [0096.079] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0096.079] GetProcessHeap () returned 0xd20000 [0096.079] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.079] GetProcessHeap () returned 0xd20000 [0096.079] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.079] GetProcessHeap () returned 0xd20000 [0096.079] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0096.079] GetProcessHeap () returned 0xd20000 [0096.079] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0096.079] GetProcessHeap () returned 0xd20000 [0096.079] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.079] GetProcessHeap () returned 0xd20000 [0096.079] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.079] GetProcessHeap () returned 0xd20000 [0096.079] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.079] GetProcessHeap () returned 0xd20000 [0096.079] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.079] GetProcessHeap () returned 0xd20000 [0096.079] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0096.080] GetProcessHeap () returned 0xd20000 [0096.080] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0096.080] GetProcessHeap () returned 0xd20000 [0096.080] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.080] GetProcessHeap () returned 0xd20000 [0096.080] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.080] GetProcessHeap () returned 0xd20000 [0096.080] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.080] GetProcessHeap () returned 0xd20000 [0096.080] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.080] GetProcessHeap () returned 0xd20000 [0096.080] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.080] GetProcessHeap () returned 0xd20000 [0096.080] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.080] GetProcessHeap () returned 0xd20000 [0096.080] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0096.080] GetProcessHeap () returned 0xd20000 [0096.080] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0096.080] GetProcessHeap () returned 0xd20000 [0096.080] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0096.080] GetProcessHeap () returned 0xd20000 [0096.081] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0096.081] GetProcessHeap () returned 0xd20000 [0096.081] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444e0 | out: hHeap=0xd20000) returned 1 [0096.081] GetProcessHeap () returned 0xd20000 [0096.081] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ab88 | out: hHeap=0xd20000) returned 1 [0096.081] GetProcessHeap () returned 0xd20000 [0096.081] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0096.081] GetProcessHeap () returned 0xd20000 [0096.081] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0096.081] GetProcessHeap () returned 0xd20000 [0096.081] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0096.081] GetProcessHeap () returned 0xd20000 [0096.081] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.081] GetProcessHeap () returned 0xd20000 [0096.081] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0096.081] WriteFile (in: hFile=0x230, lpBuffer=0xd4df38*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4df38*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0096.103] GetProcessHeap () returned 0xd20000 [0096.103] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4df38, Size=0x30) returned 0xd4df38 [0096.103] GetProcessHeap () returned 0xd20000 [0096.103] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0096.103] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0096.104] GetProcessHeap () returned 0xd20000 [0096.104] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x3e0c1) returned 0xd4df70 [0096.108] ReadFile (in: hFile=0x230, lpBuffer=0xd4df70, nNumberOfBytesToRead=0x3e0c1, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4df70*, lpNumberOfBytesRead=0x299d7e8*=0x3e0c1, lpOverlapped=0x0) returned 1 [0096.114] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0096.115] WriteFile (in: hFile=0x230, lpBuffer=0xd4df70*, nNumberOfBytesToWrite=0x3e0c1, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4df70*, lpNumberOfBytesWritten=0x299d7e4*=0x3e0c1, lpOverlapped=0x0) returned 1 [0096.121] GetProcessHeap () returned 0xd20000 [0096.121] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4df70 | out: hHeap=0xd20000) returned 1 [0096.121] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0096.121] WriteFile (in: hFile=0x230, lpBuffer=0xd4df38*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4df38*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0096.128] CloseHandle (hObject=0x230) returned 1 [0096.148] GetProcessHeap () returned 0xd20000 [0096.148] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42738 | out: hHeap=0xd20000) returned 1 [0096.148] GetProcessHeap () returned 0xd20000 [0096.148] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c1d8 | out: hHeap=0xd20000) returned 1 [0096.149] GetProcessHeap () returned 0xd20000 [0096.149] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0096.149] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" [0096.150] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm.[ponce.lorena@aol.com]" [0096.150] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_th-th.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0096.151] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_th-th.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0096.151] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0096.151] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0096.151] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0096.152] GetProcessHeap () returned 0xd20000 [0096.152] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446c0 | out: hHeap=0xd20000) returned 1 [0096.152] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5ed27d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5ed27d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x12581, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_tr-tr.htm", cAlternateFileName="EULA_T~2.HTM")) returned 1 [0096.152] lstrcmpiW (lpString1="EULA_tr-tr.htm", lpString2=".") returned 1 [0096.152] lstrcmpiW (lpString1="EULA_tr-tr.htm", lpString2="..") returned 1 [0096.152] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_tr-tr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" [0096.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_tr-tr.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0096.152] GetProcessHeap () returned 0xd20000 [0096.152] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd44690 [0096.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_tr-tr.htm", cchWideChar=-1, lpMultiByteStr=0xd44690, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_tr-tr.htm", lpUsedDefaultChar=0x0) returned 15 [0096.152] lstrlenA (lpString="EULA_tr-tr.htm") returned 14 [0096.152] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0096.152] lstrlenA (lpString="EULA_tr-tr.htm") returned 14 [0096.152] lstrlenA (lpString=".dll") returned 4 [0096.152] lstrlenA (lpString=".dll") returned 4 [0096.152] lstrlenA (lpString="EULA_tr-tr.htm") returned 14 [0096.153] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0096.153] lstrlenA (lpString="EULA_tr-tr.htm") returned 14 [0096.153] lstrlenA (lpString=".ini") returned 4 [0096.153] lstrlenA (lpString=".ini") returned 4 [0096.153] lstrlenA (lpString="EULA_tr-tr.htm") returned 14 [0096.153] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0096.153] lstrlenA (lpString="EULA_tr-tr.htm") returned 14 [0096.153] lstrlenA (lpString=".inc") returned 4 [0096.153] lstrlenA (lpString=".inc") returned 4 [0096.153] lstrlenA (lpString="EULA_tr-tr.htm") returned 14 [0096.153] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0096.153] lstrcmpiW (lpString1="EULA_tr-tr.htm", lpString2="HOW_RECOVER.html") returned -1 [0096.153] lstrcmpiW (lpString1="EULA_tr-tr.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0096.153] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0096.153] lstrcmpiW (lpString1="EULA_tr-tr.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0096.153] GetProcessHeap () returned 0xd20000 [0096.153] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42850 [0096.153] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0096.154] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=75137) returned 1 [0096.154] GetProcessHeap () returned 0xd20000 [0096.154] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bcb0 [0096.154] GetProcessHeap () returned 0xd20000 [0096.154] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0096.154] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm") returned 52 [0096.154] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0096.154] GetProcessHeap () returned 0xd20000 [0096.155] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0096.155] GetProcessHeap () returned 0xd20000 [0096.155] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4df70 [0096.155] lstrlenA (lpString="rsa_encrypt") returned 11 [0096.155] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0096.157] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0096.158] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0096.158] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0096.158] GetProcessHeap () returned 0xd20000 [0096.158] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0096.158] lstrlenA (lpString="010001") returned 6 [0096.158] GetProcessHeap () returned 0xd20000 [0096.158] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0096.158] GetProcessHeap () returned 0xd20000 [0096.158] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0096.158] GetProcessHeap () returned 0xd20000 [0096.158] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b098 [0096.158] GetProcessHeap () returned 0xd20000 [0096.158] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0096.158] GetProcessHeap () returned 0xd20000 [0096.158] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0096.158] GetProcessHeap () returned 0xd20000 [0096.158] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45528 [0096.158] GetProcessHeap () returned 0xd20000 [0096.159] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd98 [0096.159] GetProcessHeap () returned 0xd20000 [0096.159] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0096.159] GetProcessHeap () returned 0xd20000 [0096.159] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.159] GetProcessHeap () returned 0xd20000 [0096.159] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0096.159] GetProcessHeap () returned 0xd20000 [0096.159] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0096.159] GetProcessHeap () returned 0xd20000 [0096.159] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd451e0 [0096.159] GetProcessHeap () returned 0xd20000 [0096.159] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.159] GetProcessHeap () returned 0xd20000 [0096.159] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44528 [0096.159] GetProcessHeap () returned 0xd20000 [0096.159] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aa68 [0096.159] GetProcessHeap () returned 0xd20000 [0096.159] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0096.159] GetProcessHeap () returned 0xd20000 [0096.160] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0096.160] GetProcessHeap () returned 0xd20000 [0096.160] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aa68 | out: hHeap=0xd20000) returned 1 [0096.160] GetProcessHeap () returned 0xd20000 [0096.160] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0096.160] GetProcessHeap () returned 0xd20000 [0096.160] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44648 [0096.160] GetProcessHeap () returned 0xd20000 [0096.160] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.160] GetProcessHeap () returned 0xd20000 [0096.160] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0096.160] GetProcessHeap () returned 0xd20000 [0096.160] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.160] GetProcessHeap () returned 0xd20000 [0096.160] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.160] GetProcessHeap () returned 0xd20000 [0096.160] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.160] GetProcessHeap () returned 0xd20000 [0096.161] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.161] GetProcessHeap () returned 0xd20000 [0096.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4aee8 [0096.161] GetProcessHeap () returned 0xd20000 [0096.161] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44648 | out: hHeap=0xd20000) returned 1 [0096.161] GetProcessHeap () returned 0xd20000 [0096.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0096.161] GetProcessHeap () returned 0xd20000 [0096.161] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aee8 | out: hHeap=0xd20000) returned 1 [0096.161] GetProcessHeap () returned 0xd20000 [0096.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0096.161] GetProcessHeap () returned 0xd20000 [0096.161] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0096.161] GetProcessHeap () returned 0xd20000 [0096.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.161] GetProcessHeap () returned 0xd20000 [0096.161] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.161] GetProcessHeap () returned 0xd20000 [0096.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0096.161] GetProcessHeap () returned 0xd20000 [0096.162] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0096.162] GetProcessHeap () returned 0xd20000 [0096.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.162] GetProcessHeap () returned 0xd20000 [0096.162] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.162] GetProcessHeap () returned 0xd20000 [0096.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.162] GetProcessHeap () returned 0xd20000 [0096.162] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.162] GetProcessHeap () returned 0xd20000 [0096.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.162] GetProcessHeap () returned 0xd20000 [0096.162] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.162] GetProcessHeap () returned 0xd20000 [0096.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.162] GetProcessHeap () returned 0xd20000 [0096.162] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.162] GetProcessHeap () returned 0xd20000 [0096.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0096.162] GetProcessHeap () returned 0xd20000 [0096.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0096.163] GetProcessHeap () returned 0xd20000 [0096.163] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0096.163] GetProcessHeap () returned 0xd20000 [0096.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0096.163] GetProcessHeap () returned 0xd20000 [0096.163] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0096.163] GetProcessHeap () returned 0xd20000 [0096.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0096.163] GetProcessHeap () returned 0xd20000 [0096.163] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.163] GetProcessHeap () returned 0xd20000 [0096.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.163] GetProcessHeap () returned 0xd20000 [0096.163] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0096.163] GetProcessHeap () returned 0xd20000 [0096.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0096.164] GetProcessHeap () returned 0xd20000 [0096.164] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.164] GetProcessHeap () returned 0xd20000 [0096.164] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.164] GetProcessHeap () returned 0xd20000 [0096.164] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0096.164] GetProcessHeap () returned 0xd20000 [0096.164] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0096.164] GetProcessHeap () returned 0xd20000 [0096.164] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0096.164] GetProcessHeap () returned 0xd20000 [0096.164] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0096.164] GetProcessHeap () returned 0xd20000 [0096.164] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.164] GetProcessHeap () returned 0xd20000 [0096.164] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.164] GetProcessHeap () returned 0xd20000 [0096.164] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0096.164] GetProcessHeap () returned 0xd20000 [0096.164] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0096.165] GetProcessHeap () returned 0xd20000 [0096.165] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0096.165] GetProcessHeap () returned 0xd20000 [0096.165] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0096.165] GetProcessHeap () returned 0xd20000 [0096.165] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.165] GetProcessHeap () returned 0xd20000 [0096.165] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.165] GetProcessHeap () returned 0xd20000 [0096.165] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.165] GetProcessHeap () returned 0xd20000 [0096.165] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.165] GetProcessHeap () returned 0xd20000 [0096.165] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.165] GetProcessHeap () returned 0xd20000 [0096.165] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.165] GetProcessHeap () returned 0xd20000 [0096.165] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0096.165] GetProcessHeap () returned 0xd20000 [0096.166] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0096.166] GetProcessHeap () returned 0xd20000 [0096.166] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.166] GetProcessHeap () returned 0xd20000 [0096.166] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.166] GetProcessHeap () returned 0xd20000 [0096.166] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.166] GetProcessHeap () returned 0xd20000 [0096.166] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.166] GetProcessHeap () returned 0xd20000 [0096.166] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.166] GetProcessHeap () returned 0xd20000 [0096.166] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.166] GetProcessHeap () returned 0xd20000 [0096.166] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0096.166] GetProcessHeap () returned 0xd20000 [0096.166] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0096.166] GetProcessHeap () returned 0xd20000 [0096.166] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.166] GetProcessHeap () returned 0xd20000 [0096.167] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.167] GetProcessHeap () returned 0xd20000 [0096.167] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.167] GetProcessHeap () returned 0xd20000 [0096.167] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.167] GetProcessHeap () returned 0xd20000 [0096.167] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0096.167] GetProcessHeap () returned 0xd20000 [0096.167] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0096.167] GetProcessHeap () returned 0xd20000 [0096.167] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.167] GetProcessHeap () returned 0xd20000 [0096.167] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.167] GetProcessHeap () returned 0xd20000 [0096.167] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.167] GetProcessHeap () returned 0xd20000 [0096.167] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.167] GetProcessHeap () returned 0xd20000 [0096.167] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0096.168] GetProcessHeap () returned 0xd20000 [0096.168] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0096.168] GetProcessHeap () returned 0xd20000 [0096.168] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.168] GetProcessHeap () returned 0xd20000 [0096.168] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.168] GetProcessHeap () returned 0xd20000 [0096.168] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.168] GetProcessHeap () returned 0xd20000 [0096.168] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.168] GetProcessHeap () returned 0xd20000 [0096.168] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.168] GetProcessHeap () returned 0xd20000 [0096.168] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.168] GetProcessHeap () returned 0xd20000 [0096.168] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.168] GetProcessHeap () returned 0xd20000 [0096.168] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.168] GetProcessHeap () returned 0xd20000 [0096.168] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.169] GetProcessHeap () returned 0xd20000 [0096.169] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.169] GetProcessHeap () returned 0xd20000 [0096.169] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.169] GetProcessHeap () returned 0xd20000 [0096.169] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.169] GetProcessHeap () returned 0xd20000 [0096.169] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0096.169] GetProcessHeap () returned 0xd20000 [0096.169] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0096.169] GetProcessHeap () returned 0xd20000 [0096.169] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.169] GetProcessHeap () returned 0xd20000 [0096.169] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.169] GetProcessHeap () returned 0xd20000 [0096.169] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.169] GetProcessHeap () returned 0xd20000 [0096.169] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.170] GetProcessHeap () returned 0xd20000 [0096.170] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.170] GetProcessHeap () returned 0xd20000 [0096.170] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.170] GetProcessHeap () returned 0xd20000 [0096.170] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.170] GetProcessHeap () returned 0xd20000 [0096.170] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.170] GetProcessHeap () returned 0xd20000 [0096.170] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.170] GetProcessHeap () returned 0xd20000 [0096.170] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.170] GetProcessHeap () returned 0xd20000 [0096.170] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.170] GetProcessHeap () returned 0xd20000 [0096.170] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.170] GetProcessHeap () returned 0xd20000 [0096.170] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0096.171] GetProcessHeap () returned 0xd20000 [0096.171] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0096.171] GetProcessHeap () returned 0xd20000 [0096.171] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.171] GetProcessHeap () returned 0xd20000 [0096.171] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.171] GetProcessHeap () returned 0xd20000 [0096.171] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.171] GetProcessHeap () returned 0xd20000 [0096.171] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.171] GetProcessHeap () returned 0xd20000 [0096.171] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.171] GetProcessHeap () returned 0xd20000 [0096.171] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.171] GetProcessHeap () returned 0xd20000 [0096.171] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0096.171] GetProcessHeap () returned 0xd20000 [0096.171] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0096.171] GetProcessHeap () returned 0xd20000 [0096.172] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.172] GetProcessHeap () returned 0xd20000 [0096.172] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.172] GetProcessHeap () returned 0xd20000 [0096.172] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.172] GetProcessHeap () returned 0xd20000 [0096.172] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.172] GetProcessHeap () returned 0xd20000 [0096.172] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.172] GetProcessHeap () returned 0xd20000 [0096.172] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.172] GetProcessHeap () returned 0xd20000 [0096.173] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0096.173] GetProcessHeap () returned 0xd20000 [0096.173] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0096.173] GetProcessHeap () returned 0xd20000 [0096.173] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.173] GetProcessHeap () returned 0xd20000 [0096.173] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.173] GetProcessHeap () returned 0xd20000 [0096.173] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.173] GetProcessHeap () returned 0xd20000 [0096.173] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.173] GetProcessHeap () returned 0xd20000 [0096.173] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.173] GetProcessHeap () returned 0xd20000 [0096.173] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.173] GetProcessHeap () returned 0xd20000 [0096.173] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0096.173] GetProcessHeap () returned 0xd20000 [0096.173] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0096.173] GetProcessHeap () returned 0xd20000 [0096.174] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.174] GetProcessHeap () returned 0xd20000 [0096.174] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.174] GetProcessHeap () returned 0xd20000 [0096.174] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0096.174] GetProcessHeap () returned 0xd20000 [0096.174] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0096.174] GetProcessHeap () returned 0xd20000 [0096.174] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.174] GetProcessHeap () returned 0xd20000 [0096.174] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.174] GetProcessHeap () returned 0xd20000 [0096.174] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.174] GetProcessHeap () returned 0xd20000 [0096.174] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.174] GetProcessHeap () returned 0xd20000 [0096.174] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.174] GetProcessHeap () returned 0xd20000 [0096.174] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.175] GetProcessHeap () returned 0xd20000 [0096.175] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.175] GetProcessHeap () returned 0xd20000 [0096.175] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.175] GetProcessHeap () returned 0xd20000 [0096.175] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0096.175] GetProcessHeap () returned 0xd20000 [0096.175] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0096.175] GetProcessHeap () returned 0xd20000 [0096.175] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.175] GetProcessHeap () returned 0xd20000 [0096.175] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.175] GetProcessHeap () returned 0xd20000 [0096.175] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.175] GetProcessHeap () returned 0xd20000 [0096.175] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.175] GetProcessHeap () returned 0xd20000 [0096.175] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.175] GetProcessHeap () returned 0xd20000 [0096.175] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.176] GetProcessHeap () returned 0xd20000 [0096.176] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.176] GetProcessHeap () returned 0xd20000 [0096.176] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.176] GetProcessHeap () returned 0xd20000 [0096.176] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0096.176] GetProcessHeap () returned 0xd20000 [0096.176] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0096.176] GetProcessHeap () returned 0xd20000 [0096.176] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.176] GetProcessHeap () returned 0xd20000 [0096.176] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.176] GetProcessHeap () returned 0xd20000 [0096.176] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.176] GetProcessHeap () returned 0xd20000 [0096.176] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.176] GetProcessHeap () returned 0xd20000 [0096.176] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.176] GetProcessHeap () returned 0xd20000 [0096.176] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.176] GetProcessHeap () returned 0xd20000 [0096.177] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.177] GetProcessHeap () returned 0xd20000 [0096.177] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.177] GetProcessHeap () returned 0xd20000 [0096.177] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.177] GetProcessHeap () returned 0xd20000 [0096.177] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.177] GetProcessHeap () returned 0xd20000 [0096.177] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.177] GetProcessHeap () returned 0xd20000 [0096.177] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.177] GetProcessHeap () returned 0xd20000 [0096.177] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.177] GetProcessHeap () returned 0xd20000 [0096.177] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.177] GetProcessHeap () returned 0xd20000 [0096.177] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.177] GetProcessHeap () returned 0xd20000 [0096.177] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.177] GetProcessHeap () returned 0xd20000 [0096.178] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.178] GetProcessHeap () returned 0xd20000 [0096.178] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.178] GetProcessHeap () returned 0xd20000 [0096.179] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.179] GetProcessHeap () returned 0xd20000 [0096.179] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.180] GetProcessHeap () returned 0xd20000 [0096.180] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.180] GetProcessHeap () returned 0xd20000 [0096.181] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.181] GetProcessHeap () returned 0xd20000 [0096.181] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.181] GetProcessHeap () returned 0xd20000 [0096.182] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.182] GetProcessHeap () returned 0xd20000 [0096.182] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0096.182] GetProcessHeap () returned 0xd20000 [0096.183] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0096.183] GetProcessHeap () returned 0xd20000 [0096.183] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.183] GetProcessHeap () returned 0xd20000 [0096.184] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.184] GetProcessHeap () returned 0xd20000 [0096.184] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.184] GetProcessHeap () returned 0xd20000 [0096.185] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.185] GetProcessHeap () returned 0xd20000 [0096.185] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0096.186] GetProcessHeap () returned 0xd20000 [0096.186] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0096.186] GetProcessHeap () returned 0xd20000 [0096.186] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0096.186] GetProcessHeap () returned 0xd20000 [0096.186] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0096.186] GetProcessHeap () returned 0xd20000 [0096.186] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44528 | out: hHeap=0xd20000) returned 1 [0096.186] GetProcessHeap () returned 0xd20000 [0096.186] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0096.186] GetProcessHeap () returned 0xd20000 [0096.186] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0096.186] GetProcessHeap () returned 0xd20000 [0096.186] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b098 | out: hHeap=0xd20000) returned 1 [0096.187] GetProcessHeap () returned 0xd20000 [0096.187] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0096.187] GetProcessHeap () returned 0xd20000 [0096.187] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.187] GetProcessHeap () returned 0xd20000 [0096.187] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0096.187] WriteFile (in: hFile=0x230, lpBuffer=0xd4df70*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4df70*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0096.223] GetProcessHeap () returned 0xd20000 [0096.223] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4df70, Size=0x30) returned 0xd4df70 [0096.224] GetProcessHeap () returned 0xd20000 [0096.224] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0096.224] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0096.224] GetProcessHeap () returned 0xd20000 [0096.224] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x12581) returned 0xd4dfa8 [0096.226] ReadFile (in: hFile=0x230, lpBuffer=0xd4dfa8, nNumberOfBytesToRead=0x12581, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4dfa8*, lpNumberOfBytesRead=0x299d7e8*=0x12581, lpOverlapped=0x0) returned 1 [0096.228] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0096.229] WriteFile (in: hFile=0x230, lpBuffer=0xd4dfa8*, nNumberOfBytesToWrite=0x12581, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4dfa8*, lpNumberOfBytesWritten=0x299d7e4*=0x12581, lpOverlapped=0x0) returned 1 [0096.231] GetProcessHeap () returned 0xd20000 [0096.231] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4dfa8 | out: hHeap=0xd20000) returned 1 [0096.231] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0096.231] WriteFile (in: hFile=0x230, lpBuffer=0xd4df70*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4df70*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0096.233] CloseHandle (hObject=0x230) returned 1 [0096.245] GetProcessHeap () returned 0xd20000 [0096.245] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42850 | out: hHeap=0xd20000) returned 1 [0096.245] GetProcessHeap () returned 0xd20000 [0096.246] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bcb0 | out: hHeap=0xd20000) returned 1 [0096.246] GetProcessHeap () returned 0xd20000 [0096.246] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0096.246] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" [0096.247] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm.[ponce.lorena@aol.com]" [0096.247] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_tr-tr.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0096.250] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_tr-tr.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0096.250] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0096.250] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0096.250] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0096.250] GetProcessHeap () returned 0xd20000 [0096.252] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44690 | out: hHeap=0xd20000) returned 1 [0096.252] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5ed27d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5ed27d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x411eb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_uk-ua.htm", cAlternateFileName="EULA_U~1.HTM")) returned 1 [0096.252] lstrcmpiW (lpString1="EULA_uk-ua.htm", lpString2=".") returned 1 [0096.253] lstrcmpiW (lpString1="EULA_uk-ua.htm", lpString2="..") returned 1 [0096.253] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_uk-ua.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" [0096.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_uk-ua.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0096.254] GetProcessHeap () returned 0xd20000 [0096.254] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd44468 [0096.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_uk-ua.htm", cchWideChar=-1, lpMultiByteStr=0xd44468, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_uk-ua.htm", lpUsedDefaultChar=0x0) returned 15 [0096.254] lstrlenA (lpString="EULA_uk-ua.htm") returned 14 [0096.255] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0096.255] lstrlenA (lpString="EULA_uk-ua.htm") returned 14 [0096.255] lstrlenA (lpString=".dll") returned 4 [0096.255] lstrlenA (lpString=".dll") returned 4 [0096.256] lstrlenA (lpString="EULA_uk-ua.htm") returned 14 [0096.256] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0096.256] lstrlenA (lpString="EULA_uk-ua.htm") returned 14 [0096.256] lstrlenA (lpString=".ini") returned 4 [0096.257] lstrlenA (lpString=".ini") returned 4 [0096.257] lstrlenA (lpString="EULA_uk-ua.htm") returned 14 [0096.257] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0096.257] lstrlenA (lpString="EULA_uk-ua.htm") returned 14 [0096.258] lstrlenA (lpString=".inc") returned 4 [0096.258] lstrlenA (lpString=".inc") returned 4 [0096.258] lstrlenA (lpString="EULA_uk-ua.htm") returned 14 [0096.259] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0096.259] lstrcmpiW (lpString1="EULA_uk-ua.htm", lpString2="HOW_RECOVER.html") returned -1 [0096.259] lstrcmpiW (lpString1="EULA_uk-ua.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0096.259] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0096.259] lstrcmpiW (lpString1="EULA_uk-ua.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0096.259] GetProcessHeap () returned 0xd20000 [0096.259] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42580 [0096.259] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0096.262] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=266731) returned 1 [0096.262] GetProcessHeap () returned 0xd20000 [0096.263] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bda0 [0096.263] GetProcessHeap () returned 0xd20000 [0096.263] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0096.263] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm") returned 52 [0096.264] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0096.265] GetProcessHeap () returned 0xd20000 [0096.265] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0096.269] GetProcessHeap () returned 0xd20000 [0096.269] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x385) returned 0xd4dfa8 [0096.269] lstrlenA (lpString="rsa_encrypt") returned 11 [0096.269] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0096.275] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0096.275] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0096.276] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0096.276] GetProcessHeap () returned 0xd20000 [0096.276] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0096.276] lstrlenA (lpString="010001") returned 6 [0096.277] GetProcessHeap () returned 0xd20000 [0096.277] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc98 [0096.278] GetProcessHeap () returned 0xd20000 [0096.278] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0096.278] GetProcessHeap () returned 0xd20000 [0096.278] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b128 [0096.278] GetProcessHeap () returned 0xd20000 [0096.278] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0096.279] GetProcessHeap () returned 0xd20000 [0096.279] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b878 [0096.279] GetProcessHeap () returned 0xd20000 [0096.279] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd452f8 [0096.279] GetProcessHeap () returned 0xd20000 [0096.279] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cdb8 [0096.279] GetProcessHeap () returned 0xd20000 [0096.279] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0096.279] GetProcessHeap () returned 0xd20000 [0096.279] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.279] GetProcessHeap () returned 0xd20000 [0096.279] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0096.279] GetProcessHeap () returned 0xd20000 [0096.279] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0096.279] GetProcessHeap () returned 0xd20000 [0096.279] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd450c8 [0096.279] GetProcessHeap () returned 0xd20000 [0096.279] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0096.279] GetProcessHeap () returned 0xd20000 [0096.279] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444f8 [0096.280] GetProcessHeap () returned 0xd20000 [0096.280] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b7e8 [0096.280] GetProcessHeap () returned 0xd20000 [0096.281] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0096.281] GetProcessHeap () returned 0xd20000 [0096.281] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0096.345] GetProcessHeap () returned 0xd20000 [0096.345] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0096.345] GetProcessHeap () returned 0xd20000 [0096.345] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0096.345] GetProcessHeap () returned 0xd20000 [0096.345] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444c8 [0096.345] GetProcessHeap () returned 0xd20000 [0096.345] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0096.345] GetProcessHeap () returned 0xd20000 [0096.345] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0096.345] GetProcessHeap () returned 0xd20000 [0096.345] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.345] GetProcessHeap () returned 0xd20000 [0096.345] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.345] GetProcessHeap () returned 0xd20000 [0096.345] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.345] GetProcessHeap () returned 0xd20000 [0096.345] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.345] GetProcessHeap () returned 0xd20000 [0096.346] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4a948 [0096.346] GetProcessHeap () returned 0xd20000 [0096.346] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444c8 | out: hHeap=0xd20000) returned 1 [0096.346] GetProcessHeap () returned 0xd20000 [0096.346] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0096.346] GetProcessHeap () returned 0xd20000 [0096.346] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a948 | out: hHeap=0xd20000) returned 1 [0096.346] GetProcessHeap () returned 0xd20000 [0096.346] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.346] GetProcessHeap () returned 0xd20000 [0096.346] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.346] GetProcessHeap () returned 0xd20000 [0096.346] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.346] GetProcessHeap () returned 0xd20000 [0096.346] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.346] GetProcessHeap () returned 0xd20000 [0096.346] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0096.346] GetProcessHeap () returned 0xd20000 [0096.346] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0096.347] GetProcessHeap () returned 0xd20000 [0096.347] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.347] GetProcessHeap () returned 0xd20000 [0096.347] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.347] GetProcessHeap () returned 0xd20000 [0096.347] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0096.347] GetProcessHeap () returned 0xd20000 [0096.347] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0096.347] GetProcessHeap () returned 0xd20000 [0096.347] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.347] GetProcessHeap () returned 0xd20000 [0096.347] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.347] GetProcessHeap () returned 0xd20000 [0096.347] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.347] GetProcessHeap () returned 0xd20000 [0096.347] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.347] GetProcessHeap () returned 0xd20000 [0096.347] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.348] GetProcessHeap () returned 0xd20000 [0096.348] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.348] GetProcessHeap () returned 0xd20000 [0096.348] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.348] GetProcessHeap () returned 0xd20000 [0096.348] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.348] GetProcessHeap () returned 0xd20000 [0096.348] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0096.348] GetProcessHeap () returned 0xd20000 [0096.348] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0096.348] GetProcessHeap () returned 0xd20000 [0096.348] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0096.348] GetProcessHeap () returned 0xd20000 [0096.348] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0096.348] GetProcessHeap () returned 0xd20000 [0096.348] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0096.348] GetProcessHeap () returned 0xd20000 [0096.348] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0096.349] GetProcessHeap () returned 0xd20000 [0096.349] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.349] GetProcessHeap () returned 0xd20000 [0096.349] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.349] GetProcessHeap () returned 0xd20000 [0096.349] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.349] GetProcessHeap () returned 0xd20000 [0096.349] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.349] GetProcessHeap () returned 0xd20000 [0096.349] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0096.349] GetProcessHeap () returned 0xd20000 [0096.349] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0096.349] GetProcessHeap () returned 0xd20000 [0096.349] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.349] GetProcessHeap () returned 0xd20000 [0096.349] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.349] GetProcessHeap () returned 0xd20000 [0096.349] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.350] GetProcessHeap () returned 0xd20000 [0096.350] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.350] GetProcessHeap () returned 0xd20000 [0096.350] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0096.350] GetProcessHeap () returned 0xd20000 [0096.350] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0096.350] GetProcessHeap () returned 0xd20000 [0096.350] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.350] GetProcessHeap () returned 0xd20000 [0096.350] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.350] GetProcessHeap () returned 0xd20000 [0096.350] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0096.350] GetProcessHeap () returned 0xd20000 [0096.350] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0096.350] GetProcessHeap () returned 0xd20000 [0096.350] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.350] GetProcessHeap () returned 0xd20000 [0096.350] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.351] GetProcessHeap () returned 0xd20000 [0096.351] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.351] GetProcessHeap () returned 0xd20000 [0096.351] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.351] GetProcessHeap () returned 0xd20000 [0096.351] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.351] GetProcessHeap () returned 0xd20000 [0096.351] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.351] GetProcessHeap () returned 0xd20000 [0096.351] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.351] GetProcessHeap () returned 0xd20000 [0096.351] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.351] GetProcessHeap () returned 0xd20000 [0096.351] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.351] GetProcessHeap () returned 0xd20000 [0096.351] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.351] GetProcessHeap () returned 0xd20000 [0096.351] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.352] GetProcessHeap () returned 0xd20000 [0096.352] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.352] GetProcessHeap () returned 0xd20000 [0096.352] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.352] GetProcessHeap () returned 0xd20000 [0096.352] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.352] GetProcessHeap () returned 0xd20000 [0096.352] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.352] GetProcessHeap () returned 0xd20000 [0096.352] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.352] GetProcessHeap () returned 0xd20000 [0096.352] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0096.352] GetProcessHeap () returned 0xd20000 [0096.352] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0096.352] GetProcessHeap () returned 0xd20000 [0096.352] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.352] GetProcessHeap () returned 0xd20000 [0096.352] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.352] GetProcessHeap () returned 0xd20000 [0096.353] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0096.353] GetProcessHeap () returned 0xd20000 [0096.353] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0096.353] GetProcessHeap () returned 0xd20000 [0096.353] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.353] GetProcessHeap () returned 0xd20000 [0096.353] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.353] GetProcessHeap () returned 0xd20000 [0096.353] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.353] GetProcessHeap () returned 0xd20000 [0096.353] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.353] GetProcessHeap () returned 0xd20000 [0096.353] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.353] GetProcessHeap () returned 0xd20000 [0096.353] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.353] GetProcessHeap () returned 0xd20000 [0096.353] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0096.353] GetProcessHeap () returned 0xd20000 [0096.353] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0096.354] GetProcessHeap () returned 0xd20000 [0096.354] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.354] GetProcessHeap () returned 0xd20000 [0096.354] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.354] GetProcessHeap () returned 0xd20000 [0096.354] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.354] GetProcessHeap () returned 0xd20000 [0096.354] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.354] GetProcessHeap () returned 0xd20000 [0096.354] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.354] GetProcessHeap () returned 0xd20000 [0096.354] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.354] GetProcessHeap () returned 0xd20000 [0096.354] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.354] GetProcessHeap () returned 0xd20000 [0096.354] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.354] GetProcessHeap () returned 0xd20000 [0096.354] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.354] GetProcessHeap () returned 0xd20000 [0096.354] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.355] GetProcessHeap () returned 0xd20000 [0096.355] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.355] GetProcessHeap () returned 0xd20000 [0096.355] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.355] GetProcessHeap () returned 0xd20000 [0096.355] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.355] GetProcessHeap () returned 0xd20000 [0096.355] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.355] GetProcessHeap () returned 0xd20000 [0096.355] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.355] GetProcessHeap () returned 0xd20000 [0096.355] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.355] GetProcessHeap () returned 0xd20000 [0096.355] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.355] GetProcessHeap () returned 0xd20000 [0096.355] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.355] GetProcessHeap () returned 0xd20000 [0096.355] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.355] GetProcessHeap () returned 0xd20000 [0096.356] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.356] GetProcessHeap () returned 0xd20000 [0096.356] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.356] GetProcessHeap () returned 0xd20000 [0096.356] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.356] GetProcessHeap () returned 0xd20000 [0096.356] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.356] GetProcessHeap () returned 0xd20000 [0096.356] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.356] GetProcessHeap () returned 0xd20000 [0096.356] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.356] GetProcessHeap () returned 0xd20000 [0096.356] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.356] GetProcessHeap () returned 0xd20000 [0096.356] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0096.356] GetProcessHeap () returned 0xd20000 [0096.356] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0096.356] GetProcessHeap () returned 0xd20000 [0096.356] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.356] GetProcessHeap () returned 0xd20000 [0096.357] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.357] GetProcessHeap () returned 0xd20000 [0096.357] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.357] GetProcessHeap () returned 0xd20000 [0096.357] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.357] GetProcessHeap () returned 0xd20000 [0096.357] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.357] GetProcessHeap () returned 0xd20000 [0096.357] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.357] GetProcessHeap () returned 0xd20000 [0096.357] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.357] GetProcessHeap () returned 0xd20000 [0096.357] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.357] GetProcessHeap () returned 0xd20000 [0096.357] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.357] GetProcessHeap () returned 0xd20000 [0096.357] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.357] GetProcessHeap () returned 0xd20000 [0096.358] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.358] GetProcessHeap () returned 0xd20000 [0096.358] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.358] GetProcessHeap () returned 0xd20000 [0096.358] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.358] GetProcessHeap () returned 0xd20000 [0096.358] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.358] GetProcessHeap () returned 0xd20000 [0096.358] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0096.358] GetProcessHeap () returned 0xd20000 [0096.358] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0096.358] GetProcessHeap () returned 0xd20000 [0096.358] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0096.358] GetProcessHeap () returned 0xd20000 [0096.358] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0096.358] GetProcessHeap () returned 0xd20000 [0096.358] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.358] GetProcessHeap () returned 0xd20000 [0096.358] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.358] GetProcessHeap () returned 0xd20000 [0096.358] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.359] GetProcessHeap () returned 0xd20000 [0096.359] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.359] GetProcessHeap () returned 0xd20000 [0096.359] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0096.359] GetProcessHeap () returned 0xd20000 [0096.359] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0096.359] GetProcessHeap () returned 0xd20000 [0096.359] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.359] GetProcessHeap () returned 0xd20000 [0096.359] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.359] GetProcessHeap () returned 0xd20000 [0096.359] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0096.359] GetProcessHeap () returned 0xd20000 [0096.359] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0096.359] GetProcessHeap () returned 0xd20000 [0096.359] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.359] GetProcessHeap () returned 0xd20000 [0096.359] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.360] GetProcessHeap () returned 0xd20000 [0096.360] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0096.360] GetProcessHeap () returned 0xd20000 [0096.360] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0096.360] GetProcessHeap () returned 0xd20000 [0096.360] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.360] GetProcessHeap () returned 0xd20000 [0096.360] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.360] GetProcessHeap () returned 0xd20000 [0096.360] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.360] GetProcessHeap () returned 0xd20000 [0096.360] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.360] GetProcessHeap () returned 0xd20000 [0096.360] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0096.360] GetProcessHeap () returned 0xd20000 [0096.360] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0096.360] GetProcessHeap () returned 0xd20000 [0096.360] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.360] GetProcessHeap () returned 0xd20000 [0096.361] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.361] GetProcessHeap () returned 0xd20000 [0096.361] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.361] GetProcessHeap () returned 0xd20000 [0096.361] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.361] GetProcessHeap () returned 0xd20000 [0096.361] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.361] GetProcessHeap () returned 0xd20000 [0096.361] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.361] GetProcessHeap () returned 0xd20000 [0096.361] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.361] GetProcessHeap () returned 0xd20000 [0096.361] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.361] GetProcessHeap () returned 0xd20000 [0096.361] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.361] GetProcessHeap () returned 0xd20000 [0096.361] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.361] GetProcessHeap () returned 0xd20000 [0096.361] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.361] GetProcessHeap () returned 0xd20000 [0096.362] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.362] GetProcessHeap () returned 0xd20000 [0096.362] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.362] GetProcessHeap () returned 0xd20000 [0096.362] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.362] GetProcessHeap () returned 0xd20000 [0096.362] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0096.362] GetProcessHeap () returned 0xd20000 [0096.362] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0096.362] GetProcessHeap () returned 0xd20000 [0096.362] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0096.362] GetProcessHeap () returned 0xd20000 [0096.362] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0096.362] GetProcessHeap () returned 0xd20000 [0096.362] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0096.362] GetProcessHeap () returned 0xd20000 [0096.362] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0096.362] GetProcessHeap () returned 0xd20000 [0096.362] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.363] GetProcessHeap () returned 0xd20000 [0096.363] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.363] GetProcessHeap () returned 0xd20000 [0096.363] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0096.363] GetProcessHeap () returned 0xd20000 [0096.363] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0096.363] GetProcessHeap () returned 0xd20000 [0096.363] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0096.363] GetProcessHeap () returned 0xd20000 [0096.363] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0096.363] GetProcessHeap () returned 0xd20000 [0096.363] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.363] GetProcessHeap () returned 0xd20000 [0096.363] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.363] GetProcessHeap () returned 0xd20000 [0096.363] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0096.363] GetProcessHeap () returned 0xd20000 [0096.364] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0096.364] GetProcessHeap () returned 0xd20000 [0096.364] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0096.364] GetProcessHeap () returned 0xd20000 [0096.364] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0096.364] GetProcessHeap () returned 0xd20000 [0096.364] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.364] GetProcessHeap () returned 0xd20000 [0096.364] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.364] GetProcessHeap () returned 0xd20000 [0096.364] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0096.364] GetProcessHeap () returned 0xd20000 [0096.364] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0096.364] GetProcessHeap () returned 0xd20000 [0096.364] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0096.364] GetProcessHeap () returned 0xd20000 [0096.364] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0096.364] GetProcessHeap () returned 0xd20000 [0096.364] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444f8 | out: hHeap=0xd20000) returned 1 [0096.364] GetProcessHeap () returned 0xd20000 [0096.365] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b878 | out: hHeap=0xd20000) returned 1 [0096.365] GetProcessHeap () returned 0xd20000 [0096.365] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0096.365] GetProcessHeap () returned 0xd20000 [0096.365] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b128 | out: hHeap=0xd20000) returned 1 [0096.365] GetProcessHeap () returned 0xd20000 [0096.365] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0096.365] GetProcessHeap () returned 0xd20000 [0096.365] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.365] GetProcessHeap () returned 0xd20000 [0096.365] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0096.365] WriteFile (in: hFile=0x230, lpBuffer=0xd4dfa8*, nNumberOfBytesToWrite=0x385, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4dfa8*, lpNumberOfBytesWritten=0x299d864*=0x385, lpOverlapped=0x0) returned 1 [0096.372] GetProcessHeap () returned 0xd20000 [0096.372] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4dfa8, Size=0x30) returned 0xd4dfa8 [0096.372] GetProcessHeap () returned 0xd20000 [0096.372] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0096.372] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0096.372] GetProcessHeap () returned 0xd20000 [0096.372] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x411f0) returned 0xd4dfe0 [0096.404] ReadFile (in: hFile=0x230, lpBuffer=0xd4dfe0, nNumberOfBytesToRead=0x411f0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4dfe0*, lpNumberOfBytesRead=0x299d7e8*=0x411f0, lpOverlapped=0x0) returned 1 [0096.412] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0096.413] WriteFile (in: hFile=0x230, lpBuffer=0xd4dfe0*, nNumberOfBytesToWrite=0x411f0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4dfe0*, lpNumberOfBytesWritten=0x299d7e4*=0x411f0, lpOverlapped=0x0) returned 1 [0096.430] GetProcessHeap () returned 0xd20000 [0096.430] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4dfe0 | out: hHeap=0xd20000) returned 1 [0096.431] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0096.431] WriteFile (in: hFile=0x230, lpBuffer=0xd4dfa8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4dfa8*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0096.448] CloseHandle (hObject=0x230) returned 1 [0096.465] GetProcessHeap () returned 0xd20000 [0096.465] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42580 | out: hHeap=0xd20000) returned 1 [0096.465] GetProcessHeap () returned 0xd20000 [0096.465] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bda0 | out: hHeap=0xd20000) returned 1 [0096.465] GetProcessHeap () returned 0xd20000 [0096.465] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0096.465] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" [0096.465] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm.[ponce.lorena@aol.com]" [0096.465] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_uk-ua.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0096.466] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_uk-ua.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0096.467] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0096.467] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0096.467] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0096.467] GetProcessHeap () returned 0xd20000 [0096.467] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44468 | out: hHeap=0xd20000) returned 1 [0096.467] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5ed27d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5ed27d, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x1ed21, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_zh-cn.htm", cAlternateFileName="EULA_Z~1.HTM")) returned 1 [0096.467] lstrcmpiW (lpString1="EULA_zh-cn.htm", lpString2=".") returned 1 [0096.467] lstrcmpiW (lpString1="EULA_zh-cn.htm", lpString2="..") returned 1 [0096.467] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_zh-cn.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" [0096.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_zh-cn.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0096.467] GetProcessHeap () returned 0xd20000 [0096.467] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd44498 [0096.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_zh-cn.htm", cchWideChar=-1, lpMultiByteStr=0xd44498, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_zh-cn.htm", lpUsedDefaultChar=0x0) returned 15 [0096.467] lstrlenA (lpString="EULA_zh-cn.htm") returned 14 [0096.467] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0096.467] lstrlenA (lpString="EULA_zh-cn.htm") returned 14 [0096.467] lstrlenA (lpString=".dll") returned 4 [0096.468] lstrlenA (lpString=".dll") returned 4 [0096.468] lstrlenA (lpString="EULA_zh-cn.htm") returned 14 [0096.468] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0096.468] lstrlenA (lpString="EULA_zh-cn.htm") returned 14 [0096.468] lstrlenA (lpString=".ini") returned 4 [0096.468] lstrlenA (lpString=".ini") returned 4 [0096.468] lstrlenA (lpString="EULA_zh-cn.htm") returned 14 [0096.468] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0096.468] lstrlenA (lpString="EULA_zh-cn.htm") returned 14 [0096.468] lstrlenA (lpString=".inc") returned 4 [0096.468] lstrlenA (lpString=".inc") returned 4 [0096.468] lstrlenA (lpString="EULA_zh-cn.htm") returned 14 [0096.468] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0096.468] lstrcmpiW (lpString1="EULA_zh-cn.htm", lpString2="HOW_RECOVER.html") returned -1 [0096.468] lstrcmpiW (lpString1="EULA_zh-cn.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0096.468] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0096.468] lstrcmpiW (lpString1="EULA_zh-cn.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0096.468] GetProcessHeap () returned 0xd20000 [0096.468] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42620 [0096.469] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0096.470] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=126241) returned 1 [0096.470] GetProcessHeap () returned 0xd20000 [0096.470] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c160 [0096.470] GetProcessHeap () returned 0xd20000 [0096.470] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0096.470] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm") returned 52 [0096.470] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0096.470] GetProcessHeap () returned 0xd20000 [0096.470] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0096.471] GetProcessHeap () returned 0xd20000 [0096.471] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4dfe0 [0096.471] lstrlenA (lpString="rsa_encrypt") returned 11 [0096.471] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0096.473] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0096.473] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0096.473] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0096.473] GetProcessHeap () returned 0xd20000 [0096.473] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0096.473] lstrlenA (lpString="010001") returned 6 [0096.474] GetProcessHeap () returned 0xd20000 [0096.474] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0096.474] GetProcessHeap () returned 0xd20000 [0096.474] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0096.474] GetProcessHeap () returned 0xd20000 [0096.474] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b638 [0096.474] GetProcessHeap () returned 0xd20000 [0096.474] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0096.474] GetProcessHeap () returned 0xd20000 [0096.474] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aee8 [0096.474] GetProcessHeap () returned 0xd20000 [0096.474] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44b50 [0096.474] GetProcessHeap () returned 0xd20000 [0096.474] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cbe8 [0096.474] GetProcessHeap () returned 0xd20000 [0096.474] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0096.474] GetProcessHeap () returned 0xd20000 [0096.474] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0096.474] GetProcessHeap () returned 0xd20000 [0096.474] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0096.475] GetProcessHeap () returned 0xd20000 [0096.475] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0096.475] GetProcessHeap () returned 0xd20000 [0096.475] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44fb0 [0096.475] GetProcessHeap () returned 0xd20000 [0096.475] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.475] GetProcessHeap () returned 0xd20000 [0096.475] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44618 [0096.475] GetProcessHeap () returned 0xd20000 [0096.475] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b2d8 [0096.475] GetProcessHeap () returned 0xd20000 [0096.475] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0096.475] GetProcessHeap () returned 0xd20000 [0096.475] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0096.475] GetProcessHeap () returned 0xd20000 [0096.475] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b2d8 | out: hHeap=0xd20000) returned 1 [0096.475] GetProcessHeap () returned 0xd20000 [0096.475] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0096.475] GetProcessHeap () returned 0xd20000 [0096.475] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444c8 [0096.476] GetProcessHeap () returned 0xd20000 [0096.476] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.476] GetProcessHeap () returned 0xd20000 [0096.476] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0096.476] GetProcessHeap () returned 0xd20000 [0096.476] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.476] GetProcessHeap () returned 0xd20000 [0096.476] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.476] GetProcessHeap () returned 0xd20000 [0096.476] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0096.476] GetProcessHeap () returned 0xd20000 [0096.476] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0096.476] GetProcessHeap () returned 0xd20000 [0096.476] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b878 [0096.476] GetProcessHeap () returned 0xd20000 [0096.476] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444c8 | out: hHeap=0xd20000) returned 1 [0096.476] GetProcessHeap () returned 0xd20000 [0096.476] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0096.476] GetProcessHeap () returned 0xd20000 [0096.476] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b878 | out: hHeap=0xd20000) returned 1 [0096.476] GetProcessHeap () returned 0xd20000 [0096.477] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0096.477] GetProcessHeap () returned 0xd20000 [0096.477] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0096.477] GetProcessHeap () returned 0xd20000 [0096.477] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.477] GetProcessHeap () returned 0xd20000 [0096.477] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.477] GetProcessHeap () returned 0xd20000 [0096.477] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0096.477] GetProcessHeap () returned 0xd20000 [0096.477] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0096.477] GetProcessHeap () returned 0xd20000 [0096.477] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0096.477] GetProcessHeap () returned 0xd20000 [0096.477] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0096.477] GetProcessHeap () returned 0xd20000 [0096.477] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.477] GetProcessHeap () returned 0xd20000 [0096.477] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.477] GetProcessHeap () returned 0xd20000 [0096.477] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.478] GetProcessHeap () returned 0xd20000 [0096.478] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.478] GetProcessHeap () returned 0xd20000 [0096.478] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.478] GetProcessHeap () returned 0xd20000 [0096.478] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.478] GetProcessHeap () returned 0xd20000 [0096.478] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0096.478] GetProcessHeap () returned 0xd20000 [0096.478] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0096.478] GetProcessHeap () returned 0xd20000 [0096.478] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.478] GetProcessHeap () returned 0xd20000 [0096.478] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.478] GetProcessHeap () returned 0xd20000 [0096.478] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.478] GetProcessHeap () returned 0xd20000 [0096.478] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.478] GetProcessHeap () returned 0xd20000 [0096.478] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.479] GetProcessHeap () returned 0xd20000 [0096.479] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.479] GetProcessHeap () returned 0xd20000 [0096.479] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0096.479] GetProcessHeap () returned 0xd20000 [0096.479] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0096.479] GetProcessHeap () returned 0xd20000 [0096.479] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.479] GetProcessHeap () returned 0xd20000 [0096.479] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.479] GetProcessHeap () returned 0xd20000 [0096.479] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.479] GetProcessHeap () returned 0xd20000 [0096.479] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.479] GetProcessHeap () returned 0xd20000 [0096.479] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0096.479] GetProcessHeap () returned 0xd20000 [0096.479] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0096.479] GetProcessHeap () returned 0xd20000 [0096.479] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.479] GetProcessHeap () returned 0xd20000 [0096.480] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.480] GetProcessHeap () returned 0xd20000 [0096.480] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.480] GetProcessHeap () returned 0xd20000 [0096.480] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.480] GetProcessHeap () returned 0xd20000 [0096.480] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0096.480] GetProcessHeap () returned 0xd20000 [0096.480] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0096.480] GetProcessHeap () returned 0xd20000 [0096.480] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.480] GetProcessHeap () returned 0xd20000 [0096.480] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.480] GetProcessHeap () returned 0xd20000 [0096.480] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.480] GetProcessHeap () returned 0xd20000 [0096.480] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.480] GetProcessHeap () returned 0xd20000 [0096.480] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.480] GetProcessHeap () returned 0xd20000 [0096.481] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.481] GetProcessHeap () returned 0xd20000 [0096.481] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.481] GetProcessHeap () returned 0xd20000 [0096.481] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.481] GetProcessHeap () returned 0xd20000 [0096.481] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.481] GetProcessHeap () returned 0xd20000 [0096.481] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.481] GetProcessHeap () returned 0xd20000 [0096.481] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.481] GetProcessHeap () returned 0xd20000 [0096.481] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.481] GetProcessHeap () returned 0xd20000 [0096.481] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0096.481] GetProcessHeap () returned 0xd20000 [0096.481] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0096.481] GetProcessHeap () returned 0xd20000 [0096.481] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.481] GetProcessHeap () returned 0xd20000 [0096.482] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.482] GetProcessHeap () returned 0xd20000 [0096.482] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.482] GetProcessHeap () returned 0xd20000 [0096.482] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.482] GetProcessHeap () returned 0xd20000 [0096.482] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.482] GetProcessHeap () returned 0xd20000 [0096.482] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.482] GetProcessHeap () returned 0xd20000 [0096.482] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.482] GetProcessHeap () returned 0xd20000 [0096.482] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.482] GetProcessHeap () returned 0xd20000 [0096.482] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.482] GetProcessHeap () returned 0xd20000 [0096.482] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.482] GetProcessHeap () returned 0xd20000 [0096.482] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.482] GetProcessHeap () returned 0xd20000 [0096.482] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.483] GetProcessHeap () returned 0xd20000 [0096.483] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0096.483] GetProcessHeap () returned 0xd20000 [0096.483] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0096.483] GetProcessHeap () returned 0xd20000 [0096.483] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.483] GetProcessHeap () returned 0xd20000 [0096.483] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.483] GetProcessHeap () returned 0xd20000 [0096.483] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.483] GetProcessHeap () returned 0xd20000 [0096.483] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.483] GetProcessHeap () returned 0xd20000 [0096.483] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.483] GetProcessHeap () returned 0xd20000 [0096.483] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.483] GetProcessHeap () returned 0xd20000 [0096.483] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0096.483] GetProcessHeap () returned 0xd20000 [0096.483] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0096.483] GetProcessHeap () returned 0xd20000 [0096.484] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.484] GetProcessHeap () returned 0xd20000 [0096.484] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.484] GetProcessHeap () returned 0xd20000 [0096.484] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.484] GetProcessHeap () returned 0xd20000 [0096.484] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.484] GetProcessHeap () returned 0xd20000 [0096.484] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.484] GetProcessHeap () returned 0xd20000 [0096.484] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.484] GetProcessHeap () returned 0xd20000 [0096.484] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0096.484] GetProcessHeap () returned 0xd20000 [0096.484] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0096.485] GetProcessHeap () returned 0xd20000 [0096.485] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.485] GetProcessHeap () returned 0xd20000 [0096.485] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.485] GetProcessHeap () returned 0xd20000 [0096.485] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.485] GetProcessHeap () returned 0xd20000 [0096.485] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.485] GetProcessHeap () returned 0xd20000 [0096.486] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.486] GetProcessHeap () returned 0xd20000 [0096.486] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.486] GetProcessHeap () returned 0xd20000 [0096.486] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0096.486] GetProcessHeap () returned 0xd20000 [0096.486] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0096.486] GetProcessHeap () returned 0xd20000 [0096.486] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.486] GetProcessHeap () returned 0xd20000 [0096.486] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.486] GetProcessHeap () returned 0xd20000 [0096.486] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0096.486] GetProcessHeap () returned 0xd20000 [0096.486] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0096.486] GetProcessHeap () returned 0xd20000 [0096.486] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.486] GetProcessHeap () returned 0xd20000 [0096.486] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.487] GetProcessHeap () returned 0xd20000 [0096.487] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.487] GetProcessHeap () returned 0xd20000 [0096.487] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.487] GetProcessHeap () returned 0xd20000 [0096.487] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.487] GetProcessHeap () returned 0xd20000 [0096.487] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.487] GetProcessHeap () returned 0xd20000 [0096.487] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.487] GetProcessHeap () returned 0xd20000 [0096.487] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.487] GetProcessHeap () returned 0xd20000 [0096.487] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0096.487] GetProcessHeap () returned 0xd20000 [0096.487] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0096.487] GetProcessHeap () returned 0xd20000 [0096.487] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.487] GetProcessHeap () returned 0xd20000 [0096.487] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.488] GetProcessHeap () returned 0xd20000 [0096.488] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.488] GetProcessHeap () returned 0xd20000 [0096.488] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.488] GetProcessHeap () returned 0xd20000 [0096.488] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.488] GetProcessHeap () returned 0xd20000 [0096.488] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.488] GetProcessHeap () returned 0xd20000 [0096.488] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.488] GetProcessHeap () returned 0xd20000 [0096.488] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.488] GetProcessHeap () returned 0xd20000 [0096.488] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0096.488] GetProcessHeap () returned 0xd20000 [0096.488] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0096.488] GetProcessHeap () returned 0xd20000 [0096.488] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.488] GetProcessHeap () returned 0xd20000 [0096.488] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.488] GetProcessHeap () returned 0xd20000 [0096.489] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.489] GetProcessHeap () returned 0xd20000 [0096.489] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.489] GetProcessHeap () returned 0xd20000 [0096.489] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.489] GetProcessHeap () returned 0xd20000 [0096.489] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.489] GetProcessHeap () returned 0xd20000 [0096.489] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.489] GetProcessHeap () returned 0xd20000 [0096.489] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.489] GetProcessHeap () returned 0xd20000 [0096.489] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.489] GetProcessHeap () returned 0xd20000 [0096.489] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.489] GetProcessHeap () returned 0xd20000 [0096.489] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.489] GetProcessHeap () returned 0xd20000 [0096.489] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.489] GetProcessHeap () returned 0xd20000 [0096.489] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.490] GetProcessHeap () returned 0xd20000 [0096.490] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.490] GetProcessHeap () returned 0xd20000 [0096.490] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.490] GetProcessHeap () returned 0xd20000 [0096.490] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.490] GetProcessHeap () returned 0xd20000 [0096.490] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.490] GetProcessHeap () returned 0xd20000 [0096.490] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.490] GetProcessHeap () returned 0xd20000 [0096.490] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.490] GetProcessHeap () returned 0xd20000 [0096.490] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.490] GetProcessHeap () returned 0xd20000 [0096.490] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.490] GetProcessHeap () returned 0xd20000 [0096.490] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.490] GetProcessHeap () returned 0xd20000 [0096.490] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.491] GetProcessHeap () returned 0xd20000 [0096.491] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.491] GetProcessHeap () returned 0xd20000 [0096.491] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0096.491] GetProcessHeap () returned 0xd20000 [0096.491] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0096.491] GetProcessHeap () returned 0xd20000 [0096.491] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.491] GetProcessHeap () returned 0xd20000 [0096.491] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.491] GetProcessHeap () returned 0xd20000 [0096.491] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.491] GetProcessHeap () returned 0xd20000 [0096.491] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.491] GetProcessHeap () returned 0xd20000 [0096.491] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.491] GetProcessHeap () returned 0xd20000 [0096.491] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.491] GetProcessHeap () returned 0xd20000 [0096.491] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.491] GetProcessHeap () returned 0xd20000 [0096.492] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.492] GetProcessHeap () returned 0xd20000 [0096.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0096.492] GetProcessHeap () returned 0xd20000 [0096.492] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0096.492] GetProcessHeap () returned 0xd20000 [0096.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.492] GetProcessHeap () returned 0xd20000 [0096.492] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.492] GetProcessHeap () returned 0xd20000 [0096.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.492] GetProcessHeap () returned 0xd20000 [0096.492] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.492] GetProcessHeap () returned 0xd20000 [0096.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.492] GetProcessHeap () returned 0xd20000 [0096.492] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.492] GetProcessHeap () returned 0xd20000 [0096.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.492] GetProcessHeap () returned 0xd20000 [0096.493] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.493] GetProcessHeap () returned 0xd20000 [0096.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0096.493] GetProcessHeap () returned 0xd20000 [0096.493] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0096.493] GetProcessHeap () returned 0xd20000 [0096.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.493] GetProcessHeap () returned 0xd20000 [0096.493] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.493] GetProcessHeap () returned 0xd20000 [0096.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.493] GetProcessHeap () returned 0xd20000 [0096.493] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.493] GetProcessHeap () returned 0xd20000 [0096.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0096.493] GetProcessHeap () returned 0xd20000 [0096.493] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0096.493] GetProcessHeap () returned 0xd20000 [0096.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0096.493] GetProcessHeap () returned 0xd20000 [0096.493] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0096.494] GetProcessHeap () returned 0xd20000 [0096.494] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.494] GetProcessHeap () returned 0xd20000 [0096.494] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.494] GetProcessHeap () returned 0xd20000 [0096.494] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0096.494] GetProcessHeap () returned 0xd20000 [0096.494] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0096.494] GetProcessHeap () returned 0xd20000 [0096.494] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0096.494] GetProcessHeap () returned 0xd20000 [0096.494] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0096.494] GetProcessHeap () returned 0xd20000 [0096.494] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0096.494] GetProcessHeap () returned 0xd20000 [0096.494] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0096.494] GetProcessHeap () returned 0xd20000 [0096.494] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44618 | out: hHeap=0xd20000) returned 1 [0096.494] GetProcessHeap () returned 0xd20000 [0096.495] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aee8 | out: hHeap=0xd20000) returned 1 [0096.495] GetProcessHeap () returned 0xd20000 [0096.495] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0096.495] GetProcessHeap () returned 0xd20000 [0096.495] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b638 | out: hHeap=0xd20000) returned 1 [0096.495] GetProcessHeap () returned 0xd20000 [0096.495] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0096.495] GetProcessHeap () returned 0xd20000 [0096.495] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.495] GetProcessHeap () returned 0xd20000 [0096.495] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0096.495] WriteFile (in: hFile=0x230, lpBuffer=0xd4dfe0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4dfe0*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0096.506] GetProcessHeap () returned 0xd20000 [0096.506] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4dfe0, Size=0x30) returned 0xd4dfe0 [0096.506] GetProcessHeap () returned 0xd20000 [0096.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0096.506] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0096.506] GetProcessHeap () returned 0xd20000 [0096.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1ed21) returned 0xd4e018 [0096.509] ReadFile (in: hFile=0x230, lpBuffer=0xd4e018, nNumberOfBytesToRead=0x1ed21, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4e018*, lpNumberOfBytesRead=0x299d7e8*=0x1ed21, lpOverlapped=0x0) returned 1 [0096.513] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0096.513] WriteFile (in: hFile=0x230, lpBuffer=0xd4e018*, nNumberOfBytesToWrite=0x1ed21, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4e018*, lpNumberOfBytesWritten=0x299d7e4*=0x1ed21, lpOverlapped=0x0) returned 1 [0096.519] GetProcessHeap () returned 0xd20000 [0096.519] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4e018 | out: hHeap=0xd20000) returned 1 [0096.519] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0096.519] WriteFile (in: hFile=0x230, lpBuffer=0xd4dfe0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4dfe0*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0096.521] CloseHandle (hObject=0x230) returned 1 [0096.526] GetProcessHeap () returned 0xd20000 [0096.526] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42620 | out: hHeap=0xd20000) returned 1 [0096.526] GetProcessHeap () returned 0xd20000 [0096.526] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c160 | out: hHeap=0xd20000) returned 1 [0096.526] GetProcessHeap () returned 0xd20000 [0096.526] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0096.526] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" [0096.526] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm.[ponce.lorena@aol.com]" [0096.526] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-cn.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0096.527] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-cn.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0096.527] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0096.527] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0096.527] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0096.528] GetProcessHeap () returned 0xd20000 [0096.528] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44498 | out: hHeap=0xd20000) returned 1 [0096.528] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x23ec4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_zh-hk.htm", cAlternateFileName="EULA_Z~2.HTM")) returned 1 [0096.528] lstrcmpiW (lpString1="EULA_zh-hk.htm", lpString2=".") returned 1 [0096.528] lstrcmpiW (lpString1="EULA_zh-hk.htm", lpString2="..") returned 1 [0096.528] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_zh-hk.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" [0096.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_zh-hk.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0096.528] GetProcessHeap () returned 0xd20000 [0096.528] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd44588 [0096.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_zh-hk.htm", cchWideChar=-1, lpMultiByteStr=0xd44588, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_zh-hk.htm", lpUsedDefaultChar=0x0) returned 15 [0096.528] lstrlenA (lpString="EULA_zh-hk.htm") returned 14 [0096.528] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0096.528] lstrlenA (lpString="EULA_zh-hk.htm") returned 14 [0096.528] lstrlenA (lpString=".dll") returned 4 [0096.528] lstrlenA (lpString=".dll") returned 4 [0096.528] lstrlenA (lpString="EULA_zh-hk.htm") returned 14 [0096.528] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0096.529] lstrlenA (lpString="EULA_zh-hk.htm") returned 14 [0096.529] lstrlenA (lpString=".ini") returned 4 [0096.529] lstrlenA (lpString=".ini") returned 4 [0096.529] lstrlenA (lpString="EULA_zh-hk.htm") returned 14 [0096.529] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0096.529] lstrlenA (lpString="EULA_zh-hk.htm") returned 14 [0096.529] lstrlenA (lpString=".inc") returned 4 [0096.529] lstrlenA (lpString=".inc") returned 4 [0096.529] lstrlenA (lpString="EULA_zh-hk.htm") returned 14 [0096.529] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0096.529] lstrcmpiW (lpString1="EULA_zh-hk.htm", lpString2="HOW_RECOVER.html") returned -1 [0096.529] lstrcmpiW (lpString1="EULA_zh-hk.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0096.529] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0096.529] lstrcmpiW (lpString1="EULA_zh-hk.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0096.529] GetProcessHeap () returned 0xd20000 [0096.529] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd426c0 [0096.529] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0096.530] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=147140) returned 1 [0096.530] GetProcessHeap () returned 0xd20000 [0096.530] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c250 [0096.530] GetProcessHeap () returned 0xd20000 [0096.530] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0096.530] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm") returned 52 [0096.530] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0096.530] GetProcessHeap () returned 0xd20000 [0096.530] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0096.530] GetProcessHeap () returned 0xd20000 [0096.531] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4e018 [0096.531] lstrlenA (lpString="rsa_encrypt") returned 11 [0096.531] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0096.533] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0096.533] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0096.533] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0096.533] GetProcessHeap () returned 0xd20000 [0096.534] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0096.534] lstrlenA (lpString="010001") returned 6 [0096.534] GetProcessHeap () returned 0xd20000 [0096.534] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd98 [0096.534] GetProcessHeap () returned 0xd20000 [0096.534] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0096.534] GetProcessHeap () returned 0xd20000 [0096.534] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b638 [0096.534] GetProcessHeap () returned 0xd20000 [0096.534] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0096.534] GetProcessHeap () returned 0xd20000 [0096.534] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b878 [0096.534] GetProcessHeap () returned 0xd20000 [0096.534] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44fb0 [0096.534] GetProcessHeap () returned 0xd20000 [0096.534] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0096.534] GetProcessHeap () returned 0xd20000 [0096.534] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0096.534] GetProcessHeap () returned 0xd20000 [0096.535] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.535] GetProcessHeap () returned 0xd20000 [0096.535] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0096.535] GetProcessHeap () returned 0xd20000 [0096.535] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0096.535] GetProcessHeap () returned 0xd20000 [0096.535] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd451e0 [0096.535] GetProcessHeap () returned 0xd20000 [0096.535] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0096.535] GetProcessHeap () returned 0xd20000 [0096.535] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445a0 [0096.535] GetProcessHeap () returned 0xd20000 [0096.535] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b368 [0096.535] GetProcessHeap () returned 0xd20000 [0096.535] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0096.535] GetProcessHeap () returned 0xd20000 [0096.535] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0096.535] GetProcessHeap () returned 0xd20000 [0096.535] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b368 | out: hHeap=0xd20000) returned 1 [0096.535] GetProcessHeap () returned 0xd20000 [0096.536] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.536] GetProcessHeap () returned 0xd20000 [0096.536] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44468 [0096.536] GetProcessHeap () returned 0xd20000 [0096.536] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0096.536] GetProcessHeap () returned 0xd20000 [0096.536] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.536] GetProcessHeap () returned 0xd20000 [0096.536] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0096.536] GetProcessHeap () returned 0xd20000 [0096.536] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0096.536] GetProcessHeap () returned 0xd20000 [0096.536] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0096.536] GetProcessHeap () returned 0xd20000 [0096.536] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0096.536] GetProcessHeap () returned 0xd20000 [0096.536] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b518 [0096.536] GetProcessHeap () returned 0xd20000 [0096.536] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44468 | out: hHeap=0xd20000) returned 1 [0096.536] GetProcessHeap () returned 0xd20000 [0096.536] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0096.536] GetProcessHeap () returned 0xd20000 [0096.537] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0096.537] GetProcessHeap () returned 0xd20000 [0096.538] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0096.538] GetProcessHeap () returned 0xd20000 [0096.538] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0096.538] GetProcessHeap () returned 0xd20000 [0096.538] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.538] GetProcessHeap () returned 0xd20000 [0096.538] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.538] GetProcessHeap () returned 0xd20000 [0096.538] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.538] GetProcessHeap () returned 0xd20000 [0096.538] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.538] GetProcessHeap () returned 0xd20000 [0096.538] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0096.538] GetProcessHeap () returned 0xd20000 [0096.538] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0096.538] GetProcessHeap () returned 0xd20000 [0096.538] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.538] GetProcessHeap () returned 0xd20000 [0096.538] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.539] GetProcessHeap () returned 0xd20000 [0096.539] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0096.539] GetProcessHeap () returned 0xd20000 [0096.539] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0096.539] GetProcessHeap () returned 0xd20000 [0096.539] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.539] GetProcessHeap () returned 0xd20000 [0096.539] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.539] GetProcessHeap () returned 0xd20000 [0096.539] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.539] GetProcessHeap () returned 0xd20000 [0096.539] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.539] GetProcessHeap () returned 0xd20000 [0096.539] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.539] GetProcessHeap () returned 0xd20000 [0096.539] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.539] GetProcessHeap () returned 0xd20000 [0096.539] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.539] GetProcessHeap () returned 0xd20000 [0096.539] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.539] GetProcessHeap () returned 0xd20000 [0096.540] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.540] GetProcessHeap () returned 0xd20000 [0096.540] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.540] GetProcessHeap () returned 0xd20000 [0096.540] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.540] GetProcessHeap () returned 0xd20000 [0096.540] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.540] GetProcessHeap () returned 0xd20000 [0096.540] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.540] GetProcessHeap () returned 0xd20000 [0096.540] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.540] GetProcessHeap () returned 0xd20000 [0096.540] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.540] GetProcessHeap () returned 0xd20000 [0096.540] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.540] GetProcessHeap () returned 0xd20000 [0096.540] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0096.540] GetProcessHeap () returned 0xd20000 [0096.540] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0096.541] GetProcessHeap () returned 0xd20000 [0096.541] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.541] GetProcessHeap () returned 0xd20000 [0096.541] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.541] GetProcessHeap () returned 0xd20000 [0096.541] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0096.541] GetProcessHeap () returned 0xd20000 [0096.541] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0096.541] GetProcessHeap () returned 0xd20000 [0096.541] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.541] GetProcessHeap () returned 0xd20000 [0096.541] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.541] GetProcessHeap () returned 0xd20000 [0096.541] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.541] GetProcessHeap () returned 0xd20000 [0096.541] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.541] GetProcessHeap () returned 0xd20000 [0096.541] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.541] GetProcessHeap () returned 0xd20000 [0096.541] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.542] GetProcessHeap () returned 0xd20000 [0096.542] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0096.542] GetProcessHeap () returned 0xd20000 [0096.542] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0096.542] GetProcessHeap () returned 0xd20000 [0096.542] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.542] GetProcessHeap () returned 0xd20000 [0096.542] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.542] GetProcessHeap () returned 0xd20000 [0096.542] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.542] GetProcessHeap () returned 0xd20000 [0096.542] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.542] GetProcessHeap () returned 0xd20000 [0096.542] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.542] GetProcessHeap () returned 0xd20000 [0096.542] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.542] GetProcessHeap () returned 0xd20000 [0096.542] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.542] GetProcessHeap () returned 0xd20000 [0096.542] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.543] GetProcessHeap () returned 0xd20000 [0096.543] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.543] GetProcessHeap () returned 0xd20000 [0096.543] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.543] GetProcessHeap () returned 0xd20000 [0096.543] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.543] GetProcessHeap () returned 0xd20000 [0096.543] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.543] GetProcessHeap () returned 0xd20000 [0096.543] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.543] GetProcessHeap () returned 0xd20000 [0096.543] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.543] GetProcessHeap () returned 0xd20000 [0096.543] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.543] GetProcessHeap () returned 0xd20000 [0096.543] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.543] GetProcessHeap () returned 0xd20000 [0096.543] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.543] GetProcessHeap () returned 0xd20000 [0096.543] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.544] GetProcessHeap () returned 0xd20000 [0096.544] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.544] GetProcessHeap () returned 0xd20000 [0096.544] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.544] GetProcessHeap () returned 0xd20000 [0096.544] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.544] GetProcessHeap () returned 0xd20000 [0096.544] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.544] GetProcessHeap () returned 0xd20000 [0096.544] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.544] GetProcessHeap () returned 0xd20000 [0096.544] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.544] GetProcessHeap () returned 0xd20000 [0096.544] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.544] GetProcessHeap () returned 0xd20000 [0096.544] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.544] GetProcessHeap () returned 0xd20000 [0096.544] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0096.544] GetProcessHeap () returned 0xd20000 [0096.544] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0096.545] GetProcessHeap () returned 0xd20000 [0096.545] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.545] GetProcessHeap () returned 0xd20000 [0096.545] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.545] GetProcessHeap () returned 0xd20000 [0096.545] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.545] GetProcessHeap () returned 0xd20000 [0096.545] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.545] GetProcessHeap () returned 0xd20000 [0096.545] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.545] GetProcessHeap () returned 0xd20000 [0096.545] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.545] GetProcessHeap () returned 0xd20000 [0096.545] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.545] GetProcessHeap () returned 0xd20000 [0096.545] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.545] GetProcessHeap () returned 0xd20000 [0096.545] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.545] GetProcessHeap () returned 0xd20000 [0096.545] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.546] GetProcessHeap () returned 0xd20000 [0096.546] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.546] GetProcessHeap () returned 0xd20000 [0096.546] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.546] GetProcessHeap () returned 0xd20000 [0096.546] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.546] GetProcessHeap () returned 0xd20000 [0096.546] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.546] GetProcessHeap () returned 0xd20000 [0096.546] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0096.546] GetProcessHeap () returned 0xd20000 [0096.546] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0096.546] GetProcessHeap () returned 0xd20000 [0096.546] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0096.546] GetProcessHeap () returned 0xd20000 [0096.546] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0096.546] GetProcessHeap () returned 0xd20000 [0096.546] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.546] GetProcessHeap () returned 0xd20000 [0096.546] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.547] GetProcessHeap () returned 0xd20000 [0096.547] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.547] GetProcessHeap () returned 0xd20000 [0096.547] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.547] GetProcessHeap () returned 0xd20000 [0096.547] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0096.547] GetProcessHeap () returned 0xd20000 [0096.547] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0096.549] GetProcessHeap () returned 0xd20000 [0096.549] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.549] GetProcessHeap () returned 0xd20000 [0096.549] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.549] GetProcessHeap () returned 0xd20000 [0096.549] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0096.549] GetProcessHeap () returned 0xd20000 [0096.549] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0096.549] GetProcessHeap () returned 0xd20000 [0096.549] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.549] GetProcessHeap () returned 0xd20000 [0096.549] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.549] GetProcessHeap () returned 0xd20000 [0096.549] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0096.550] GetProcessHeap () returned 0xd20000 [0096.550] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0096.550] GetProcessHeap () returned 0xd20000 [0096.550] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.550] GetProcessHeap () returned 0xd20000 [0096.550] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.550] GetProcessHeap () returned 0xd20000 [0096.550] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.550] GetProcessHeap () returned 0xd20000 [0096.550] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.550] GetProcessHeap () returned 0xd20000 [0096.550] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0096.550] GetProcessHeap () returned 0xd20000 [0096.550] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0096.550] GetProcessHeap () returned 0xd20000 [0096.550] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.550] GetProcessHeap () returned 0xd20000 [0096.550] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.551] GetProcessHeap () returned 0xd20000 [0096.551] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.551] GetProcessHeap () returned 0xd20000 [0096.551] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.551] GetProcessHeap () returned 0xd20000 [0096.551] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.551] GetProcessHeap () returned 0xd20000 [0096.551] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.551] GetProcessHeap () returned 0xd20000 [0096.551] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.551] GetProcessHeap () returned 0xd20000 [0096.551] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.551] GetProcessHeap () returned 0xd20000 [0096.551] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.551] GetProcessHeap () returned 0xd20000 [0096.551] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.551] GetProcessHeap () returned 0xd20000 [0096.551] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.551] GetProcessHeap () returned 0xd20000 [0096.552] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.552] GetProcessHeap () returned 0xd20000 [0096.552] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.552] GetProcessHeap () returned 0xd20000 [0096.552] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.552] GetProcessHeap () returned 0xd20000 [0096.552] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0096.552] GetProcessHeap () returned 0xd20000 [0096.552] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0096.552] GetProcessHeap () returned 0xd20000 [0096.552] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0096.552] GetProcessHeap () returned 0xd20000 [0096.552] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0096.552] GetProcessHeap () returned 0xd20000 [0096.552] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0096.552] GetProcessHeap () returned 0xd20000 [0096.552] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0096.552] GetProcessHeap () returned 0xd20000 [0096.552] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.552] GetProcessHeap () returned 0xd20000 [0096.553] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.553] GetProcessHeap () returned 0xd20000 [0096.553] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0096.553] GetProcessHeap () returned 0xd20000 [0096.553] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0096.553] GetProcessHeap () returned 0xd20000 [0096.553] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0096.553] GetProcessHeap () returned 0xd20000 [0096.553] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0096.553] GetProcessHeap () returned 0xd20000 [0096.553] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.553] GetProcessHeap () returned 0xd20000 [0096.553] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.553] GetProcessHeap () returned 0xd20000 [0096.553] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0096.553] GetProcessHeap () returned 0xd20000 [0096.553] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0096.553] GetProcessHeap () returned 0xd20000 [0096.553] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0096.553] GetProcessHeap () returned 0xd20000 [0096.553] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0096.554] GetProcessHeap () returned 0xd20000 [0096.554] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.554] GetProcessHeap () returned 0xd20000 [0096.554] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.554] GetProcessHeap () returned 0xd20000 [0096.554] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.554] GetProcessHeap () returned 0xd20000 [0096.554] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.554] GetProcessHeap () returned 0xd20000 [0096.554] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0096.554] GetProcessHeap () returned 0xd20000 [0096.554] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0096.554] GetProcessHeap () returned 0xd20000 [0096.554] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0096.554] GetProcessHeap () returned 0xd20000 [0096.554] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0096.554] GetProcessHeap () returned 0xd20000 [0096.554] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.554] GetProcessHeap () returned 0xd20000 [0096.554] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.554] GetProcessHeap () returned 0xd20000 [0096.555] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0096.555] GetProcessHeap () returned 0xd20000 [0096.555] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0096.555] GetProcessHeap () returned 0xd20000 [0096.555] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.555] GetProcessHeap () returned 0xd20000 [0096.555] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.555] GetProcessHeap () returned 0xd20000 [0096.555] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.555] GetProcessHeap () returned 0xd20000 [0096.555] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.555] GetProcessHeap () returned 0xd20000 [0096.555] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.555] GetProcessHeap () returned 0xd20000 [0096.555] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.555] GetProcessHeap () returned 0xd20000 [0096.555] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0096.555] GetProcessHeap () returned 0xd20000 [0096.555] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0096.555] GetProcessHeap () returned 0xd20000 [0096.555] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0096.556] GetProcessHeap () returned 0xd20000 [0096.556] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0096.556] GetProcessHeap () returned 0xd20000 [0096.556] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.556] GetProcessHeap () returned 0xd20000 [0096.556] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.556] GetProcessHeap () returned 0xd20000 [0096.556] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0096.556] GetProcessHeap () returned 0xd20000 [0096.556] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0096.556] GetProcessHeap () returned 0xd20000 [0096.556] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0096.556] GetProcessHeap () returned 0xd20000 [0096.556] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0096.556] GetProcessHeap () returned 0xd20000 [0096.556] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.556] GetProcessHeap () returned 0xd20000 [0096.556] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.556] GetProcessHeap () returned 0xd20000 [0096.556] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0096.557] GetProcessHeap () returned 0xd20000 [0096.557] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0096.557] GetProcessHeap () returned 0xd20000 [0096.557] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0096.557] GetProcessHeap () returned 0xd20000 [0096.557] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0096.557] GetProcessHeap () returned 0xd20000 [0096.557] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445a0 | out: hHeap=0xd20000) returned 1 [0096.557] GetProcessHeap () returned 0xd20000 [0096.557] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b878 | out: hHeap=0xd20000) returned 1 [0096.557] GetProcessHeap () returned 0xd20000 [0096.557] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0096.557] GetProcessHeap () returned 0xd20000 [0096.557] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b638 | out: hHeap=0xd20000) returned 1 [0096.557] GetProcessHeap () returned 0xd20000 [0096.557] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0096.557] GetProcessHeap () returned 0xd20000 [0096.557] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.557] GetProcessHeap () returned 0xd20000 [0096.557] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0096.558] WriteFile (in: hFile=0x230, lpBuffer=0xd4e018*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e018*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0096.580] GetProcessHeap () returned 0xd20000 [0096.580] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4e018, Size=0x30) returned 0xd4e018 [0096.580] GetProcessHeap () returned 0xd20000 [0096.580] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0096.580] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0096.580] GetProcessHeap () returned 0xd20000 [0096.580] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x23ec4) returned 0xd4e050 [0096.581] ReadFile (in: hFile=0x230, lpBuffer=0xd4e050, nNumberOfBytesToRead=0x23ec4, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4e050*, lpNumberOfBytesRead=0x299d7e8*=0x23ec4, lpOverlapped=0x0) returned 1 [0096.585] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0096.585] WriteFile (in: hFile=0x230, lpBuffer=0xd4e050*, nNumberOfBytesToWrite=0x23ec4, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4e050*, lpNumberOfBytesWritten=0x299d7e4*=0x23ec4, lpOverlapped=0x0) returned 1 [0096.588] GetProcessHeap () returned 0xd20000 [0096.588] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4e050 | out: hHeap=0xd20000) returned 1 [0096.588] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0096.589] WriteFile (in: hFile=0x230, lpBuffer=0xd4e018*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e018*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0096.590] CloseHandle (hObject=0x230) returned 1 [0096.597] GetProcessHeap () returned 0xd20000 [0096.597] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd426c0 | out: hHeap=0xd20000) returned 1 [0096.597] GetProcessHeap () returned 0xd20000 [0096.597] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c250 | out: hHeap=0xd20000) returned 1 [0096.597] GetProcessHeap () returned 0xd20000 [0096.597] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0096.597] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" [0096.598] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm.[ponce.lorena@aol.com]" [0096.598] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-hk.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0096.598] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-hk.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0096.598] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0096.598] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0096.599] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0096.599] GetProcessHeap () returned 0xd20000 [0096.599] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44588 | out: hHeap=0xd20000) returned 1 [0096.599] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5f6eb5, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea5f6eb5, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x1939000, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x23ec4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EULA_zh-tw.htm", cAlternateFileName="EULA_Z~3.HTM")) returned 1 [0096.599] lstrcmpiW (lpString1="EULA_zh-tw.htm", lpString2=".") returned 1 [0096.599] lstrcmpiW (lpString1="EULA_zh-tw.htm", lpString2="..") returned 1 [0096.599] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="EULA_zh-tw.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" [0096.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_zh-tw.htm", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0096.599] GetProcessHeap () returned 0xd20000 [0096.599] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd44468 [0096.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EULA_zh-tw.htm", cchWideChar=-1, lpMultiByteStr=0xd44468, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EULA_zh-tw.htm", lpUsedDefaultChar=0x0) returned 15 [0096.599] lstrlenA (lpString="EULA_zh-tw.htm") returned 14 [0096.599] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0096.599] lstrlenA (lpString="EULA_zh-tw.htm") returned 14 [0096.599] lstrlenA (lpString=".dll") returned 4 [0096.599] lstrlenA (lpString=".dll") returned 4 [0096.599] lstrlenA (lpString="EULA_zh-tw.htm") returned 14 [0096.599] lstrcmpiA (lpString1=".htm", lpString2=".dll") returned 1 [0096.599] lstrlenA (lpString="EULA_zh-tw.htm") returned 14 [0096.600] lstrlenA (lpString=".ini") returned 4 [0096.600] lstrlenA (lpString=".ini") returned 4 [0096.600] lstrlenA (lpString="EULA_zh-tw.htm") returned 14 [0096.600] lstrcmpiA (lpString1=".htm", lpString2=".ini") returned -1 [0096.600] lstrlenA (lpString="EULA_zh-tw.htm") returned 14 [0096.600] lstrlenA (lpString=".inc") returned 4 [0096.600] lstrlenA (lpString=".inc") returned 4 [0096.600] lstrlenA (lpString="EULA_zh-tw.htm") returned 14 [0096.600] lstrcmpiA (lpString1=".htm", lpString2=".inc") returned -1 [0096.600] lstrcmpiW (lpString1="EULA_zh-tw.htm", lpString2="HOW_RECOVER.html") returned -1 [0096.600] lstrcmpiW (lpString1="EULA_zh-tw.htm", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0096.600] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0096.600] lstrcmpiW (lpString1="EULA_zh-tw.htm", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0096.600] GetProcessHeap () returned 0xd20000 [0096.600] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42620 [0096.600] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0096.601] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=147140) returned 1 [0096.601] GetProcessHeap () returned 0xd20000 [0096.601] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4be90 [0096.601] GetProcessHeap () returned 0xd20000 [0096.601] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0096.601] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm") returned 52 [0096.601] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0096.601] GetProcessHeap () returned 0xd20000 [0096.601] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0096.601] GetProcessHeap () returned 0xd20000 [0096.602] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4e050 [0096.602] lstrlenA (lpString="rsa_encrypt") returned 11 [0096.602] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0096.604] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0096.604] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0096.604] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0096.604] GetProcessHeap () returned 0xd20000 [0096.605] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0096.605] lstrlenA (lpString="010001") returned 6 [0096.605] GetProcessHeap () returned 0xd20000 [0096.605] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0096.605] GetProcessHeap () returned 0xd20000 [0096.605] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0096.605] GetProcessHeap () returned 0xd20000 [0096.605] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b488 [0096.605] GetProcessHeap () returned 0xd20000 [0096.605] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0096.605] GetProcessHeap () returned 0xd20000 [0096.605] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b878 [0096.605] GetProcessHeap () returned 0xd20000 [0096.605] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd452f8 [0096.606] GetProcessHeap () returned 0xd20000 [0096.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc38 [0096.606] GetProcessHeap () returned 0xd20000 [0096.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0096.606] GetProcessHeap () returned 0xd20000 [0096.606] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0096.606] GetProcessHeap () returned 0xd20000 [0096.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0096.606] GetProcessHeap () returned 0xd20000 [0096.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0096.606] GetProcessHeap () returned 0xd20000 [0096.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44c68 [0096.606] GetProcessHeap () returned 0xd20000 [0096.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.606] GetProcessHeap () returned 0xd20000 [0096.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446a8 [0096.607] GetProcessHeap () returned 0xd20000 [0096.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b1b8 [0096.607] GetProcessHeap () returned 0xd20000 [0096.607] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0096.607] GetProcessHeap () returned 0xd20000 [0096.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0096.607] GetProcessHeap () returned 0xd20000 [0096.607] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b1b8 | out: hHeap=0xd20000) returned 1 [0096.607] GetProcessHeap () returned 0xd20000 [0096.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.607] GetProcessHeap () returned 0xd20000 [0096.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44528 [0096.607] GetProcessHeap () returned 0xd20000 [0096.607] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.607] GetProcessHeap () returned 0xd20000 [0096.607] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.607] GetProcessHeap () returned 0xd20000 [0096.608] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.608] GetProcessHeap () returned 0xd20000 [0096.608] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.608] GetProcessHeap () returned 0xd20000 [0096.608] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0096.608] GetProcessHeap () returned 0xd20000 [0096.608] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0096.608] GetProcessHeap () returned 0xd20000 [0096.608] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b758 [0096.608] GetProcessHeap () returned 0xd20000 [0096.608] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44528 | out: hHeap=0xd20000) returned 1 [0096.608] GetProcessHeap () returned 0xd20000 [0096.608] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0096.608] GetProcessHeap () returned 0xd20000 [0096.608] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b758 | out: hHeap=0xd20000) returned 1 [0096.608] GetProcessHeap () returned 0xd20000 [0096.608] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0096.608] GetProcessHeap () returned 0xd20000 [0096.608] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0096.608] GetProcessHeap () returned 0xd20000 [0096.609] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.609] GetProcessHeap () returned 0xd20000 [0096.609] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.609] GetProcessHeap () returned 0xd20000 [0096.609] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.609] GetProcessHeap () returned 0xd20000 [0096.609] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.609] GetProcessHeap () returned 0xd20000 [0096.609] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0096.609] GetProcessHeap () returned 0xd20000 [0096.609] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0096.609] GetProcessHeap () returned 0xd20000 [0096.609] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.609] GetProcessHeap () returned 0xd20000 [0096.609] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.609] GetProcessHeap () returned 0xd20000 [0096.609] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.609] GetProcessHeap () returned 0xd20000 [0096.609] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.610] GetProcessHeap () returned 0xd20000 [0096.610] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.610] GetProcessHeap () returned 0xd20000 [0096.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.610] GetProcessHeap () returned 0xd20000 [0096.610] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.610] GetProcessHeap () returned 0xd20000 [0096.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.610] GetProcessHeap () returned 0xd20000 [0096.610] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.610] GetProcessHeap () returned 0xd20000 [0096.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.611] GetProcessHeap () returned 0xd20000 [0096.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.611] GetProcessHeap () returned 0xd20000 [0096.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.611] GetProcessHeap () returned 0xd20000 [0096.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0096.611] GetProcessHeap () returned 0xd20000 [0096.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0096.611] GetProcessHeap () returned 0xd20000 [0096.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.611] GetProcessHeap () returned 0xd20000 [0096.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.611] GetProcessHeap () returned 0xd20000 [0096.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.612] GetProcessHeap () returned 0xd20000 [0096.612] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.612] GetProcessHeap () returned 0xd20000 [0096.612] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.612] GetProcessHeap () returned 0xd20000 [0096.612] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.612] GetProcessHeap () returned 0xd20000 [0096.612] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.612] GetProcessHeap () returned 0xd20000 [0096.612] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.612] GetProcessHeap () returned 0xd20000 [0096.612] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.612] GetProcessHeap () returned 0xd20000 [0096.612] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.612] GetProcessHeap () returned 0xd20000 [0096.612] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.612] GetProcessHeap () returned 0xd20000 [0096.612] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.612] GetProcessHeap () returned 0xd20000 [0096.612] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0096.613] GetProcessHeap () returned 0xd20000 [0096.613] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0096.613] GetProcessHeap () returned 0xd20000 [0096.613] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.613] GetProcessHeap () returned 0xd20000 [0096.613] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.613] GetProcessHeap () returned 0xd20000 [0096.613] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.613] GetProcessHeap () returned 0xd20000 [0096.613] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.613] GetProcessHeap () returned 0xd20000 [0096.613] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.613] GetProcessHeap () returned 0xd20000 [0096.613] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.613] GetProcessHeap () returned 0xd20000 [0096.613] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0096.613] GetProcessHeap () returned 0xd20000 [0096.613] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0096.613] GetProcessHeap () returned 0xd20000 [0096.613] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.613] GetProcessHeap () returned 0xd20000 [0096.614] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.614] GetProcessHeap () returned 0xd20000 [0096.614] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.614] GetProcessHeap () returned 0xd20000 [0096.614] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.614] GetProcessHeap () returned 0xd20000 [0096.614] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.614] GetProcessHeap () returned 0xd20000 [0096.614] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.614] GetProcessHeap () returned 0xd20000 [0096.614] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0096.614] GetProcessHeap () returned 0xd20000 [0096.614] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0096.614] GetProcessHeap () returned 0xd20000 [0096.614] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.614] GetProcessHeap () returned 0xd20000 [0096.614] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.614] GetProcessHeap () returned 0xd20000 [0096.614] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.614] GetProcessHeap () returned 0xd20000 [0096.615] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.615] GetProcessHeap () returned 0xd20000 [0096.615] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.615] GetProcessHeap () returned 0xd20000 [0096.615] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.615] GetProcessHeap () returned 0xd20000 [0096.615] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0096.615] GetProcessHeap () returned 0xd20000 [0096.615] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0096.615] GetProcessHeap () returned 0xd20000 [0096.615] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.615] GetProcessHeap () returned 0xd20000 [0096.615] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.615] GetProcessHeap () returned 0xd20000 [0096.615] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0096.615] GetProcessHeap () returned 0xd20000 [0096.615] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0096.615] GetProcessHeap () returned 0xd20000 [0096.616] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.616] GetProcessHeap () returned 0xd20000 [0096.616] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.616] GetProcessHeap () returned 0xd20000 [0096.616] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.616] GetProcessHeap () returned 0xd20000 [0096.616] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.616] GetProcessHeap () returned 0xd20000 [0096.616] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.616] GetProcessHeap () returned 0xd20000 [0096.616] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.616] GetProcessHeap () returned 0xd20000 [0096.616] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.616] GetProcessHeap () returned 0xd20000 [0096.616] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.616] GetProcessHeap () returned 0xd20000 [0096.616] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0096.616] GetProcessHeap () returned 0xd20000 [0096.616] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0096.617] GetProcessHeap () returned 0xd20000 [0096.617] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.617] GetProcessHeap () returned 0xd20000 [0096.617] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.617] GetProcessHeap () returned 0xd20000 [0096.617] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.617] GetProcessHeap () returned 0xd20000 [0096.617] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.617] GetProcessHeap () returned 0xd20000 [0096.617] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.617] GetProcessHeap () returned 0xd20000 [0096.617] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.617] GetProcessHeap () returned 0xd20000 [0096.617] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.617] GetProcessHeap () returned 0xd20000 [0096.617] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.617] GetProcessHeap () returned 0xd20000 [0096.617] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0096.617] GetProcessHeap () returned 0xd20000 [0096.617] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0096.617] GetProcessHeap () returned 0xd20000 [0096.618] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.618] GetProcessHeap () returned 0xd20000 [0096.618] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.618] GetProcessHeap () returned 0xd20000 [0096.618] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.618] GetProcessHeap () returned 0xd20000 [0096.618] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.618] GetProcessHeap () returned 0xd20000 [0096.618] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.618] GetProcessHeap () returned 0xd20000 [0096.618] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.618] GetProcessHeap () returned 0xd20000 [0096.618] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.618] GetProcessHeap () returned 0xd20000 [0096.618] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.618] GetProcessHeap () returned 0xd20000 [0096.618] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.618] GetProcessHeap () returned 0xd20000 [0096.619] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.619] GetProcessHeap () returned 0xd20000 [0096.619] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.619] GetProcessHeap () returned 0xd20000 [0096.619] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.619] GetProcessHeap () returned 0xd20000 [0096.619] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.619] GetProcessHeap () returned 0xd20000 [0096.619] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.619] GetProcessHeap () returned 0xd20000 [0096.619] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.619] GetProcessHeap () returned 0xd20000 [0096.619] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.619] GetProcessHeap () returned 0xd20000 [0096.619] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.619] GetProcessHeap () returned 0xd20000 [0096.619] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.619] GetProcessHeap () returned 0xd20000 [0096.619] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.620] GetProcessHeap () returned 0xd20000 [0096.620] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.620] GetProcessHeap () returned 0xd20000 [0096.620] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.620] GetProcessHeap () returned 0xd20000 [0096.620] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.620] GetProcessHeap () returned 0xd20000 [0096.620] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.620] GetProcessHeap () returned 0xd20000 [0096.620] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.620] GetProcessHeap () returned 0xd20000 [0096.620] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0096.620] GetProcessHeap () returned 0xd20000 [0096.620] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0096.620] GetProcessHeap () returned 0xd20000 [0096.620] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.620] GetProcessHeap () returned 0xd20000 [0096.620] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.620] GetProcessHeap () returned 0xd20000 [0096.620] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.620] GetProcessHeap () returned 0xd20000 [0096.621] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.621] GetProcessHeap () returned 0xd20000 [0096.621] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.621] GetProcessHeap () returned 0xd20000 [0096.621] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.621] GetProcessHeap () returned 0xd20000 [0096.621] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.621] GetProcessHeap () returned 0xd20000 [0096.621] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.621] GetProcessHeap () returned 0xd20000 [0096.621] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0096.621] GetProcessHeap () returned 0xd20000 [0096.621] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0096.621] GetProcessHeap () returned 0xd20000 [0096.621] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.621] GetProcessHeap () returned 0xd20000 [0096.621] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.621] GetProcessHeap () returned 0xd20000 [0096.621] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.621] GetProcessHeap () returned 0xd20000 [0096.622] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.622] GetProcessHeap () returned 0xd20000 [0096.622] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.622] GetProcessHeap () returned 0xd20000 [0096.622] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.622] GetProcessHeap () returned 0xd20000 [0096.622] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.622] GetProcessHeap () returned 0xd20000 [0096.622] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.622] GetProcessHeap () returned 0xd20000 [0096.622] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0096.622] GetProcessHeap () returned 0xd20000 [0096.622] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0096.622] GetProcessHeap () returned 0xd20000 [0096.622] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.622] GetProcessHeap () returned 0xd20000 [0096.622] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.622] GetProcessHeap () returned 0xd20000 [0096.622] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.622] GetProcessHeap () returned 0xd20000 [0096.623] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.623] GetProcessHeap () returned 0xd20000 [0096.623] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0096.623] GetProcessHeap () returned 0xd20000 [0096.623] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0096.623] GetProcessHeap () returned 0xd20000 [0096.623] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0096.623] GetProcessHeap () returned 0xd20000 [0096.623] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0096.623] GetProcessHeap () returned 0xd20000 [0096.623] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.623] GetProcessHeap () returned 0xd20000 [0096.623] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.623] GetProcessHeap () returned 0xd20000 [0096.623] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0096.623] GetProcessHeap () returned 0xd20000 [0096.623] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0096.623] GetProcessHeap () returned 0xd20000 [0096.623] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.623] GetProcessHeap () returned 0xd20000 [0096.623] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.624] GetProcessHeap () returned 0xd20000 [0096.624] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.624] GetProcessHeap () returned 0xd20000 [0096.624] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.624] GetProcessHeap () returned 0xd20000 [0096.624] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.624] GetProcessHeap () returned 0xd20000 [0096.624] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.624] GetProcessHeap () returned 0xd20000 [0096.624] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.624] GetProcessHeap () returned 0xd20000 [0096.624] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.624] GetProcessHeap () returned 0xd20000 [0096.624] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.624] GetProcessHeap () returned 0xd20000 [0096.624] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.624] GetProcessHeap () returned 0xd20000 [0096.624] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.624] GetProcessHeap () returned 0xd20000 [0096.624] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.625] GetProcessHeap () returned 0xd20000 [0096.625] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0096.625] GetProcessHeap () returned 0xd20000 [0096.625] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0096.625] GetProcessHeap () returned 0xd20000 [0096.625] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0096.625] GetProcessHeap () returned 0xd20000 [0096.625] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0096.625] GetProcessHeap () returned 0xd20000 [0096.625] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.625] GetProcessHeap () returned 0xd20000 [0096.625] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.625] GetProcessHeap () returned 0xd20000 [0096.625] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0096.625] GetProcessHeap () returned 0xd20000 [0096.625] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0096.626] GetProcessHeap () returned 0xd20000 [0096.626] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0096.626] GetProcessHeap () returned 0xd20000 [0096.626] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0096.626] GetProcessHeap () returned 0xd20000 [0096.626] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.626] GetProcessHeap () returned 0xd20000 [0096.626] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.626] GetProcessHeap () returned 0xd20000 [0096.626] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.626] GetProcessHeap () returned 0xd20000 [0096.626] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.626] GetProcessHeap () returned 0xd20000 [0096.626] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0096.626] GetProcessHeap () returned 0xd20000 [0096.626] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0096.626] GetProcessHeap () returned 0xd20000 [0096.626] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0096.626] GetProcessHeap () returned 0xd20000 [0096.626] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0096.626] GetProcessHeap () returned 0xd20000 [0096.627] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0096.627] GetProcessHeap () returned 0xd20000 [0096.627] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0096.627] GetProcessHeap () returned 0xd20000 [0096.627] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446a8 | out: hHeap=0xd20000) returned 1 [0096.627] GetProcessHeap () returned 0xd20000 [0096.627] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b878 | out: hHeap=0xd20000) returned 1 [0096.627] GetProcessHeap () returned 0xd20000 [0096.627] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0096.627] GetProcessHeap () returned 0xd20000 [0096.627] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b488 | out: hHeap=0xd20000) returned 1 [0096.627] GetProcessHeap () returned 0xd20000 [0096.627] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0096.627] GetProcessHeap () returned 0xd20000 [0096.627] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.627] GetProcessHeap () returned 0xd20000 [0096.627] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0096.627] WriteFile (in: hFile=0x230, lpBuffer=0xd4e050*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e050*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0096.637] GetProcessHeap () returned 0xd20000 [0096.637] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4e050, Size=0x30) returned 0xd4e050 [0096.637] GetProcessHeap () returned 0xd20000 [0096.637] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0096.637] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0096.637] GetProcessHeap () returned 0xd20000 [0096.637] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x23ec4) returned 0xd4e088 [0096.640] ReadFile (in: hFile=0x230, lpBuffer=0xd4e088, nNumberOfBytesToRead=0x23ec4, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4e088*, lpNumberOfBytesRead=0x299d7e8*=0x23ec4, lpOverlapped=0x0) returned 1 [0096.887] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0096.887] WriteFile (in: hFile=0x230, lpBuffer=0xd4e088*, nNumberOfBytesToWrite=0x23ec4, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4e088*, lpNumberOfBytesWritten=0x299d7e4*=0x23ec4, lpOverlapped=0x0) returned 1 [0096.894] GetProcessHeap () returned 0xd20000 [0096.894] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4e088 | out: hHeap=0xd20000) returned 1 [0096.894] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0096.895] WriteFile (in: hFile=0x230, lpBuffer=0xd4e050*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e050*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0096.904] CloseHandle (hObject=0x230) returned 1 [0096.915] GetProcessHeap () returned 0xd20000 [0096.916] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42620 | out: hHeap=0xd20000) returned 1 [0096.916] GetProcessHeap () returned 0xd20000 [0096.916] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4be90 | out: hHeap=0xd20000) returned 1 [0096.916] GetProcessHeap () returned 0xd20000 [0096.916] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0096.916] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" [0096.916] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm.[ponce.lorena@aol.com]" [0096.916] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm"), lpNewFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\eula_zh-tw.htm.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0096.917] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\EULA_zh-tw.htm" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA") returned 1 [0096.917] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA" | out: pszPath="C:\\Windows10Upgrade\\resources\\ux\\EULA\\") returned="" [0096.917] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0096.917] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\ux\\eula\\how_recover.html")) returned 0x20 [0096.917] GetProcessHeap () returned 0xd20000 [0096.917] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44468 | out: hHeap=0xd20000) returned 1 [0096.918] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x831b9cff, ftCreationTime.dwHighDateTime=0x1d5c395, ftLastAccessTime.dwLowDateTime=0x831b9cff, ftLastAccessTime.dwHighDateTime=0x1d5c395, ftLastWriteTime.dwLowDateTime=0x83337528, ftLastWriteTime.dwHighDateTime=0x1d5c395, nFileSizeHigh=0x0, nFileSizeLow=0xb00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW_RECOVER.html", cAlternateFileName="HOW_RE~1.HTM")) returned 1 [0096.918] lstrcmpiW (lpString1="HOW_RECOVER.html", lpString2=".") returned 1 [0096.918] lstrcmpiW (lpString1="HOW_RECOVER.html", lpString2="..") returned 1 [0096.918] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\ux\\EULA\\HOW_RECOVER.html" [0096.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOW_RECOVER.html", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0096.918] GetProcessHeap () returned 0xd20000 [0096.918] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x11) returned 0xd36568 [0096.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HOW_RECOVER.html", cchWideChar=-1, lpMultiByteStr=0xd36568, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HOW_RECOVER.html", lpUsedDefaultChar=0x0) returned 17 [0096.918] lstrlenA (lpString="HOW_RECOVER.html") returned 16 [0096.918] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0096.918] lstrlenA (lpString="HOW_RECOVER.html") returned 16 [0096.918] lstrlenA (lpString=".dll") returned 4 [0096.918] lstrlenA (lpString=".dll") returned 4 [0096.919] lstrlenA (lpString="HOW_RECOVER.html") returned 16 [0096.919] lstrcmpiA (lpString1="html", lpString2=".dll") returned 1 [0096.919] lstrlenA (lpString="HOW_RECOVER.html") returned 16 [0096.919] lstrlenA (lpString=".ini") returned 4 [0096.919] lstrlenA (lpString=".ini") returned 4 [0096.919] lstrlenA (lpString="HOW_RECOVER.html") returned 16 [0096.919] lstrcmpiA (lpString1="html", lpString2=".ini") returned 1 [0096.919] lstrlenA (lpString="HOW_RECOVER.html") returned 16 [0096.919] lstrlenA (lpString=".inc") returned 4 [0096.919] lstrlenA (lpString=".inc") returned 4 [0096.919] lstrlenA (lpString="HOW_RECOVER.html") returned 16 [0096.919] lstrcmpiA (lpString1="html", lpString2=".inc") returned 1 [0096.919] lstrcmpiW (lpString1="HOW_RECOVER.html", lpString2="HOW_RECOVER.html") returned 0 [0096.919] GetProcessHeap () returned 0xd20000 [0096.919] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36568 | out: hHeap=0xd20000) returned 1 [0096.920] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x831b9cff, ftCreationTime.dwHighDateTime=0x1d5c395, ftLastAccessTime.dwLowDateTime=0x831b9cff, ftLastAccessTime.dwHighDateTime=0x1d5c395, ftLastWriteTime.dwLowDateTime=0x83337528, ftLastWriteTime.dwHighDateTime=0x1d5c395, nFileSizeHigh=0x0, nFileSizeLow=0xb00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="HOW_RECOVER.html", cAlternateFileName="HOW_RE~1.HTM")) returned 0 [0096.920] FindClose (in: hFindFile=0xd48e60 | out: hFindFile=0xd48e60) returned 1 [0096.920] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Windows10Upgrade\\resources\\i386\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\") returned="C:\\Windows10Upgrade\\resources\\i386\\" [0096.920] GetProcessHeap () returned 0xd20000 [0096.920] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43ec8 | out: hHeap=0xd20000) returned 1 [0096.920] GetProcessHeap () returned 0xd20000 [0096.920] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0096.920] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\i386\\") returned 35 [0096.920] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\*") returned="C:\\Windows10Upgrade\\resources\\i386\\*" [0096.920] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\i386\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3a9fd3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b1515, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b2895, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd48f20 [0096.926] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0096.926] FindNextFileW (in: hFindFile=0xd48f20, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3a9fd3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b1515, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3b2895, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.927] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0096.927] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0096.927] FindNextFileW (in: hFindFile=0xd48f20, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ab347, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ab347, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x16600, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BiosBlocks.xml", cAlternateFileName="BIOSBL~1.XML")) returned 1 [0096.927] lstrcmpiW (lpString1="BiosBlocks.xml", lpString2=".") returned 1 [0096.927] lstrcmpiW (lpString1="BiosBlocks.xml", lpString2="..") returned 1 [0096.927] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="BiosBlocks.xml" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml") returned="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" [0096.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BiosBlocks.xml", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0096.927] GetProcessHeap () returned 0xd20000 [0096.927] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd44588 [0096.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BiosBlocks.xml", cchWideChar=-1, lpMultiByteStr=0xd44588, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BiosBlocks.xml", lpUsedDefaultChar=0x0) returned 15 [0096.927] lstrlenA (lpString="BiosBlocks.xml") returned 14 [0096.927] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0096.927] lstrlenA (lpString="BiosBlocks.xml") returned 14 [0096.927] lstrlenA (lpString=".dll") returned 4 [0096.927] lstrlenA (lpString=".dll") returned 4 [0096.927] lstrlenA (lpString="BiosBlocks.xml") returned 14 [0096.927] lstrcmpiA (lpString1=".xml", lpString2=".dll") returned 1 [0096.927] lstrlenA (lpString="BiosBlocks.xml") returned 14 [0096.927] lstrlenA (lpString=".ini") returned 4 [0096.928] lstrlenA (lpString=".ini") returned 4 [0096.928] lstrlenA (lpString="BiosBlocks.xml") returned 14 [0096.928] lstrcmpiA (lpString1=".xml", lpString2=".ini") returned 1 [0096.928] lstrlenA (lpString="BiosBlocks.xml") returned 14 [0096.928] lstrlenA (lpString=".inc") returned 4 [0096.928] lstrlenA (lpString=".inc") returned 4 [0096.928] lstrlenA (lpString="BiosBlocks.xml") returned 14 [0096.928] lstrcmpiA (lpString1=".xml", lpString2=".inc") returned 1 [0096.928] lstrcmpiW (lpString1="BiosBlocks.xml", lpString2="HOW_RECOVER.html") returned -1 [0096.928] lstrcmpiW (lpString1="BiosBlocks.xml", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0096.928] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0096.928] lstrcmpiW (lpString1="BiosBlocks.xml", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0096.928] GetProcessHeap () returned 0xd20000 [0096.928] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd428c8 [0096.928] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0096.930] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=91648) returned 1 [0096.930] GetProcessHeap () returned 0xd20000 [0096.930] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c250 [0096.930] GetProcessHeap () returned 0xd20000 [0096.930] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0096.930] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml") returned 49 [0096.930] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0096.930] GetProcessHeap () returned 0xd20000 [0096.930] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0096.930] GetProcessHeap () returned 0xd20000 [0096.930] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4e088 [0096.930] lstrlenA (lpString="rsa_encrypt") returned 11 [0096.931] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0096.933] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0096.933] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0096.933] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0096.933] GetProcessHeap () returned 0xd20000 [0096.933] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0096.933] lstrlenA (lpString="010001") returned 6 [0096.933] GetProcessHeap () returned 0xd20000 [0096.933] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd88 [0096.933] GetProcessHeap () returned 0xd20000 [0096.933] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0096.934] GetProcessHeap () returned 0xd20000 [0096.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4a9d8 [0096.934] GetProcessHeap () returned 0xd20000 [0096.934] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0096.934] GetProcessHeap () returned 0xd20000 [0096.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0096.934] GetProcessHeap () returned 0xd20000 [0096.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45640 [0096.934] GetProcessHeap () returned 0xd20000 [0096.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc48 [0096.934] GetProcessHeap () returned 0xd20000 [0096.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0096.934] GetProcessHeap () returned 0xd20000 [0096.934] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0096.934] GetProcessHeap () returned 0xd20000 [0096.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0096.934] GetProcessHeap () returned 0xd20000 [0096.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0096.934] GetProcessHeap () returned 0xd20000 [0096.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd450c8 [0096.934] GetProcessHeap () returned 0xd20000 [0096.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.935] GetProcessHeap () returned 0xd20000 [0096.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445d0 [0096.935] GetProcessHeap () returned 0xd20000 [0096.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b368 [0096.935] GetProcessHeap () returned 0xd20000 [0096.935] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0096.935] GetProcessHeap () returned 0xd20000 [0096.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0096.935] GetProcessHeap () returned 0xd20000 [0096.935] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b368 | out: hHeap=0xd20000) returned 1 [0096.935] GetProcessHeap () returned 0xd20000 [0096.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.935] GetProcessHeap () returned 0xd20000 [0096.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44660 [0096.935] GetProcessHeap () returned 0xd20000 [0096.935] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.935] GetProcessHeap () returned 0xd20000 [0096.935] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.935] GetProcessHeap () returned 0xd20000 [0096.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.935] GetProcessHeap () returned 0xd20000 [0096.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.936] GetProcessHeap () returned 0xd20000 [0096.936] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0096.936] GetProcessHeap () returned 0xd20000 [0096.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0096.936] GetProcessHeap () returned 0xd20000 [0096.936] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4adc8 [0096.936] GetProcessHeap () returned 0xd20000 [0096.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44660 | out: hHeap=0xd20000) returned 1 [0096.936] GetProcessHeap () returned 0xd20000 [0096.936] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0096.936] GetProcessHeap () returned 0xd20000 [0096.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4adc8 | out: hHeap=0xd20000) returned 1 [0096.936] GetProcessHeap () returned 0xd20000 [0096.936] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.936] GetProcessHeap () returned 0xd20000 [0096.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.936] GetProcessHeap () returned 0xd20000 [0096.936] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.936] GetProcessHeap () returned 0xd20000 [0096.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.936] GetProcessHeap () returned 0xd20000 [0096.937] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.937] GetProcessHeap () returned 0xd20000 [0096.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.937] GetProcessHeap () returned 0xd20000 [0096.937] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0096.937] GetProcessHeap () returned 0xd20000 [0096.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0096.937] GetProcessHeap () returned 0xd20000 [0096.937] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.937] GetProcessHeap () returned 0xd20000 [0096.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.937] GetProcessHeap () returned 0xd20000 [0096.937] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.937] GetProcessHeap () returned 0xd20000 [0096.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.937] GetProcessHeap () returned 0xd20000 [0096.937] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.937] GetProcessHeap () returned 0xd20000 [0096.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.937] GetProcessHeap () returned 0xd20000 [0096.937] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.938] GetProcessHeap () returned 0xd20000 [0096.938] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.938] GetProcessHeap () returned 0xd20000 [0096.938] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.938] GetProcessHeap () returned 0xd20000 [0096.938] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.938] GetProcessHeap () returned 0xd20000 [0096.938] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.938] GetProcessHeap () returned 0xd20000 [0096.938] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.938] GetProcessHeap () returned 0xd20000 [0096.939] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.939] GetProcessHeap () returned 0xd20000 [0096.939] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.939] GetProcessHeap () returned 0xd20000 [0096.939] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.939] GetProcessHeap () returned 0xd20000 [0096.939] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.939] GetProcessHeap () returned 0xd20000 [0096.939] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.939] GetProcessHeap () returned 0xd20000 [0096.939] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.939] GetProcessHeap () returned 0xd20000 [0096.939] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.939] GetProcessHeap () returned 0xd20000 [0096.939] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.939] GetProcessHeap () returned 0xd20000 [0096.939] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.939] GetProcessHeap () returned 0xd20000 [0096.939] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.939] GetProcessHeap () returned 0xd20000 [0096.939] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.939] GetProcessHeap () returned 0xd20000 [0096.940] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.940] GetProcessHeap () returned 0xd20000 [0096.940] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.940] GetProcessHeap () returned 0xd20000 [0096.940] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.940] GetProcessHeap () returned 0xd20000 [0096.940] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0096.940] GetProcessHeap () returned 0xd20000 [0096.940] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0096.940] GetProcessHeap () returned 0xd20000 [0096.940] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.940] GetProcessHeap () returned 0xd20000 [0096.940] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.940] GetProcessHeap () returned 0xd20000 [0096.940] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.940] GetProcessHeap () returned 0xd20000 [0096.940] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.940] GetProcessHeap () returned 0xd20000 [0096.940] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.940] GetProcessHeap () returned 0xd20000 [0096.940] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.940] GetProcessHeap () returned 0xd20000 [0096.941] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.941] GetProcessHeap () returned 0xd20000 [0096.941] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.941] GetProcessHeap () returned 0xd20000 [0096.941] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.941] GetProcessHeap () returned 0xd20000 [0096.941] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.941] GetProcessHeap () returned 0xd20000 [0096.941] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.941] GetProcessHeap () returned 0xd20000 [0096.941] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.941] GetProcessHeap () returned 0xd20000 [0096.941] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.941] GetProcessHeap () returned 0xd20000 [0096.941] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.941] GetProcessHeap () returned 0xd20000 [0096.941] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0096.941] GetProcessHeap () returned 0xd20000 [0096.941] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0096.941] GetProcessHeap () returned 0xd20000 [0096.941] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0096.942] GetProcessHeap () returned 0xd20000 [0096.942] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0096.942] GetProcessHeap () returned 0xd20000 [0096.942] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.942] GetProcessHeap () returned 0xd20000 [0096.942] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.942] GetProcessHeap () returned 0xd20000 [0096.942] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.942] GetProcessHeap () returned 0xd20000 [0096.942] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.942] GetProcessHeap () returned 0xd20000 [0096.942] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0096.942] GetProcessHeap () returned 0xd20000 [0096.942] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0096.942] GetProcessHeap () returned 0xd20000 [0096.942] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.942] GetProcessHeap () returned 0xd20000 [0096.942] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.942] GetProcessHeap () returned 0xd20000 [0096.942] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0096.943] GetProcessHeap () returned 0xd20000 [0096.943] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0096.943] GetProcessHeap () returned 0xd20000 [0096.943] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.943] GetProcessHeap () returned 0xd20000 [0096.943] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.943] GetProcessHeap () returned 0xd20000 [0096.943] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0096.943] GetProcessHeap () returned 0xd20000 [0096.943] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0096.943] GetProcessHeap () returned 0xd20000 [0096.943] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.943] GetProcessHeap () returned 0xd20000 [0096.943] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.943] GetProcessHeap () returned 0xd20000 [0096.943] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.943] GetProcessHeap () returned 0xd20000 [0096.943] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.943] GetProcessHeap () returned 0xd20000 [0096.943] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0096.943] GetProcessHeap () returned 0xd20000 [0096.943] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0096.944] GetProcessHeap () returned 0xd20000 [0096.944] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.944] GetProcessHeap () returned 0xd20000 [0096.944] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.944] GetProcessHeap () returned 0xd20000 [0096.944] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.944] GetProcessHeap () returned 0xd20000 [0096.944] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.944] GetProcessHeap () returned 0xd20000 [0096.944] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.944] GetProcessHeap () returned 0xd20000 [0096.944] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.944] GetProcessHeap () returned 0xd20000 [0096.944] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.944] GetProcessHeap () returned 0xd20000 [0096.944] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.944] GetProcessHeap () returned 0xd20000 [0096.944] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.944] GetProcessHeap () returned 0xd20000 [0096.944] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.944] GetProcessHeap () returned 0xd20000 [0096.945] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.945] GetProcessHeap () returned 0xd20000 [0096.945] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.945] GetProcessHeap () returned 0xd20000 [0096.945] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.945] GetProcessHeap () returned 0xd20000 [0096.945] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.945] GetProcessHeap () returned 0xd20000 [0096.945] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0096.945] GetProcessHeap () returned 0xd20000 [0096.945] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0096.945] GetProcessHeap () returned 0xd20000 [0096.945] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0096.945] GetProcessHeap () returned 0xd20000 [0096.945] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0096.945] GetProcessHeap () returned 0xd20000 [0096.945] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0096.945] GetProcessHeap () returned 0xd20000 [0096.945] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0096.945] GetProcessHeap () returned 0xd20000 [0096.945] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.945] GetProcessHeap () returned 0xd20000 [0096.946] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.946] GetProcessHeap () returned 0xd20000 [0096.946] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0096.946] GetProcessHeap () returned 0xd20000 [0096.946] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0096.946] GetProcessHeap () returned 0xd20000 [0096.946] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0096.946] GetProcessHeap () returned 0xd20000 [0096.946] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0096.946] GetProcessHeap () returned 0xd20000 [0096.946] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.946] GetProcessHeap () returned 0xd20000 [0096.946] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.946] GetProcessHeap () returned 0xd20000 [0096.946] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0096.946] GetProcessHeap () returned 0xd20000 [0096.946] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0096.946] GetProcessHeap () returned 0xd20000 [0096.946] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0096.946] GetProcessHeap () returned 0xd20000 [0096.946] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0096.947] GetProcessHeap () returned 0xd20000 [0096.947] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.947] GetProcessHeap () returned 0xd20000 [0096.947] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.947] GetProcessHeap () returned 0xd20000 [0096.947] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.947] GetProcessHeap () returned 0xd20000 [0096.947] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.947] GetProcessHeap () returned 0xd20000 [0096.947] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0096.947] GetProcessHeap () returned 0xd20000 [0096.947] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0096.947] GetProcessHeap () returned 0xd20000 [0096.947] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0096.947] GetProcessHeap () returned 0xd20000 [0096.947] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0096.947] GetProcessHeap () returned 0xd20000 [0096.947] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.947] GetProcessHeap () returned 0xd20000 [0096.947] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.947] GetProcessHeap () returned 0xd20000 [0096.948] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0096.948] GetProcessHeap () returned 0xd20000 [0096.948] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0096.948] GetProcessHeap () returned 0xd20000 [0096.948] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.948] GetProcessHeap () returned 0xd20000 [0096.948] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.948] GetProcessHeap () returned 0xd20000 [0096.948] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.948] GetProcessHeap () returned 0xd20000 [0096.948] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.948] GetProcessHeap () returned 0xd20000 [0096.948] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.948] GetProcessHeap () returned 0xd20000 [0096.948] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.948] GetProcessHeap () returned 0xd20000 [0096.948] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0096.948] GetProcessHeap () returned 0xd20000 [0096.948] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0096.948] GetProcessHeap () returned 0xd20000 [0096.948] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0096.949] GetProcessHeap () returned 0xd20000 [0096.949] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0096.949] GetProcessHeap () returned 0xd20000 [0096.949] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.949] GetProcessHeap () returned 0xd20000 [0096.949] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.949] GetProcessHeap () returned 0xd20000 [0096.949] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0096.949] GetProcessHeap () returned 0xd20000 [0096.949] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0096.949] GetProcessHeap () returned 0xd20000 [0096.949] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0096.949] GetProcessHeap () returned 0xd20000 [0096.949] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0096.949] GetProcessHeap () returned 0xd20000 [0096.949] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.949] GetProcessHeap () returned 0xd20000 [0096.949] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.949] GetProcessHeap () returned 0xd20000 [0096.949] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0096.949] GetProcessHeap () returned 0xd20000 [0096.949] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0096.949] GetProcessHeap () returned 0xd20000 [0096.950] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0096.950] GetProcessHeap () returned 0xd20000 [0096.950] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0096.950] GetProcessHeap () returned 0xd20000 [0096.950] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0096.950] GetProcessHeap () returned 0xd20000 [0096.950] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0096.950] GetProcessHeap () returned 0xd20000 [0096.950] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.950] GetProcessHeap () returned 0xd20000 [0096.950] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.950] GetProcessHeap () returned 0xd20000 [0096.950] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.950] GetProcessHeap () returned 0xd20000 [0096.950] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.950] GetProcessHeap () returned 0xd20000 [0096.950] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.950] GetProcessHeap () returned 0xd20000 [0096.950] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.950] GetProcessHeap () returned 0xd20000 [0096.950] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.950] GetProcessHeap () returned 0xd20000 [0096.951] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.951] GetProcessHeap () returned 0xd20000 [0096.951] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.951] GetProcessHeap () returned 0xd20000 [0096.951] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.951] GetProcessHeap () returned 0xd20000 [0096.951] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0096.951] GetProcessHeap () returned 0xd20000 [0096.951] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0096.951] GetProcessHeap () returned 0xd20000 [0096.951] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.951] GetProcessHeap () returned 0xd20000 [0096.951] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.951] GetProcessHeap () returned 0xd20000 [0096.951] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0096.951] GetProcessHeap () returned 0xd20000 [0096.951] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0096.951] GetProcessHeap () returned 0xd20000 [0096.951] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.951] GetProcessHeap () returned 0xd20000 [0096.952] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.952] GetProcessHeap () returned 0xd20000 [0096.952] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0096.952] GetProcessHeap () returned 0xd20000 [0096.952] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0096.952] GetProcessHeap () returned 0xd20000 [0096.952] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0096.952] GetProcessHeap () returned 0xd20000 [0096.952] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0096.952] GetProcessHeap () returned 0xd20000 [0096.952] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0096.952] GetProcessHeap () returned 0xd20000 [0096.952] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0096.952] GetProcessHeap () returned 0xd20000 [0096.952] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0096.952] GetProcessHeap () returned 0xd20000 [0096.952] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0096.952] GetProcessHeap () returned 0xd20000 [0096.952] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0096.952] GetProcessHeap () returned 0xd20000 [0096.952] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0096.952] GetProcessHeap () returned 0xd20000 [0096.953] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0096.953] GetProcessHeap () returned 0xd20000 [0096.953] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0096.953] GetProcessHeap () returned 0xd20000 [0096.953] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0096.953] GetProcessHeap () returned 0xd20000 [0096.953] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0096.953] GetProcessHeap () returned 0xd20000 [0096.953] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445d0 | out: hHeap=0xd20000) returned 1 [0096.953] GetProcessHeap () returned 0xd20000 [0096.953] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0096.953] GetProcessHeap () returned 0xd20000 [0096.953] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0096.953] GetProcessHeap () returned 0xd20000 [0096.953] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a9d8 | out: hHeap=0xd20000) returned 1 [0096.953] GetProcessHeap () returned 0xd20000 [0096.953] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0096.953] GetProcessHeap () returned 0xd20000 [0096.953] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0096.953] GetProcessHeap () returned 0xd20000 [0096.954] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0096.954] WriteFile (in: hFile=0x230, lpBuffer=0xd4e088*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e088*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0097.279] GetProcessHeap () returned 0xd20000 [0097.279] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4e088, Size=0x30) returned 0xd4e088 [0097.279] GetProcessHeap () returned 0xd20000 [0097.279] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0097.279] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0097.279] GetProcessHeap () returned 0xd20000 [0097.279] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x16600) returned 0xd4e0c0 [0097.279] ReadFile (in: hFile=0x230, lpBuffer=0xd4e0c0, nNumberOfBytesToRead=0x16600, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4e0c0*, lpNumberOfBytesRead=0x299d7e8*=0x16600, lpOverlapped=0x0) returned 1 [0097.306] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0097.306] WriteFile (in: hFile=0x230, lpBuffer=0xd4e0c0*, nNumberOfBytesToWrite=0x16600, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4e0c0*, lpNumberOfBytesWritten=0x299d7e4*=0x16600, lpOverlapped=0x0) returned 1 [0097.661] GetProcessHeap () returned 0xd20000 [0097.661] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4e0c0 | out: hHeap=0xd20000) returned 1 [0097.661] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0097.662] WriteFile (in: hFile=0x230, lpBuffer=0xd4e088*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e088*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0097.686] CloseHandle (hObject=0x230) returned 1 [0098.008] GetProcessHeap () returned 0xd20000 [0098.008] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd428c8 | out: hHeap=0xd20000) returned 1 [0098.008] GetProcessHeap () returned 0xd20000 [0098.008] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c250 | out: hHeap=0xd20000) returned 1 [0098.009] GetProcessHeap () returned 0xd20000 [0098.009] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0098.009] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml") returned="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" [0098.009] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml.[ponce.lorena@aol.com]" [0098.009] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\i386\\biosblocks.xml.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0098.010] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386\\BiosBlocks.xml" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386") returned 1 [0098.011] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386\\") returned="" [0098.011] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\i386\\HOW_RECOVER.html" [0098.011] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\i386\\how_recover.html")) returned 0xffffffff [0098.011] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\i386\\how_recover.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0098.012] GetProcessHeap () returned 0xd20000 [0098.012] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bd28 [0098.012] GetProcessHeap () returned 0xd20000 [0098.012] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0098.066] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.068] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.068] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.068] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.068] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.069] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.069] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.069] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.069] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.069] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.069] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.069] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.070] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.070] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.070] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.070] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.070] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.070] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.070] GetProcessHeap () returned 0xd20000 [0098.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bd28 | out: hHeap=0xd20000) returned 1 [0098.071] GetProcessHeap () returned 0xd20000 [0098.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0098.071] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x299d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x299d9d0*=0x300, lpOverlapped=0x0) returned 1 [0098.138] GetProcessHeap () returned 0xd20000 [0098.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bbc0 [0098.139] GetProcessHeap () returned 0xd20000 [0098.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0098.151] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.151] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.151] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.152] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.152] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.152] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.152] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.152] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.152] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.152] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.152] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.153] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.153] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.153] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.153] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.153] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.153] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.153] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.154] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.154] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.154] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.154] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.154] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.154] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.154] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.154] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.155] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.155] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.155] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.155] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.155] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.155] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.155] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.156] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.156] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.156] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.156] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.156] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.156] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.907] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.907] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.907] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.908] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.908] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.908] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.908] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.908] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.908] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.908] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.908] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.909] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.909] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.909] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.909] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.909] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.909] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.915] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.915] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.915] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.916] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.916] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.916] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.916] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.916] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.916] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.916] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.916] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.917] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.917] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.917] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.917] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.917] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.917] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.917] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.917] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.918] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.918] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.918] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.918] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.918] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.918] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.918] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.918] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.919] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.919] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.919] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.919] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.919] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.919] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.919] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.920] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.920] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.920] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.920] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.920] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.920] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.920] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.920] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.921] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.921] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.921] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.921] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.921] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.921] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.921] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.922] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.922] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.922] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.922] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.922] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0098.922] GetProcessHeap () returned 0xd20000 [0098.922] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bbc0 | out: hHeap=0xd20000) returned 1 [0098.922] GetProcessHeap () returned 0xd20000 [0098.922] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0098.922] CloseHandle (hObject=0x230) returned 1 [0098.923] GetProcessHeap () returned 0xd20000 [0098.923] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44588 | out: hHeap=0xd20000) returned 1 [0098.923] FindNextFileW (in: hFindFile=0xd48f20, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ac6e0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ac6e0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x4071, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hwcompat.txt", cAlternateFileName="")) returned 1 [0098.923] lstrcmpiW (lpString1="hwcompat.txt", lpString2=".") returned 1 [0098.924] lstrcmpiW (lpString1="hwcompat.txt", lpString2="..") returned 1 [0098.924] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="hwcompat.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt") returned="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" [0098.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwcompat.txt", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0098.924] GetProcessHeap () returned 0xd20000 [0098.924] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xd) returned 0xd446d8 [0098.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwcompat.txt", cchWideChar=-1, lpMultiByteStr=0xd446d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwcompat.txt", lpUsedDefaultChar=0x0) returned 13 [0098.924] lstrlenA (lpString="hwcompat.txt") returned 12 [0098.924] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0098.924] lstrlenA (lpString="hwcompat.txt") returned 12 [0098.924] lstrlenA (lpString=".dll") returned 4 [0098.924] lstrlenA (lpString=".dll") returned 4 [0098.924] lstrlenA (lpString="hwcompat.txt") returned 12 [0098.924] lstrcmpiA (lpString1=".txt", lpString2=".dll") returned 1 [0098.924] lstrlenA (lpString="hwcompat.txt") returned 12 [0098.925] lstrlenA (lpString=".ini") returned 4 [0098.925] lstrlenA (lpString=".ini") returned 4 [0098.925] lstrlenA (lpString="hwcompat.txt") returned 12 [0098.925] lstrcmpiA (lpString1=".txt", lpString2=".ini") returned 1 [0098.925] lstrlenA (lpString="hwcompat.txt") returned 12 [0098.925] lstrlenA (lpString=".inc") returned 4 [0098.925] lstrlenA (lpString=".inc") returned 4 [0098.925] lstrlenA (lpString="hwcompat.txt") returned 12 [0098.925] lstrcmpiA (lpString1=".txt", lpString2=".inc") returned 1 [0098.925] lstrcmpiW (lpString1="hwcompat.txt", lpString2="HOW_RECOVER.html") returned 1 [0098.925] lstrcmpiW (lpString1="hwcompat.txt", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0098.925] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0098.925] lstrcmpiW (lpString1="hwcompat.txt", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0098.925] GetProcessHeap () returned 0xd20000 [0098.925] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42418 [0098.925] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0098.926] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=16497) returned 1 [0098.926] GetProcessHeap () returned 0xd20000 [0098.926] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4be90 [0098.926] GetProcessHeap () returned 0xd20000 [0098.926] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0098.927] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt") returned 47 [0098.927] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0098.927] GetProcessHeap () returned 0xd20000 [0098.927] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0098.927] GetProcessHeap () returned 0xd20000 [0098.927] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x38f) returned 0xd4e0c0 [0098.927] lstrlenA (lpString="rsa_encrypt") returned 11 [0098.928] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0098.930] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0098.930] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0098.930] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0098.931] GetProcessHeap () returned 0xd20000 [0098.931] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0098.931] lstrlenA (lpString="010001") returned 6 [0098.931] GetProcessHeap () returned 0xd20000 [0098.931] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc98 [0098.931] GetProcessHeap () returned 0xd20000 [0098.931] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0098.931] GetProcessHeap () returned 0xd20000 [0098.931] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aa68 [0098.931] GetProcessHeap () returned 0xd20000 [0098.931] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0098.931] GetProcessHeap () returned 0xd20000 [0098.931] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b008 [0098.931] GetProcessHeap () returned 0xd20000 [0098.931] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd450c8 [0098.931] GetProcessHeap () returned 0xd20000 [0098.931] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0098.931] GetProcessHeap () returned 0xd20000 [0098.932] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0098.932] GetProcessHeap () returned 0xd20000 [0098.932] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0098.932] GetProcessHeap () returned 0xd20000 [0098.932] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0098.932] GetProcessHeap () returned 0xd20000 [0098.932] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0098.932] GetProcessHeap () returned 0xd20000 [0098.932] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd451e0 [0098.932] GetProcessHeap () returned 0xd20000 [0098.932] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0098.932] GetProcessHeap () returned 0xd20000 [0098.932] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44510 [0098.932] GetProcessHeap () returned 0xd20000 [0098.932] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b1b8 [0098.932] GetProcessHeap () returned 0xd20000 [0098.932] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0098.932] GetProcessHeap () returned 0xd20000 [0098.932] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0098.933] GetProcessHeap () returned 0xd20000 [0098.933] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b1b8 | out: hHeap=0xd20000) returned 1 [0098.933] GetProcessHeap () returned 0xd20000 [0098.933] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0098.933] GetProcessHeap () returned 0xd20000 [0098.933] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445a0 [0098.933] GetProcessHeap () returned 0xd20000 [0098.933] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0098.933] GetProcessHeap () returned 0xd20000 [0098.933] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0098.933] GetProcessHeap () returned 0xd20000 [0098.933] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0098.933] GetProcessHeap () returned 0xd20000 [0098.933] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0098.933] GetProcessHeap () returned 0xd20000 [0098.933] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0098.933] GetProcessHeap () returned 0xd20000 [0098.933] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0098.933] GetProcessHeap () returned 0xd20000 [0098.933] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b518 [0098.934] GetProcessHeap () returned 0xd20000 [0098.934] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445a0 | out: hHeap=0xd20000) returned 1 [0098.934] GetProcessHeap () returned 0xd20000 [0098.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0098.934] GetProcessHeap () returned 0xd20000 [0098.934] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0098.934] GetProcessHeap () returned 0xd20000 [0098.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0098.934] GetProcessHeap () returned 0xd20000 [0098.934] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0098.934] GetProcessHeap () returned 0xd20000 [0098.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0098.934] GetProcessHeap () returned 0xd20000 [0098.934] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0098.934] GetProcessHeap () returned 0xd20000 [0098.934] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0098.934] GetProcessHeap () returned 0xd20000 [0098.934] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0098.934] GetProcessHeap () returned 0xd20000 [0098.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0098.935] GetProcessHeap () returned 0xd20000 [0098.935] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0098.935] GetProcessHeap () returned 0xd20000 [0098.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0098.935] GetProcessHeap () returned 0xd20000 [0098.935] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0098.935] GetProcessHeap () returned 0xd20000 [0098.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0098.935] GetProcessHeap () returned 0xd20000 [0098.935] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0098.935] GetProcessHeap () returned 0xd20000 [0098.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0098.935] GetProcessHeap () returned 0xd20000 [0098.935] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0098.935] GetProcessHeap () returned 0xd20000 [0098.935] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0098.935] GetProcessHeap () returned 0xd20000 [0098.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0098.936] GetProcessHeap () returned 0xd20000 [0098.936] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0098.936] GetProcessHeap () returned 0xd20000 [0098.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0098.936] GetProcessHeap () returned 0xd20000 [0098.936] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0098.936] GetProcessHeap () returned 0xd20000 [0098.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0098.936] GetProcessHeap () returned 0xd20000 [0098.936] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0098.936] GetProcessHeap () returned 0xd20000 [0098.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0098.936] GetProcessHeap () returned 0xd20000 [0098.936] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0098.936] GetProcessHeap () returned 0xd20000 [0098.936] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0098.936] GetProcessHeap () returned 0xd20000 [0098.936] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0098.937] GetProcessHeap () returned 0xd20000 [0098.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0098.937] GetProcessHeap () returned 0xd20000 [0098.937] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0098.937] GetProcessHeap () returned 0xd20000 [0098.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0098.937] GetProcessHeap () returned 0xd20000 [0098.937] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0098.937] GetProcessHeap () returned 0xd20000 [0098.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0098.937] GetProcessHeap () returned 0xd20000 [0098.937] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0098.937] GetProcessHeap () returned 0xd20000 [0098.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0098.937] GetProcessHeap () returned 0xd20000 [0098.937] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0098.937] GetProcessHeap () returned 0xd20000 [0098.937] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0098.937] GetProcessHeap () returned 0xd20000 [0098.938] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0098.938] GetProcessHeap () returned 0xd20000 [0098.938] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0098.938] GetProcessHeap () returned 0xd20000 [0098.938] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0098.938] GetProcessHeap () returned 0xd20000 [0098.938] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0098.938] GetProcessHeap () returned 0xd20000 [0098.938] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0098.938] GetProcessHeap () returned 0xd20000 [0098.938] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0098.938] GetProcessHeap () returned 0xd20000 [0098.938] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0098.938] GetProcessHeap () returned 0xd20000 [0098.938] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0098.938] GetProcessHeap () returned 0xd20000 [0098.938] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0098.938] GetProcessHeap () returned 0xd20000 [0098.938] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0098.939] GetProcessHeap () returned 0xd20000 [0098.939] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0098.939] GetProcessHeap () returned 0xd20000 [0098.939] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0098.939] GetProcessHeap () returned 0xd20000 [0098.939] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0098.939] GetProcessHeap () returned 0xd20000 [0098.939] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0098.939] GetProcessHeap () returned 0xd20000 [0098.939] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0098.939] GetProcessHeap () returned 0xd20000 [0098.939] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0098.939] GetProcessHeap () returned 0xd20000 [0098.939] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0098.939] GetProcessHeap () returned 0xd20000 [0098.939] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0098.939] GetProcessHeap () returned 0xd20000 [0098.939] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0098.939] GetProcessHeap () returned 0xd20000 [0098.939] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0098.940] GetProcessHeap () returned 0xd20000 [0098.940] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0098.940] GetProcessHeap () returned 0xd20000 [0098.940] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0098.940] GetProcessHeap () returned 0xd20000 [0098.940] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0098.940] GetProcessHeap () returned 0xd20000 [0098.940] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0098.940] GetProcessHeap () returned 0xd20000 [0098.940] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0098.940] GetProcessHeap () returned 0xd20000 [0098.940] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0098.940] GetProcessHeap () returned 0xd20000 [0098.940] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0098.940] GetProcessHeap () returned 0xd20000 [0098.949] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0098.949] GetProcessHeap () returned 0xd20000 [0098.949] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0098.949] GetProcessHeap () returned 0xd20000 [0098.949] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0098.950] GetProcessHeap () returned 0xd20000 [0098.950] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0098.950] GetProcessHeap () returned 0xd20000 [0098.950] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0098.950] GetProcessHeap () returned 0xd20000 [0098.950] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0098.950] GetProcessHeap () returned 0xd20000 [0098.950] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0098.950] GetProcessHeap () returned 0xd20000 [0098.950] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0098.950] GetProcessHeap () returned 0xd20000 [0098.950] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0098.950] GetProcessHeap () returned 0xd20000 [0098.950] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0098.950] GetProcessHeap () returned 0xd20000 [0098.950] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0098.950] GetProcessHeap () returned 0xd20000 [0098.950] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0098.950] GetProcessHeap () returned 0xd20000 [0098.951] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0098.951] GetProcessHeap () returned 0xd20000 [0098.951] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0098.951] GetProcessHeap () returned 0xd20000 [0098.951] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0098.951] GetProcessHeap () returned 0xd20000 [0098.951] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0098.951] GetProcessHeap () returned 0xd20000 [0098.951] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0098.951] GetProcessHeap () returned 0xd20000 [0098.951] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0098.951] GetProcessHeap () returned 0xd20000 [0098.951] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0098.951] GetProcessHeap () returned 0xd20000 [0098.951] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0098.951] GetProcessHeap () returned 0xd20000 [0098.951] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0098.951] GetProcessHeap () returned 0xd20000 [0098.951] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0098.951] GetProcessHeap () returned 0xd20000 [0098.952] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0098.952] GetProcessHeap () returned 0xd20000 [0098.952] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0098.952] GetProcessHeap () returned 0xd20000 [0098.952] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0098.952] GetProcessHeap () returned 0xd20000 [0098.952] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0098.952] GetProcessHeap () returned 0xd20000 [0098.952] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0098.952] GetProcessHeap () returned 0xd20000 [0098.952] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0098.952] GetProcessHeap () returned 0xd20000 [0098.952] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0098.952] GetProcessHeap () returned 0xd20000 [0098.952] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0098.952] GetProcessHeap () returned 0xd20000 [0098.952] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0098.952] GetProcessHeap () returned 0xd20000 [0098.952] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0098.953] GetProcessHeap () returned 0xd20000 [0098.953] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0098.953] GetProcessHeap () returned 0xd20000 [0098.953] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0098.953] GetProcessHeap () returned 0xd20000 [0098.953] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0098.953] GetProcessHeap () returned 0xd20000 [0098.953] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0098.953] GetProcessHeap () returned 0xd20000 [0098.953] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0098.953] GetProcessHeap () returned 0xd20000 [0098.953] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0098.953] GetProcessHeap () returned 0xd20000 [0098.953] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0098.953] GetProcessHeap () returned 0xd20000 [0098.953] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0098.953] GetProcessHeap () returned 0xd20000 [0098.953] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0098.953] GetProcessHeap () returned 0xd20000 [0098.954] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0098.954] GetProcessHeap () returned 0xd20000 [0098.954] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0098.954] GetProcessHeap () returned 0xd20000 [0098.954] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0098.954] GetProcessHeap () returned 0xd20000 [0098.954] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0098.954] GetProcessHeap () returned 0xd20000 [0098.954] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0098.954] GetProcessHeap () returned 0xd20000 [0098.954] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0098.954] GetProcessHeap () returned 0xd20000 [0098.954] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0098.954] GetProcessHeap () returned 0xd20000 [0098.954] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0098.954] GetProcessHeap () returned 0xd20000 [0098.954] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0098.954] GetProcessHeap () returned 0xd20000 [0098.955] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0098.955] GetProcessHeap () returned 0xd20000 [0098.955] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0098.955] GetProcessHeap () returned 0xd20000 [0098.955] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0098.955] GetProcessHeap () returned 0xd20000 [0098.955] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0098.955] GetProcessHeap () returned 0xd20000 [0098.955] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0099.173] GetProcessHeap () returned 0xd20000 [0099.173] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0099.173] GetProcessHeap () returned 0xd20000 [0099.173] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0099.173] GetProcessHeap () returned 0xd20000 [0099.173] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0099.173] GetProcessHeap () returned 0xd20000 [0099.173] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0099.173] GetProcessHeap () returned 0xd20000 [0099.173] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0099.173] GetProcessHeap () returned 0xd20000 [0099.173] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0099.174] GetProcessHeap () returned 0xd20000 [0099.174] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0099.174] GetProcessHeap () returned 0xd20000 [0099.174] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0099.174] GetProcessHeap () returned 0xd20000 [0099.174] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0099.179] GetProcessHeap () returned 0xd20000 [0099.179] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0099.179] GetProcessHeap () returned 0xd20000 [0099.179] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0099.179] GetProcessHeap () returned 0xd20000 [0099.179] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0099.179] GetProcessHeap () returned 0xd20000 [0099.179] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0099.179] GetProcessHeap () returned 0xd20000 [0099.179] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0099.179] GetProcessHeap () returned 0xd20000 [0099.179] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0099.179] GetProcessHeap () returned 0xd20000 [0099.179] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0099.180] GetProcessHeap () returned 0xd20000 [0099.180] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0099.180] GetProcessHeap () returned 0xd20000 [0099.180] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0099.180] GetProcessHeap () returned 0xd20000 [0099.180] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0099.180] GetProcessHeap () returned 0xd20000 [0099.180] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0099.180] GetProcessHeap () returned 0xd20000 [0099.180] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0099.180] GetProcessHeap () returned 0xd20000 [0099.180] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0099.180] GetProcessHeap () returned 0xd20000 [0099.180] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0099.180] GetProcessHeap () returned 0xd20000 [0099.180] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0099.180] GetProcessHeap () returned 0xd20000 [0099.180] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0099.180] GetProcessHeap () returned 0xd20000 [0099.180] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0099.181] GetProcessHeap () returned 0xd20000 [0099.181] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0099.181] GetProcessHeap () returned 0xd20000 [0099.181] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0099.181] GetProcessHeap () returned 0xd20000 [0099.181] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0099.181] GetProcessHeap () returned 0xd20000 [0099.181] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0099.181] GetProcessHeap () returned 0xd20000 [0099.181] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0099.181] GetProcessHeap () returned 0xd20000 [0099.181] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0099.181] GetProcessHeap () returned 0xd20000 [0099.181] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0099.181] GetProcessHeap () returned 0xd20000 [0099.181] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0099.181] GetProcessHeap () returned 0xd20000 [0099.181] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0099.181] GetProcessHeap () returned 0xd20000 [0099.182] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0099.182] GetProcessHeap () returned 0xd20000 [0099.182] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0099.182] GetProcessHeap () returned 0xd20000 [0099.182] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0099.182] GetProcessHeap () returned 0xd20000 [0099.182] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0099.182] GetProcessHeap () returned 0xd20000 [0099.182] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0099.182] GetProcessHeap () returned 0xd20000 [0099.182] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0099.182] GetProcessHeap () returned 0xd20000 [0099.182] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0099.182] GetProcessHeap () returned 0xd20000 [0099.182] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0099.182] GetProcessHeap () returned 0xd20000 [0099.182] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0099.182] GetProcessHeap () returned 0xd20000 [0099.182] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0099.182] GetProcessHeap () returned 0xd20000 [0099.183] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0099.183] GetProcessHeap () returned 0xd20000 [0099.183] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0099.183] GetProcessHeap () returned 0xd20000 [0099.183] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0099.183] GetProcessHeap () returned 0xd20000 [0099.183] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0099.183] GetProcessHeap () returned 0xd20000 [0099.183] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0099.183] GetProcessHeap () returned 0xd20000 [0099.183] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0099.183] GetProcessHeap () returned 0xd20000 [0099.183] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0099.183] GetProcessHeap () returned 0xd20000 [0099.183] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0099.183] GetProcessHeap () returned 0xd20000 [0099.183] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0099.183] GetProcessHeap () returned 0xd20000 [0099.183] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0099.183] GetProcessHeap () returned 0xd20000 [0099.184] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0099.184] GetProcessHeap () returned 0xd20000 [0099.184] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0099.184] GetProcessHeap () returned 0xd20000 [0099.184] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0099.184] GetProcessHeap () returned 0xd20000 [0099.184] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44510 | out: hHeap=0xd20000) returned 1 [0099.184] GetProcessHeap () returned 0xd20000 [0099.184] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b008 | out: hHeap=0xd20000) returned 1 [0099.184] GetProcessHeap () returned 0xd20000 [0099.184] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0099.184] GetProcessHeap () returned 0xd20000 [0099.184] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aa68 | out: hHeap=0xd20000) returned 1 [0099.184] GetProcessHeap () returned 0xd20000 [0099.184] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0099.184] GetProcessHeap () returned 0xd20000 [0099.184] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0099.184] GetProcessHeap () returned 0xd20000 [0099.184] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0099.185] WriteFile (in: hFile=0x230, lpBuffer=0xd4e0c0*, nNumberOfBytesToWrite=0x38f, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e0c0*, lpNumberOfBytesWritten=0x299d864*=0x38f, lpOverlapped=0x0) returned 1 [0100.652] GetProcessHeap () returned 0xd20000 [0100.652] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4e0c0, Size=0x30) returned 0xd4e0c0 [0100.652] GetProcessHeap () returned 0xd20000 [0100.653] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0100.653] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0100.653] GetProcessHeap () returned 0xd20000 [0100.653] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4080) returned 0xd4e0f8 [0100.653] ReadFile (in: hFile=0x230, lpBuffer=0xd4e0f8, nNumberOfBytesToRead=0x4080, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4e0f8*, lpNumberOfBytesRead=0x299d7e8*=0x4080, lpOverlapped=0x0) returned 1 [0100.655] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0100.655] WriteFile (in: hFile=0x230, lpBuffer=0xd4e0f8*, nNumberOfBytesToWrite=0x4080, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4e0f8*, lpNumberOfBytesWritten=0x299d7e4*=0x4080, lpOverlapped=0x0) returned 1 [0100.658] GetProcessHeap () returned 0xd20000 [0100.658] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4e0f8 | out: hHeap=0xd20000) returned 1 [0100.658] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0100.658] WriteFile (in: hFile=0x230, lpBuffer=0xd4e0c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e0c0*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0100.660] CloseHandle (hObject=0x230) returned 1 [0100.669] GetProcessHeap () returned 0xd20000 [0100.669] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42418 | out: hHeap=0xd20000) returned 1 [0100.669] GetProcessHeap () returned 0xd20000 [0100.669] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4be90 | out: hHeap=0xd20000) returned 1 [0100.669] GetProcessHeap () returned 0xd20000 [0100.669] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0100.669] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt") returned="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" [0100.669] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt.[ponce.lorena@aol.com]" [0100.669] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwcompat.txt.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0100.671] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386\\hwcompat.txt" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386") returned 1 [0100.671] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386\\") returned="" [0100.671] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\i386\\HOW_RECOVER.html" [0100.671] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\i386\\how_recover.html")) returned 0x20 [0100.671] GetProcessHeap () returned 0xd20000 [0100.671] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446d8 | out: hHeap=0xd20000) returned 1 [0100.671] FindNextFileW (in: hFindFile=0xd48f20, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ada69, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3ada69, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x8d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hwexclude.txt", cAlternateFileName="HWEXCL~1.TXT")) returned 1 [0100.671] lstrcmpiW (lpString1="hwexclude.txt", lpString2=".") returned 1 [0100.671] lstrcmpiW (lpString1="hwexclude.txt", lpString2="..") returned 1 [0100.671] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="hwexclude.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt") returned="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" [0100.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwexclude.txt", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0100.672] GetProcessHeap () returned 0xd20000 [0100.672] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xe) returned 0xd445a0 [0100.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwexclude.txt", cchWideChar=-1, lpMultiByteStr=0xd445a0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwexclude.txt", lpUsedDefaultChar=0x0) returned 14 [0100.672] lstrlenA (lpString="hwexclude.txt") returned 13 [0100.672] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0100.672] lstrlenA (lpString="hwexclude.txt") returned 13 [0100.672] lstrlenA (lpString=".dll") returned 4 [0100.672] lstrlenA (lpString=".dll") returned 4 [0100.672] lstrlenA (lpString="hwexclude.txt") returned 13 [0100.672] lstrcmpiA (lpString1=".txt", lpString2=".dll") returned 1 [0100.672] lstrlenA (lpString="hwexclude.txt") returned 13 [0100.672] lstrlenA (lpString=".ini") returned 4 [0100.672] lstrlenA (lpString=".ini") returned 4 [0100.672] lstrlenA (lpString="hwexclude.txt") returned 13 [0100.672] lstrcmpiA (lpString1=".txt", lpString2=".ini") returned 1 [0100.672] lstrlenA (lpString="hwexclude.txt") returned 13 [0100.672] lstrlenA (lpString=".inc") returned 4 [0100.673] lstrlenA (lpString=".inc") returned 4 [0100.673] lstrlenA (lpString="hwexclude.txt") returned 13 [0100.673] lstrcmpiA (lpString1=".txt", lpString2=".inc") returned 1 [0100.673] lstrcmpiW (lpString1="hwexclude.txt", lpString2="HOW_RECOVER.html") returned 1 [0100.673] lstrcmpiW (lpString1="hwexclude.txt", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0100.673] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0100.673] lstrcmpiW (lpString1="hwexclude.txt", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0100.673] GetProcessHeap () returned 0xd20000 [0100.673] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd426c0 [0100.673] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0100.674] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=2263) returned 1 [0100.678] GetProcessHeap () returned 0xd20000 [0100.678] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bf08 [0100.678] GetProcessHeap () returned 0xd20000 [0100.678] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0100.678] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt") returned 48 [0100.678] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0100.679] GetProcessHeap () returned 0xd20000 [0100.679] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0100.679] GetProcessHeap () returned 0xd20000 [0100.679] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x389) returned 0xd4e0f8 [0100.679] lstrlenA (lpString="rsa_encrypt") returned 11 [0100.679] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0100.682] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0100.682] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0100.682] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0100.682] GetProcessHeap () returned 0xd20000 [0100.682] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0100.682] lstrlenA (lpString="010001") returned 6 [0100.682] GetProcessHeap () returned 0xd20000 [0100.683] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cbe8 [0100.683] GetProcessHeap () returned 0xd20000 [0100.683] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0100.683] GetProcessHeap () returned 0xd20000 [0100.683] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0100.683] GetProcessHeap () returned 0xd20000 [0100.683] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0100.683] GetProcessHeap () returned 0xd20000 [0100.683] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b368 [0100.683] GetProcessHeap () returned 0xd20000 [0100.683] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44d80 [0100.683] GetProcessHeap () returned 0xd20000 [0100.683] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc28 [0100.683] GetProcessHeap () returned 0xd20000 [0100.683] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0100.683] GetProcessHeap () returned 0xd20000 [0100.683] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0100.683] GetProcessHeap () returned 0xd20000 [0100.684] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0100.684] GetProcessHeap () returned 0xd20000 [0100.684] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0100.684] GetProcessHeap () returned 0xd20000 [0100.684] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd451e0 [0100.684] GetProcessHeap () returned 0xd20000 [0100.684] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.684] GetProcessHeap () returned 0xd20000 [0100.684] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445d0 [0100.684] GetProcessHeap () returned 0xd20000 [0100.684] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b7e8 [0100.684] GetProcessHeap () returned 0xd20000 [0100.684] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0100.684] GetProcessHeap () returned 0xd20000 [0100.684] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0100.684] GetProcessHeap () returned 0xd20000 [0100.684] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0100.684] GetProcessHeap () returned 0xd20000 [0100.685] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0100.685] GetProcessHeap () returned 0xd20000 [0100.685] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446f0 [0100.685] GetProcessHeap () returned 0xd20000 [0100.685] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.685] GetProcessHeap () returned 0xd20000 [0100.685] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0100.685] GetProcessHeap () returned 0xd20000 [0100.685] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0100.685] GetProcessHeap () returned 0xd20000 [0100.685] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0100.685] GetProcessHeap () returned 0xd20000 [0100.685] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0100.685] GetProcessHeap () returned 0xd20000 [0100.685] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0100.685] GetProcessHeap () returned 0xd20000 [0100.685] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4ae58 [0100.685] GetProcessHeap () returned 0xd20000 [0100.685] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446f0 | out: hHeap=0xd20000) returned 1 [0100.685] GetProcessHeap () returned 0xd20000 [0100.686] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0100.686] GetProcessHeap () returned 0xd20000 [0100.686] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ae58 | out: hHeap=0xd20000) returned 1 [0100.686] GetProcessHeap () returned 0xd20000 [0100.686] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0100.686] GetProcessHeap () returned 0xd20000 [0100.686] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0100.686] GetProcessHeap () returned 0xd20000 [0100.686] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.686] GetProcessHeap () returned 0xd20000 [0100.686] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.686] GetProcessHeap () returned 0xd20000 [0100.686] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.686] GetProcessHeap () returned 0xd20000 [0100.686] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.686] GetProcessHeap () returned 0xd20000 [0100.686] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0100.686] GetProcessHeap () returned 0xd20000 [0100.686] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0100.686] GetProcessHeap () returned 0xd20000 [0100.687] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0100.687] GetProcessHeap () returned 0xd20000 [0100.687] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0100.687] GetProcessHeap () returned 0xd20000 [0100.687] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0100.687] GetProcessHeap () returned 0xd20000 [0100.687] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0100.687] GetProcessHeap () returned 0xd20000 [0100.687] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0100.687] GetProcessHeap () returned 0xd20000 [0100.687] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0100.687] GetProcessHeap () returned 0xd20000 [0100.687] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0100.687] GetProcessHeap () returned 0xd20000 [0100.687] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0100.687] GetProcessHeap () returned 0xd20000 [0100.687] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0100.687] GetProcessHeap () returned 0xd20000 [0100.687] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0100.687] GetProcessHeap () returned 0xd20000 [0100.688] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0100.688] GetProcessHeap () returned 0xd20000 [0100.688] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0100.688] GetProcessHeap () returned 0xd20000 [0100.688] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0100.688] GetProcessHeap () returned 0xd20000 [0100.688] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0100.688] GetProcessHeap () returned 0xd20000 [0100.688] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.688] GetProcessHeap () returned 0xd20000 [0100.688] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.688] GetProcessHeap () returned 0xd20000 [0100.688] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0100.688] GetProcessHeap () returned 0xd20000 [0100.688] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0100.688] GetProcessHeap () returned 0xd20000 [0100.688] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0100.688] GetProcessHeap () returned 0xd20000 [0100.688] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0100.688] GetProcessHeap () returned 0xd20000 [0100.689] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0100.689] GetProcessHeap () returned 0xd20000 [0100.689] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0100.689] GetProcessHeap () returned 0xd20000 [0100.689] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.689] GetProcessHeap () returned 0xd20000 [0100.689] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.689] GetProcessHeap () returned 0xd20000 [0100.689] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0100.689] GetProcessHeap () returned 0xd20000 [0100.689] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0100.689] GetProcessHeap () returned 0xd20000 [0100.689] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0100.689] GetProcessHeap () returned 0xd20000 [0100.689] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0100.689] GetProcessHeap () returned 0xd20000 [0100.689] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.689] GetProcessHeap () returned 0xd20000 [0100.691] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.691] GetProcessHeap () returned 0xd20000 [0100.691] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0100.691] GetProcessHeap () returned 0xd20000 [0100.691] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0100.691] GetProcessHeap () returned 0xd20000 [0100.691] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.691] GetProcessHeap () returned 0xd20000 [0100.692] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.692] GetProcessHeap () returned 0xd20000 [0100.692] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.692] GetProcessHeap () returned 0xd20000 [0100.692] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.692] GetProcessHeap () returned 0xd20000 [0100.692] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.692] GetProcessHeap () returned 0xd20000 [0100.692] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.692] GetProcessHeap () returned 0xd20000 [0100.692] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0100.692] GetProcessHeap () returned 0xd20000 [0100.692] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0100.692] GetProcessHeap () returned 0xd20000 [0100.692] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0100.692] GetProcessHeap () returned 0xd20000 [0100.692] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0100.692] GetProcessHeap () returned 0xd20000 [0100.692] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0100.692] GetProcessHeap () returned 0xd20000 [0100.692] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0100.693] GetProcessHeap () returned 0xd20000 [0100.693] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0100.693] GetProcessHeap () returned 0xd20000 [0100.693] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0100.693] GetProcessHeap () returned 0xd20000 [0100.693] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0100.693] GetProcessHeap () returned 0xd20000 [0100.693] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0100.693] GetProcessHeap () returned 0xd20000 [0100.693] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0100.693] GetProcessHeap () returned 0xd20000 [0100.693] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0100.693] GetProcessHeap () returned 0xd20000 [0100.693] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0100.693] GetProcessHeap () returned 0xd20000 [0100.693] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0100.693] GetProcessHeap () returned 0xd20000 [0100.693] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0100.693] GetProcessHeap () returned 0xd20000 [0100.694] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0100.694] GetProcessHeap () returned 0xd20000 [0100.694] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0100.694] GetProcessHeap () returned 0xd20000 [0100.694] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0100.694] GetProcessHeap () returned 0xd20000 [0100.694] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0100.694] GetProcessHeap () returned 0xd20000 [0100.694] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0100.694] GetProcessHeap () returned 0xd20000 [0100.694] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.694] GetProcessHeap () returned 0xd20000 [0100.694] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.694] GetProcessHeap () returned 0xd20000 [0100.694] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0100.694] GetProcessHeap () returned 0xd20000 [0100.694] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0100.695] GetProcessHeap () returned 0xd20000 [0100.695] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0100.695] GetProcessHeap () returned 0xd20000 [0100.695] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0100.695] GetProcessHeap () returned 0xd20000 [0100.695] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0100.695] GetProcessHeap () returned 0xd20000 [0100.695] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0100.695] GetProcessHeap () returned 0xd20000 [0100.695] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0100.695] GetProcessHeap () returned 0xd20000 [0100.695] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0100.695] GetProcessHeap () returned 0xd20000 [0100.695] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0100.695] GetProcessHeap () returned 0xd20000 [0100.695] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0100.696] GetProcessHeap () returned 0xd20000 [0100.696] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0100.696] GetProcessHeap () returned 0xd20000 [0100.696] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0100.696] GetProcessHeap () returned 0xd20000 [0100.696] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.696] GetProcessHeap () returned 0xd20000 [0100.696] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.696] GetProcessHeap () returned 0xd20000 [0100.696] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0100.696] GetProcessHeap () returned 0xd20000 [0100.696] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0100.696] GetProcessHeap () returned 0xd20000 [0100.696] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0100.696] GetProcessHeap () returned 0xd20000 [0100.696] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0100.696] GetProcessHeap () returned 0xd20000 [0100.696] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0100.696] GetProcessHeap () returned 0xd20000 [0100.697] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0100.697] GetProcessHeap () returned 0xd20000 [0100.697] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0100.697] GetProcessHeap () returned 0xd20000 [0100.697] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0100.697] GetProcessHeap () returned 0xd20000 [0100.697] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0100.697] GetProcessHeap () returned 0xd20000 [0100.697] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0100.697] GetProcessHeap () returned 0xd20000 [0100.697] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0100.697] GetProcessHeap () returned 0xd20000 [0100.697] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0100.697] GetProcessHeap () returned 0xd20000 [0100.697] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0100.697] GetProcessHeap () returned 0xd20000 [0100.697] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0100.697] GetProcessHeap () returned 0xd20000 [0100.697] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0100.697] GetProcessHeap () returned 0xd20000 [0100.698] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0100.698] GetProcessHeap () returned 0xd20000 [0100.698] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0100.698] GetProcessHeap () returned 0xd20000 [0100.698] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0100.698] GetProcessHeap () returned 0xd20000 [0100.698] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.698] GetProcessHeap () returned 0xd20000 [0100.698] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.698] GetProcessHeap () returned 0xd20000 [0100.698] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0100.698] GetProcessHeap () returned 0xd20000 [0100.698] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0100.698] GetProcessHeap () returned 0xd20000 [0100.698] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0100.698] GetProcessHeap () returned 0xd20000 [0100.698] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0100.698] GetProcessHeap () returned 0xd20000 [0100.698] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0100.698] GetProcessHeap () returned 0xd20000 [0100.699] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0100.699] GetProcessHeap () returned 0xd20000 [0100.699] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.699] GetProcessHeap () returned 0xd20000 [0100.699] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.699] GetProcessHeap () returned 0xd20000 [0100.699] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.699] GetProcessHeap () returned 0xd20000 [0100.699] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.699] GetProcessHeap () returned 0xd20000 [0100.699] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.699] GetProcessHeap () returned 0xd20000 [0100.699] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.699] GetProcessHeap () returned 0xd20000 [0100.699] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0100.699] GetProcessHeap () returned 0xd20000 [0100.699] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0100.699] GetProcessHeap () returned 0xd20000 [0100.699] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0100.700] GetProcessHeap () returned 0xd20000 [0100.700] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0100.700] GetProcessHeap () returned 0xd20000 [0100.700] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0100.700] GetProcessHeap () returned 0xd20000 [0100.700] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0100.700] GetProcessHeap () returned 0xd20000 [0100.700] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.700] GetProcessHeap () returned 0xd20000 [0100.700] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.700] GetProcessHeap () returned 0xd20000 [0100.700] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0100.700] GetProcessHeap () returned 0xd20000 [0100.700] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0100.700] GetProcessHeap () returned 0xd20000 [0100.700] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.700] GetProcessHeap () returned 0xd20000 [0100.700] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.700] GetProcessHeap () returned 0xd20000 [0100.700] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.700] GetProcessHeap () returned 0xd20000 [0100.700] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.701] GetProcessHeap () returned 0xd20000 [0100.701] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0100.701] GetProcessHeap () returned 0xd20000 [0100.701] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0100.701] GetProcessHeap () returned 0xd20000 [0100.701] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0100.701] GetProcessHeap () returned 0xd20000 [0100.701] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0100.701] GetProcessHeap () returned 0xd20000 [0100.701] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0100.701] GetProcessHeap () returned 0xd20000 [0100.701] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0100.701] GetProcessHeap () returned 0xd20000 [0100.701] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0100.701] GetProcessHeap () returned 0xd20000 [0100.701] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0100.701] GetProcessHeap () returned 0xd20000 [0100.701] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0100.701] GetProcessHeap () returned 0xd20000 [0100.701] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0100.701] GetProcessHeap () returned 0xd20000 [0100.701] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.702] GetProcessHeap () returned 0xd20000 [0100.702] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.702] GetProcessHeap () returned 0xd20000 [0100.702] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0100.702] GetProcessHeap () returned 0xd20000 [0100.702] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0100.702] GetProcessHeap () returned 0xd20000 [0100.702] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0100.702] GetProcessHeap () returned 0xd20000 [0100.702] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0100.702] GetProcessHeap () returned 0xd20000 [0100.702] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0100.702] GetProcessHeap () returned 0xd20000 [0100.702] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0100.702] GetProcessHeap () returned 0xd20000 [0100.702] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0100.702] GetProcessHeap () returned 0xd20000 [0100.702] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0100.702] GetProcessHeap () returned 0xd20000 [0100.702] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0100.703] GetProcessHeap () returned 0xd20000 [0100.703] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0100.703] GetProcessHeap () returned 0xd20000 [0100.703] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0100.703] GetProcessHeap () returned 0xd20000 [0100.703] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0100.703] GetProcessHeap () returned 0xd20000 [0100.703] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.703] GetProcessHeap () returned 0xd20000 [0100.703] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.703] GetProcessHeap () returned 0xd20000 [0100.703] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0100.703] GetProcessHeap () returned 0xd20000 [0100.703] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0100.703] GetProcessHeap () returned 0xd20000 [0100.703] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0100.703] GetProcessHeap () returned 0xd20000 [0100.703] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0100.703] GetProcessHeap () returned 0xd20000 [0100.703] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.704] GetProcessHeap () returned 0xd20000 [0100.704] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.704] GetProcessHeap () returned 0xd20000 [0100.704] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0100.704] GetProcessHeap () returned 0xd20000 [0100.704] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0100.704] GetProcessHeap () returned 0xd20000 [0100.704] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0100.704] GetProcessHeap () returned 0xd20000 [0100.704] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0100.704] GetProcessHeap () returned 0xd20000 [0100.704] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0100.704] GetProcessHeap () returned 0xd20000 [0100.704] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0100.704] GetProcessHeap () returned 0xd20000 [0100.704] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.704] GetProcessHeap () returned 0xd20000 [0100.704] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.704] GetProcessHeap () returned 0xd20000 [0100.704] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0100.704] GetProcessHeap () returned 0xd20000 [0100.705] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0100.705] GetProcessHeap () returned 0xd20000 [0100.705] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0100.705] GetProcessHeap () returned 0xd20000 [0100.705] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0100.705] GetProcessHeap () returned 0xd20000 [0100.705] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0100.705] GetProcessHeap () returned 0xd20000 [0100.705] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0100.705] GetProcessHeap () returned 0xd20000 [0100.707] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445d0 | out: hHeap=0xd20000) returned 1 [0100.707] GetProcessHeap () returned 0xd20000 [0100.707] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b368 | out: hHeap=0xd20000) returned 1 [0100.707] GetProcessHeap () returned 0xd20000 [0100.707] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0100.708] GetProcessHeap () returned 0xd20000 [0100.708] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0100.708] GetProcessHeap () returned 0xd20000 [0100.708] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0100.708] GetProcessHeap () returned 0xd20000 [0100.708] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0100.708] GetProcessHeap () returned 0xd20000 [0100.708] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0100.708] WriteFile (in: hFile=0x230, lpBuffer=0xd4e0f8*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e0f8*, lpNumberOfBytesWritten=0x299d864*=0x389, lpOverlapped=0x0) returned 1 [0100.714] GetProcessHeap () returned 0xd20000 [0100.714] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4e0f8, Size=0x30) returned 0xd4e0f8 [0100.714] GetProcessHeap () returned 0xd20000 [0100.714] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0100.714] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0100.714] GetProcessHeap () returned 0xd20000 [0100.714] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8e0) returned 0xd4e130 [0100.714] ReadFile (in: hFile=0x230, lpBuffer=0xd4e130, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4e130*, lpNumberOfBytesRead=0x299d7e8*=0x8e0, lpOverlapped=0x0) returned 1 [0100.715] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0100.715] WriteFile (in: hFile=0x230, lpBuffer=0xd4e130*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4e130*, lpNumberOfBytesWritten=0x299d7e4*=0x8e0, lpOverlapped=0x0) returned 1 [0100.716] GetProcessHeap () returned 0xd20000 [0100.716] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4e130 | out: hHeap=0xd20000) returned 1 [0100.716] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0100.716] WriteFile (in: hFile=0x230, lpBuffer=0xd4e0f8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e0f8*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0100.718] CloseHandle (hObject=0x230) returned 1 [0100.722] GetProcessHeap () returned 0xd20000 [0100.722] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd426c0 | out: hHeap=0xd20000) returned 1 [0100.722] GetProcessHeap () returned 0xd20000 [0100.722] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bf08 | out: hHeap=0xd20000) returned 1 [0100.722] GetProcessHeap () returned 0xd20000 [0100.722] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0100.722] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt") returned="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" [0100.722] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt.[ponce.lorena@aol.com]" [0100.722] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\i386\\hwexclude.txt.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0100.723] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386\\hwexclude.txt" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386") returned 1 [0100.723] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386\\") returned="" [0100.723] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\i386\\HOW_RECOVER.html" [0100.723] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\i386\\how_recover.html")) returned 0x20 [0100.723] GetProcessHeap () returned 0xd20000 [0100.723] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445a0 | out: hHeap=0xd20000) returned 1 [0100.723] FindNextFileW (in: hFindFile=0xd48f20, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3aedef, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3aedef, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x2684, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nxquery.cat", cAlternateFileName="")) returned 1 [0100.723] lstrcmpiW (lpString1="nxquery.cat", lpString2=".") returned 1 [0100.723] lstrcmpiW (lpString1="nxquery.cat", lpString2="..") returned 1 [0100.723] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="nxquery.cat" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat") returned="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat" [0100.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nxquery.cat", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0100.724] GetProcessHeap () returned 0xd20000 [0100.724] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd44588 [0100.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nxquery.cat", cchWideChar=-1, lpMultiByteStr=0xd44588, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nxquery.cat", lpUsedDefaultChar=0x0) returned 12 [0100.724] lstrlenA (lpString="nxquery.cat") returned 11 [0100.724] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0100.724] lstrlenA (lpString="nxquery.cat") returned 11 [0100.724] lstrlenA (lpString=".dll") returned 4 [0100.724] lstrlenA (lpString=".dll") returned 4 [0100.724] lstrlenA (lpString="nxquery.cat") returned 11 [0100.724] lstrcmpiA (lpString1=".cat", lpString2=".dll") returned -1 [0100.724] lstrlenA (lpString="nxquery.cat") returned 11 [0100.724] lstrlenA (lpString=".ini") returned 4 [0100.724] lstrlenA (lpString=".ini") returned 4 [0100.724] lstrlenA (lpString="nxquery.cat") returned 11 [0100.724] lstrcmpiA (lpString1=".cat", lpString2=".ini") returned -1 [0100.724] lstrlenA (lpString="nxquery.cat") returned 11 [0100.724] lstrlenA (lpString=".inc") returned 4 [0100.724] lstrlenA (lpString=".inc") returned 4 [0100.725] lstrlenA (lpString="nxquery.cat") returned 11 [0100.725] lstrcmpiA (lpString1=".cat", lpString2=".inc") returned -1 [0100.725] lstrcmpiW (lpString1="nxquery.cat", lpString2="HOW_RECOVER.html") returned 1 [0100.725] lstrcmpiW (lpString1="nxquery.cat", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0100.725] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0100.725] lstrcmpiW (lpString1="nxquery.cat", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0100.725] GetProcessHeap () returned 0xd20000 [0100.725] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42530 [0100.725] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0100.726] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=9860) returned 1 [0100.726] GetProcessHeap () returned 0xd20000 [0100.726] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bd28 [0100.726] GetProcessHeap () returned 0xd20000 [0100.726] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0100.726] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat") returned 46 [0100.726] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0100.726] GetProcessHeap () returned 0xd20000 [0100.726] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0100.726] GetProcessHeap () returned 0xd20000 [0100.726] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4e130 [0100.726] lstrlenA (lpString="rsa_encrypt") returned 11 [0100.726] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0100.729] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0100.729] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0100.729] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0100.729] GetProcessHeap () returned 0xd20000 [0100.729] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0100.729] lstrlenA (lpString="010001") returned 6 [0100.729] GetProcessHeap () returned 0xd20000 [0100.729] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc98 [0100.729] GetProcessHeap () returned 0xd20000 [0100.729] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0100.729] GetProcessHeap () returned 0xd20000 [0100.729] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4a948 [0100.729] GetProcessHeap () returned 0xd20000 [0100.729] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0100.730] GetProcessHeap () returned 0xd20000 [0100.730] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b5a8 [0100.730] GetProcessHeap () returned 0xd20000 [0100.730] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45410 [0100.730] GetProcessHeap () returned 0xd20000 [0100.730] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd88 [0100.730] GetProcessHeap () returned 0xd20000 [0100.730] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0100.730] GetProcessHeap () returned 0xd20000 [0100.730] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0100.730] GetProcessHeap () returned 0xd20000 [0100.730] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0100.730] GetProcessHeap () returned 0xd20000 [0100.730] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0100.730] GetProcessHeap () returned 0xd20000 [0100.730] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44e98 [0100.730] GetProcessHeap () returned 0xd20000 [0100.730] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0100.730] GetProcessHeap () returned 0xd20000 [0100.730] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444c8 [0100.730] GetProcessHeap () returned 0xd20000 [0100.730] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4a9d8 [0100.731] GetProcessHeap () returned 0xd20000 [0100.731] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0100.731] GetProcessHeap () returned 0xd20000 [0100.731] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0100.731] GetProcessHeap () returned 0xd20000 [0100.731] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a9d8 | out: hHeap=0xd20000) returned 1 [0100.731] GetProcessHeap () returned 0xd20000 [0100.731] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0100.731] GetProcessHeap () returned 0xd20000 [0100.731] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444e0 [0100.731] GetProcessHeap () returned 0xd20000 [0100.731] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0100.731] GetProcessHeap () returned 0xd20000 [0100.731] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0100.731] GetProcessHeap () returned 0xd20000 [0100.731] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0100.731] GetProcessHeap () returned 0xd20000 [0100.731] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0100.731] GetProcessHeap () returned 0xd20000 [0100.731] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0100.732] GetProcessHeap () returned 0xd20000 [0100.732] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0100.732] GetProcessHeap () returned 0xd20000 [0100.732] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b488 [0100.732] GetProcessHeap () returned 0xd20000 [0100.732] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444e0 | out: hHeap=0xd20000) returned 1 [0100.732] GetProcessHeap () returned 0xd20000 [0100.732] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0100.732] GetProcessHeap () returned 0xd20000 [0100.732] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b488 | out: hHeap=0xd20000) returned 1 [0100.732] GetProcessHeap () returned 0xd20000 [0100.732] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0100.732] GetProcessHeap () returned 0xd20000 [0100.732] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0100.732] GetProcessHeap () returned 0xd20000 [0100.732] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0100.732] GetProcessHeap () returned 0xd20000 [0100.732] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0100.732] GetProcessHeap () returned 0xd20000 [0100.732] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0100.733] GetProcessHeap () returned 0xd20000 [0100.733] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0100.733] GetProcessHeap () returned 0xd20000 [0100.733] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0100.733] GetProcessHeap () returned 0xd20000 [0100.733] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0100.733] GetProcessHeap () returned 0xd20000 [0100.733] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0100.733] GetProcessHeap () returned 0xd20000 [0100.733] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0100.733] GetProcessHeap () returned 0xd20000 [0100.733] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.733] GetProcessHeap () returned 0xd20000 [0100.733] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.733] GetProcessHeap () returned 0xd20000 [0100.733] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0100.733] GetProcessHeap () returned 0xd20000 [0100.733] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0100.733] GetProcessHeap () returned 0xd20000 [0100.733] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0100.734] GetProcessHeap () returned 0xd20000 [0100.734] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0100.734] GetProcessHeap () returned 0xd20000 [0100.734] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.734] GetProcessHeap () returned 0xd20000 [0100.734] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.734] GetProcessHeap () returned 0xd20000 [0100.734] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0100.734] GetProcessHeap () returned 0xd20000 [0100.734] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0100.734] GetProcessHeap () returned 0xd20000 [0100.734] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0100.734] GetProcessHeap () returned 0xd20000 [0100.734] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0100.734] GetProcessHeap () returned 0xd20000 [0100.734] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0100.734] GetProcessHeap () returned 0xd20000 [0100.734] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0100.734] GetProcessHeap () returned 0xd20000 [0100.734] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0100.735] GetProcessHeap () returned 0xd20000 [0100.735] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0100.735] GetProcessHeap () returned 0xd20000 [0100.735] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.735] GetProcessHeap () returned 0xd20000 [0100.735] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.735] GetProcessHeap () returned 0xd20000 [0100.735] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0100.735] GetProcessHeap () returned 0xd20000 [0100.735] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0100.735] GetProcessHeap () returned 0xd20000 [0100.735] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0100.735] GetProcessHeap () returned 0xd20000 [0100.735] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0100.735] GetProcessHeap () returned 0xd20000 [0100.735] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.735] GetProcessHeap () returned 0xd20000 [0100.735] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.735] GetProcessHeap () returned 0xd20000 [0100.735] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.736] GetProcessHeap () returned 0xd20000 [0100.736] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.736] GetProcessHeap () returned 0xd20000 [0100.736] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0100.736] GetProcessHeap () returned 0xd20000 [0100.736] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0100.736] GetProcessHeap () returned 0xd20000 [0100.736] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.736] GetProcessHeap () returned 0xd20000 [0100.736] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.736] GetProcessHeap () returned 0xd20000 [0100.736] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0100.736] GetProcessHeap () returned 0xd20000 [0100.736] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0100.737] GetProcessHeap () returned 0xd20000 [0100.737] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0100.737] GetProcessHeap () returned 0xd20000 [0100.737] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0100.737] GetProcessHeap () returned 0xd20000 [0100.737] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0100.737] GetProcessHeap () returned 0xd20000 [0100.738] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0100.738] GetProcessHeap () returned 0xd20000 [0100.738] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.738] GetProcessHeap () returned 0xd20000 [0100.738] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.738] GetProcessHeap () returned 0xd20000 [0100.738] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.738] GetProcessHeap () returned 0xd20000 [0100.738] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.738] GetProcessHeap () returned 0xd20000 [0100.738] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0100.738] GetProcessHeap () returned 0xd20000 [0100.738] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0100.738] GetProcessHeap () returned 0xd20000 [0100.738] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.738] GetProcessHeap () returned 0xd20000 [0100.738] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.738] GetProcessHeap () returned 0xd20000 [0100.738] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.739] GetProcessHeap () returned 0xd20000 [0100.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.739] GetProcessHeap () returned 0xd20000 [0100.739] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.739] GetProcessHeap () returned 0xd20000 [0100.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.739] GetProcessHeap () returned 0xd20000 [0100.739] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.739] GetProcessHeap () returned 0xd20000 [0100.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.739] GetProcessHeap () returned 0xd20000 [0100.739] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0100.739] GetProcessHeap () returned 0xd20000 [0100.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0100.739] GetProcessHeap () returned 0xd20000 [0100.739] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0100.739] GetProcessHeap () returned 0xd20000 [0100.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0100.740] GetProcessHeap () returned 0xd20000 [0100.740] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.740] GetProcessHeap () returned 0xd20000 [0100.740] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.740] GetProcessHeap () returned 0xd20000 [0100.740] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0100.740] GetProcessHeap () returned 0xd20000 [0100.740] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0100.740] GetProcessHeap () returned 0xd20000 [0100.740] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0100.740] GetProcessHeap () returned 0xd20000 [0100.740] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0100.740] GetProcessHeap () returned 0xd20000 [0100.740] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0100.740] GetProcessHeap () returned 0xd20000 [0100.740] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0100.740] GetProcessHeap () returned 0xd20000 [0100.740] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0100.740] GetProcessHeap () returned 0xd20000 [0100.741] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0100.741] GetProcessHeap () returned 0xd20000 [0100.741] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0100.741] GetProcessHeap () returned 0xd20000 [0100.741] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0100.741] GetProcessHeap () returned 0xd20000 [0100.741] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0100.741] GetProcessHeap () returned 0xd20000 [0100.741] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0100.741] GetProcessHeap () returned 0xd20000 [0100.741] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.741] GetProcessHeap () returned 0xd20000 [0100.741] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.741] GetProcessHeap () returned 0xd20000 [0100.741] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.741] GetProcessHeap () returned 0xd20000 [0100.741] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.741] GetProcessHeap () returned 0xd20000 [0100.742] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.742] GetProcessHeap () returned 0xd20000 [0100.742] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.742] GetProcessHeap () returned 0xd20000 [0100.742] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0100.742] GetProcessHeap () returned 0xd20000 [0100.742] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0100.742] GetProcessHeap () returned 0xd20000 [0100.742] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0100.742] GetProcessHeap () returned 0xd20000 [0100.742] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0100.742] GetProcessHeap () returned 0xd20000 [0100.742] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0100.742] GetProcessHeap () returned 0xd20000 [0100.742] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0100.742] GetProcessHeap () returned 0xd20000 [0100.742] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.742] GetProcessHeap () returned 0xd20000 [0100.742] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.743] GetProcessHeap () returned 0xd20000 [0100.743] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0100.743] GetProcessHeap () returned 0xd20000 [0100.743] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0100.743] GetProcessHeap () returned 0xd20000 [0100.743] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0100.743] GetProcessHeap () returned 0xd20000 [0100.743] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0100.743] GetProcessHeap () returned 0xd20000 [0100.743] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0100.743] GetProcessHeap () returned 0xd20000 [0100.743] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0100.743] GetProcessHeap () returned 0xd20000 [0100.743] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0100.743] GetProcessHeap () returned 0xd20000 [0100.743] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0100.743] GetProcessHeap () returned 0xd20000 [0100.743] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0100.743] GetProcessHeap () returned 0xd20000 [0100.744] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0100.744] GetProcessHeap () returned 0xd20000 [0100.744] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0100.744] GetProcessHeap () returned 0xd20000 [0100.744] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0100.744] GetProcessHeap () returned 0xd20000 [0100.744] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0100.744] GetProcessHeap () returned 0xd20000 [0100.744] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0100.744] GetProcessHeap () returned 0xd20000 [0100.744] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.744] GetProcessHeap () returned 0xd20000 [0100.744] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.744] GetProcessHeap () returned 0xd20000 [0100.744] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.744] GetProcessHeap () returned 0xd20000 [0100.744] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.744] GetProcessHeap () returned 0xd20000 [0100.745] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.745] GetProcessHeap () returned 0xd20000 [0100.745] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.745] GetProcessHeap () returned 0xd20000 [0100.745] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.745] GetProcessHeap () returned 0xd20000 [0100.745] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.745] GetProcessHeap () returned 0xd20000 [0100.745] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0100.745] GetProcessHeap () returned 0xd20000 [0100.745] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0100.745] GetProcessHeap () returned 0xd20000 [0100.745] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0100.745] GetProcessHeap () returned 0xd20000 [0100.745] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0100.745] GetProcessHeap () returned 0xd20000 [0100.745] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0100.745] GetProcessHeap () returned 0xd20000 [0100.745] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0100.746] GetProcessHeap () returned 0xd20000 [0100.746] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.746] GetProcessHeap () returned 0xd20000 [0100.746] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.746] GetProcessHeap () returned 0xd20000 [0100.746] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0100.746] GetProcessHeap () returned 0xd20000 [0100.746] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0100.746] GetProcessHeap () returned 0xd20000 [0100.746] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.746] GetProcessHeap () returned 0xd20000 [0100.746] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.746] GetProcessHeap () returned 0xd20000 [0100.746] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0100.746] GetProcessHeap () returned 0xd20000 [0100.746] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0100.746] GetProcessHeap () returned 0xd20000 [0100.746] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.746] GetProcessHeap () returned 0xd20000 [0100.747] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.747] GetProcessHeap () returned 0xd20000 [0100.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0100.747] GetProcessHeap () returned 0xd20000 [0100.747] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0100.747] GetProcessHeap () returned 0xd20000 [0100.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.747] GetProcessHeap () returned 0xd20000 [0100.747] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.747] GetProcessHeap () returned 0xd20000 [0100.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0100.747] GetProcessHeap () returned 0xd20000 [0100.747] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0100.747] GetProcessHeap () returned 0xd20000 [0100.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0100.747] GetProcessHeap () returned 0xd20000 [0100.747] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0100.747] GetProcessHeap () returned 0xd20000 [0100.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0100.748] GetProcessHeap () returned 0xd20000 [0100.748] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0100.748] GetProcessHeap () returned 0xd20000 [0100.748] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0100.748] GetProcessHeap () returned 0xd20000 [0100.748] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0100.748] GetProcessHeap () returned 0xd20000 [0100.748] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0100.748] GetProcessHeap () returned 0xd20000 [0100.748] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0100.748] GetProcessHeap () returned 0xd20000 [0100.748] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.748] GetProcessHeap () returned 0xd20000 [0100.748] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.748] GetProcessHeap () returned 0xd20000 [0100.748] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.748] GetProcessHeap () returned 0xd20000 [0100.748] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.748] GetProcessHeap () returned 0xd20000 [0100.749] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.749] GetProcessHeap () returned 0xd20000 [0100.749] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.749] GetProcessHeap () returned 0xd20000 [0100.749] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0100.749] GetProcessHeap () returned 0xd20000 [0100.749] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0100.749] GetProcessHeap () returned 0xd20000 [0100.749] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.749] GetProcessHeap () returned 0xd20000 [0100.749] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.749] GetProcessHeap () returned 0xd20000 [0100.749] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0100.749] GetProcessHeap () returned 0xd20000 [0100.749] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0100.749] GetProcessHeap () returned 0xd20000 [0100.749] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.749] GetProcessHeap () returned 0xd20000 [0100.749] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.749] GetProcessHeap () returned 0xd20000 [0100.750] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0100.750] GetProcessHeap () returned 0xd20000 [0100.750] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0100.750] GetProcessHeap () returned 0xd20000 [0100.750] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0100.750] GetProcessHeap () returned 0xd20000 [0100.750] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0100.750] GetProcessHeap () returned 0xd20000 [0100.750] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0100.750] GetProcessHeap () returned 0xd20000 [0100.750] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0100.750] GetProcessHeap () returned 0xd20000 [0100.750] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0100.750] GetProcessHeap () returned 0xd20000 [0100.750] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0100.750] GetProcessHeap () returned 0xd20000 [0100.750] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0100.750] GetProcessHeap () returned 0xd20000 [0100.750] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0100.751] GetProcessHeap () returned 0xd20000 [0100.751] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0100.751] GetProcessHeap () returned 0xd20000 [0100.751] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0100.751] GetProcessHeap () returned 0xd20000 [0100.751] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0100.751] GetProcessHeap () returned 0xd20000 [0100.751] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0100.751] GetProcessHeap () returned 0xd20000 [0100.751] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0100.751] GetProcessHeap () returned 0xd20000 [0100.751] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0100.751] GetProcessHeap () returned 0xd20000 [0100.751] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444c8 | out: hHeap=0xd20000) returned 1 [0100.751] GetProcessHeap () returned 0xd20000 [0100.751] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b5a8 | out: hHeap=0xd20000) returned 1 [0100.751] GetProcessHeap () returned 0xd20000 [0100.751] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0100.751] GetProcessHeap () returned 0xd20000 [0100.751] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a948 | out: hHeap=0xd20000) returned 1 [0100.752] GetProcessHeap () returned 0xd20000 [0100.752] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0100.752] GetProcessHeap () returned 0xd20000 [0100.752] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0100.752] GetProcessHeap () returned 0xd20000 [0100.752] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0100.752] WriteFile (in: hFile=0x230, lpBuffer=0xd4e130*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e130*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0101.108] GetProcessHeap () returned 0xd20000 [0101.108] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4e130, Size=0x30) returned 0xd4e130 [0101.108] GetProcessHeap () returned 0xd20000 [0101.108] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0101.108] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0101.108] GetProcessHeap () returned 0xd20000 [0101.108] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x2684) returned 0xd4e168 [0101.108] ReadFile (in: hFile=0x230, lpBuffer=0xd4e168, nNumberOfBytesToRead=0x2684, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4e168*, lpNumberOfBytesRead=0x299d7e8*=0x2684, lpOverlapped=0x0) returned 1 [0101.110] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0101.110] WriteFile (in: hFile=0x230, lpBuffer=0xd4e168*, nNumberOfBytesToWrite=0x2684, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4e168*, lpNumberOfBytesWritten=0x299d7e4*=0x2684, lpOverlapped=0x0) returned 1 [0101.111] GetProcessHeap () returned 0xd20000 [0101.111] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4e168 | out: hHeap=0xd20000) returned 1 [0101.111] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0101.112] WriteFile (in: hFile=0x230, lpBuffer=0xd4e130*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e130*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0101.113] CloseHandle (hObject=0x230) returned 1 [0101.117] GetProcessHeap () returned 0xd20000 [0101.117] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42530 | out: hHeap=0xd20000) returned 1 [0101.117] GetProcessHeap () returned 0xd20000 [0101.117] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bd28 | out: hHeap=0xd20000) returned 1 [0101.117] GetProcessHeap () returned 0xd20000 [0101.117] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0101.117] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat") returned="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat" [0101.117] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat.[ponce.lorena@aol.com]" [0101.118] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.cat"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.cat.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0101.118] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386\\nxquery.cat" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386") returned 1 [0101.118] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386\\") returned="" [0101.118] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\i386\\HOW_RECOVER.html" [0101.119] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\i386\\how_recover.html")) returned 0x20 [0101.119] GetProcessHeap () returned 0xd20000 [0101.119] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44588 | out: hHeap=0xd20000) returned 1 [0101.119] FindNextFileW (in: hFindFile=0xd48f20, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b017f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b017f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x5d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nxquery.inf", cAlternateFileName="")) returned 1 [0101.119] lstrcmpiW (lpString1="nxquery.inf", lpString2=".") returned 1 [0101.119] lstrcmpiW (lpString1="nxquery.inf", lpString2="..") returned 1 [0101.119] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="nxquery.inf" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf") returned="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf" [0101.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nxquery.inf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0101.119] GetProcessHeap () returned 0xd20000 [0101.119] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd44420 [0101.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nxquery.inf", cchWideChar=-1, lpMultiByteStr=0xd44420, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nxquery.inf", lpUsedDefaultChar=0x0) returned 12 [0101.119] lstrlenA (lpString="nxquery.inf") returned 11 [0101.119] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0101.119] lstrlenA (lpString="nxquery.inf") returned 11 [0101.119] lstrlenA (lpString=".dll") returned 4 [0101.120] lstrlenA (lpString=".dll") returned 4 [0101.120] lstrlenA (lpString="nxquery.inf") returned 11 [0101.120] lstrcmpiA (lpString1=".inf", lpString2=".dll") returned 1 [0101.120] lstrlenA (lpString="nxquery.inf") returned 11 [0101.120] lstrlenA (lpString=".ini") returned 4 [0101.120] lstrlenA (lpString=".ini") returned 4 [0101.120] lstrlenA (lpString="nxquery.inf") returned 11 [0101.120] lstrcmpiA (lpString1=".inf", lpString2=".ini") returned -1 [0101.120] lstrlenA (lpString="nxquery.inf") returned 11 [0101.120] lstrlenA (lpString=".inc") returned 4 [0101.120] lstrlenA (lpString=".inc") returned 4 [0101.120] lstrlenA (lpString="nxquery.inf") returned 11 [0101.120] lstrcmpiA (lpString1=".inf", lpString2=".inc") returned 1 [0101.120] lstrcmpiW (lpString1="nxquery.inf", lpString2="HOW_RECOVER.html") returned 1 [0101.120] lstrcmpiW (lpString1="nxquery.inf", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0101.120] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0101.120] lstrcmpiW (lpString1="nxquery.inf", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0101.120] GetProcessHeap () returned 0xd20000 [0101.120] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42828 [0101.121] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0101.121] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=1495) returned 1 [0101.121] GetProcessHeap () returned 0xd20000 [0101.121] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c250 [0101.121] GetProcessHeap () returned 0xd20000 [0101.121] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0101.121] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf") returned 46 [0101.121] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0101.122] GetProcessHeap () returned 0xd20000 [0101.122] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0101.122] GetProcessHeap () returned 0xd20000 [0101.122] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x389) returned 0xd4e168 [0101.122] lstrlenA (lpString="rsa_encrypt") returned 11 [0101.122] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0101.124] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0101.124] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0101.125] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0101.125] GetProcessHeap () returned 0xd20000 [0101.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0101.125] lstrlenA (lpString="010001") returned 6 [0101.125] GetProcessHeap () returned 0xd20000 [0101.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cdb8 [0101.125] GetProcessHeap () returned 0xd20000 [0101.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0101.125] GetProcessHeap () returned 0xd20000 [0101.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0101.125] GetProcessHeap () returned 0xd20000 [0101.125] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0101.125] GetProcessHeap () returned 0xd20000 [0101.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b758 [0101.125] GetProcessHeap () returned 0xd20000 [0101.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44c68 [0101.126] GetProcessHeap () returned 0xd20000 [0101.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd88 [0101.126] GetProcessHeap () returned 0xd20000 [0101.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0101.126] GetProcessHeap () returned 0xd20000 [0101.126] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.126] GetProcessHeap () returned 0xd20000 [0101.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0101.126] GetProcessHeap () returned 0xd20000 [0101.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0101.126] GetProcessHeap () returned 0xd20000 [0101.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44fb0 [0101.126] GetProcessHeap () returned 0xd20000 [0101.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0101.126] GetProcessHeap () returned 0xd20000 [0101.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446f0 [0101.126] GetProcessHeap () returned 0xd20000 [0101.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b7e8 [0101.126] GetProcessHeap () returned 0xd20000 [0101.126] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0101.127] GetProcessHeap () returned 0xd20000 [0101.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0101.127] GetProcessHeap () returned 0xd20000 [0101.127] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0101.127] GetProcessHeap () returned 0xd20000 [0101.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.128] GetProcessHeap () returned 0xd20000 [0101.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44408 [0101.128] GetProcessHeap () returned 0xd20000 [0101.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0101.128] GetProcessHeap () returned 0xd20000 [0101.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.128] GetProcessHeap () returned 0xd20000 [0101.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0101.128] GetProcessHeap () returned 0xd20000 [0101.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0101.128] GetProcessHeap () returned 0xd20000 [0101.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0101.128] GetProcessHeap () returned 0xd20000 [0101.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0101.128] GetProcessHeap () returned 0xd20000 [0101.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b1b8 [0101.128] GetProcessHeap () returned 0xd20000 [0101.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44408 | out: hHeap=0xd20000) returned 1 [0101.128] GetProcessHeap () returned 0xd20000 [0101.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0101.129] GetProcessHeap () returned 0xd20000 [0101.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b1b8 | out: hHeap=0xd20000) returned 1 [0101.129] GetProcessHeap () returned 0xd20000 [0101.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.129] GetProcessHeap () returned 0xd20000 [0101.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.129] GetProcessHeap () returned 0xd20000 [0101.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0101.129] GetProcessHeap () returned 0xd20000 [0101.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0101.129] GetProcessHeap () returned 0xd20000 [0101.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.129] GetProcessHeap () returned 0xd20000 [0101.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.129] GetProcessHeap () returned 0xd20000 [0101.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0101.129] GetProcessHeap () returned 0xd20000 [0101.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0101.130] GetProcessHeap () returned 0xd20000 [0101.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.130] GetProcessHeap () returned 0xd20000 [0101.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.130] GetProcessHeap () returned 0xd20000 [0101.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.130] GetProcessHeap () returned 0xd20000 [0101.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.130] GetProcessHeap () returned 0xd20000 [0101.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0101.130] GetProcessHeap () returned 0xd20000 [0101.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0101.130] GetProcessHeap () returned 0xd20000 [0101.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.130] GetProcessHeap () returned 0xd20000 [0101.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.130] GetProcessHeap () returned 0xd20000 [0101.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.131] GetProcessHeap () returned 0xd20000 [0101.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.131] GetProcessHeap () returned 0xd20000 [0101.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.131] GetProcessHeap () returned 0xd20000 [0101.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.131] GetProcessHeap () returned 0xd20000 [0101.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0101.131] GetProcessHeap () returned 0xd20000 [0101.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0101.131] GetProcessHeap () returned 0xd20000 [0101.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.131] GetProcessHeap () returned 0xd20000 [0101.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.131] GetProcessHeap () returned 0xd20000 [0101.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.131] GetProcessHeap () returned 0xd20000 [0101.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.131] GetProcessHeap () returned 0xd20000 [0101.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.132] GetProcessHeap () returned 0xd20000 [0101.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.132] GetProcessHeap () returned 0xd20000 [0101.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0101.132] GetProcessHeap () returned 0xd20000 [0101.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0101.132] GetProcessHeap () returned 0xd20000 [0101.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0101.132] GetProcessHeap () returned 0xd20000 [0101.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0101.132] GetProcessHeap () returned 0xd20000 [0101.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0101.132] GetProcessHeap () returned 0xd20000 [0101.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0101.132] GetProcessHeap () returned 0xd20000 [0101.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.132] GetProcessHeap () returned 0xd20000 [0101.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.133] GetProcessHeap () returned 0xd20000 [0101.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0101.133] GetProcessHeap () returned 0xd20000 [0101.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0101.133] GetProcessHeap () returned 0xd20000 [0101.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0101.133] GetProcessHeap () returned 0xd20000 [0101.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0101.133] GetProcessHeap () returned 0xd20000 [0101.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.133] GetProcessHeap () returned 0xd20000 [0101.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.133] GetProcessHeap () returned 0xd20000 [0101.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0101.133] GetProcessHeap () returned 0xd20000 [0101.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0101.133] GetProcessHeap () returned 0xd20000 [0101.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0101.134] GetProcessHeap () returned 0xd20000 [0101.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0101.134] GetProcessHeap () returned 0xd20000 [0101.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.134] GetProcessHeap () returned 0xd20000 [0101.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.134] GetProcessHeap () returned 0xd20000 [0101.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0101.134] GetProcessHeap () returned 0xd20000 [0101.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0101.134] GetProcessHeap () returned 0xd20000 [0101.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0101.134] GetProcessHeap () returned 0xd20000 [0101.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0101.134] GetProcessHeap () returned 0xd20000 [0101.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0101.134] GetProcessHeap () returned 0xd20000 [0101.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0101.135] GetProcessHeap () returned 0xd20000 [0101.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.135] GetProcessHeap () returned 0xd20000 [0101.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.135] GetProcessHeap () returned 0xd20000 [0101.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0101.135] GetProcessHeap () returned 0xd20000 [0101.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0101.135] GetProcessHeap () returned 0xd20000 [0101.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.135] GetProcessHeap () returned 0xd20000 [0101.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.135] GetProcessHeap () returned 0xd20000 [0101.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0101.135] GetProcessHeap () returned 0xd20000 [0101.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0101.136] GetProcessHeap () returned 0xd20000 [0101.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0101.136] GetProcessHeap () returned 0xd20000 [0101.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0101.136] GetProcessHeap () returned 0xd20000 [0101.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0101.136] GetProcessHeap () returned 0xd20000 [0101.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0101.136] GetProcessHeap () returned 0xd20000 [0101.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0101.136] GetProcessHeap () returned 0xd20000 [0101.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0101.136] GetProcessHeap () returned 0xd20000 [0101.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.136] GetProcessHeap () returned 0xd20000 [0101.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.136] GetProcessHeap () returned 0xd20000 [0101.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0101.136] GetProcessHeap () returned 0xd20000 [0101.137] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0101.137] GetProcessHeap () returned 0xd20000 [0101.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0101.137] GetProcessHeap () returned 0xd20000 [0101.137] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0101.137] GetProcessHeap () returned 0xd20000 [0101.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.137] GetProcessHeap () returned 0xd20000 [0101.137] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.137] GetProcessHeap () returned 0xd20000 [0101.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0101.137] GetProcessHeap () returned 0xd20000 [0101.137] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0101.137] GetProcessHeap () returned 0xd20000 [0101.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0101.137] GetProcessHeap () returned 0xd20000 [0101.137] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0101.137] GetProcessHeap () returned 0xd20000 [0101.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0101.138] GetProcessHeap () returned 0xd20000 [0101.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0101.138] GetProcessHeap () returned 0xd20000 [0101.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.138] GetProcessHeap () returned 0xd20000 [0101.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.138] GetProcessHeap () returned 0xd20000 [0101.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.138] GetProcessHeap () returned 0xd20000 [0101.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.138] GetProcessHeap () returned 0xd20000 [0101.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.138] GetProcessHeap () returned 0xd20000 [0101.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.138] GetProcessHeap () returned 0xd20000 [0101.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.138] GetProcessHeap () returned 0xd20000 [0101.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.138] GetProcessHeap () returned 0xd20000 [0101.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.139] GetProcessHeap () returned 0xd20000 [0101.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.139] GetProcessHeap () returned 0xd20000 [0101.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.139] GetProcessHeap () returned 0xd20000 [0101.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.139] GetProcessHeap () returned 0xd20000 [0101.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.139] GetProcessHeap () returned 0xd20000 [0101.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.139] GetProcessHeap () returned 0xd20000 [0101.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0101.139] GetProcessHeap () returned 0xd20000 [0101.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0101.139] GetProcessHeap () returned 0xd20000 [0101.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.139] GetProcessHeap () returned 0xd20000 [0101.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.140] GetProcessHeap () returned 0xd20000 [0101.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.140] GetProcessHeap () returned 0xd20000 [0101.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.140] GetProcessHeap () returned 0xd20000 [0101.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.140] GetProcessHeap () returned 0xd20000 [0101.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.140] GetProcessHeap () returned 0xd20000 [0101.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0101.140] GetProcessHeap () returned 0xd20000 [0101.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0101.140] GetProcessHeap () returned 0xd20000 [0101.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0101.140] GetProcessHeap () returned 0xd20000 [0101.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0101.140] GetProcessHeap () returned 0xd20000 [0101.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0101.140] GetProcessHeap () returned 0xd20000 [0101.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0101.141] GetProcessHeap () returned 0xd20000 [0101.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.141] GetProcessHeap () returned 0xd20000 [0101.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.141] GetProcessHeap () returned 0xd20000 [0101.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.141] GetProcessHeap () returned 0xd20000 [0101.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.141] GetProcessHeap () returned 0xd20000 [0101.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.141] GetProcessHeap () returned 0xd20000 [0101.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.141] GetProcessHeap () returned 0xd20000 [0101.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.141] GetProcessHeap () returned 0xd20000 [0101.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.141] GetProcessHeap () returned 0xd20000 [0101.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0101.141] GetProcessHeap () returned 0xd20000 [0101.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0101.142] GetProcessHeap () returned 0xd20000 [0101.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0101.142] GetProcessHeap () returned 0xd20000 [0101.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0101.142] GetProcessHeap () returned 0xd20000 [0101.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0101.142] GetProcessHeap () returned 0xd20000 [0101.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0101.142] GetProcessHeap () returned 0xd20000 [0101.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0101.142] GetProcessHeap () returned 0xd20000 [0101.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0101.142] GetProcessHeap () returned 0xd20000 [0101.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.142] GetProcessHeap () returned 0xd20000 [0101.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.142] GetProcessHeap () returned 0xd20000 [0101.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0101.142] GetProcessHeap () returned 0xd20000 [0101.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0101.142] GetProcessHeap () returned 0xd20000 [0101.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0101.143] GetProcessHeap () returned 0xd20000 [0101.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0101.143] GetProcessHeap () returned 0xd20000 [0101.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.143] GetProcessHeap () returned 0xd20000 [0101.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.143] GetProcessHeap () returned 0xd20000 [0101.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0101.144] GetProcessHeap () returned 0xd20000 [0101.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0101.144] GetProcessHeap () returned 0xd20000 [0101.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0101.144] GetProcessHeap () returned 0xd20000 [0101.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0101.144] GetProcessHeap () returned 0xd20000 [0101.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0101.144] GetProcessHeap () returned 0xd20000 [0101.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0101.144] GetProcessHeap () returned 0xd20000 [0101.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.144] GetProcessHeap () returned 0xd20000 [0101.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.144] GetProcessHeap () returned 0xd20000 [0101.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0101.144] GetProcessHeap () returned 0xd20000 [0101.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0101.144] GetProcessHeap () returned 0xd20000 [0101.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0101.144] GetProcessHeap () returned 0xd20000 [0101.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0101.144] GetProcessHeap () returned 0xd20000 [0101.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0101.145] GetProcessHeap () returned 0xd20000 [0101.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0101.145] GetProcessHeap () returned 0xd20000 [0101.145] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0101.145] GetProcessHeap () returned 0xd20000 [0101.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0101.145] GetProcessHeap () returned 0xd20000 [0101.145] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.145] GetProcessHeap () returned 0xd20000 [0101.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.145] GetProcessHeap () returned 0xd20000 [0101.145] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0101.145] GetProcessHeap () returned 0xd20000 [0101.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0101.145] GetProcessHeap () returned 0xd20000 [0101.145] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0101.145] GetProcessHeap () returned 0xd20000 [0101.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0101.145] GetProcessHeap () returned 0xd20000 [0101.145] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0101.145] GetProcessHeap () returned 0xd20000 [0101.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0101.146] GetProcessHeap () returned 0xd20000 [0101.146] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.146] GetProcessHeap () returned 0xd20000 [0101.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.146] GetProcessHeap () returned 0xd20000 [0101.146] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.146] GetProcessHeap () returned 0xd20000 [0101.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.146] GetProcessHeap () returned 0xd20000 [0101.146] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0101.146] GetProcessHeap () returned 0xd20000 [0101.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0101.146] GetProcessHeap () returned 0xd20000 [0101.146] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.146] GetProcessHeap () returned 0xd20000 [0101.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.146] GetProcessHeap () returned 0xd20000 [0101.146] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.146] GetProcessHeap () returned 0xd20000 [0101.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.146] GetProcessHeap () returned 0xd20000 [0101.146] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.147] GetProcessHeap () returned 0xd20000 [0101.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.147] GetProcessHeap () returned 0xd20000 [0101.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0101.147] GetProcessHeap () returned 0xd20000 [0101.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0101.147] GetProcessHeap () returned 0xd20000 [0101.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0101.147] GetProcessHeap () returned 0xd20000 [0101.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0101.147] GetProcessHeap () returned 0xd20000 [0101.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446f0 | out: hHeap=0xd20000) returned 1 [0101.147] GetProcessHeap () returned 0xd20000 [0101.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b758 | out: hHeap=0xd20000) returned 1 [0101.147] GetProcessHeap () returned 0xd20000 [0101.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0101.147] GetProcessHeap () returned 0xd20000 [0101.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0101.147] GetProcessHeap () returned 0xd20000 [0101.148] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0101.148] GetProcessHeap () returned 0xd20000 [0101.148] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0101.148] GetProcessHeap () returned 0xd20000 [0101.148] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0101.148] WriteFile (in: hFile=0x230, lpBuffer=0xd4e168*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e168*, lpNumberOfBytesWritten=0x299d864*=0x389, lpOverlapped=0x0) returned 1 [0101.152] GetProcessHeap () returned 0xd20000 [0101.152] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4e168, Size=0x30) returned 0xd4e168 [0101.153] GetProcessHeap () returned 0xd20000 [0101.153] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0101.153] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0101.153] GetProcessHeap () returned 0xd20000 [0101.153] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x5e0) returned 0xd4e1a0 [0101.153] ReadFile (in: hFile=0x230, lpBuffer=0xd4e1a0, nNumberOfBytesToRead=0x5e0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4e1a0*, lpNumberOfBytesRead=0x299d7e8*=0x5e0, lpOverlapped=0x0) returned 1 [0101.153] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0101.153] WriteFile (in: hFile=0x230, lpBuffer=0xd4e1a0*, nNumberOfBytesToWrite=0x5e0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4e1a0*, lpNumberOfBytesWritten=0x299d7e4*=0x5e0, lpOverlapped=0x0) returned 1 [0101.154] GetProcessHeap () returned 0xd20000 [0101.155] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4e1a0 | out: hHeap=0xd20000) returned 1 [0101.155] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0101.155] WriteFile (in: hFile=0x230, lpBuffer=0xd4e168*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e168*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0101.156] CloseHandle (hObject=0x230) returned 1 [0101.158] GetProcessHeap () returned 0xd20000 [0101.158] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42828 | out: hHeap=0xd20000) returned 1 [0101.158] GetProcessHeap () returned 0xd20000 [0101.158] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c250 | out: hHeap=0xd20000) returned 1 [0101.158] GetProcessHeap () returned 0xd20000 [0101.158] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0101.158] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf") returned="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf" [0101.158] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf.[ponce.lorena@aol.com]" [0101.159] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.inf"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.inf.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0101.159] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386\\nxquery.inf" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386") returned 1 [0101.159] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386\\") returned="" [0101.159] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\i386\\HOW_RECOVER.html" [0101.159] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\i386\\how_recover.html")) returned 0x20 [0101.160] GetProcessHeap () returned 0xd20000 [0101.160] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44420 | out: hHeap=0xd20000) returned 1 [0101.160] FindNextFileW (in: hFindFile=0xd48f20, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b2895, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b2895, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x4eb0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NXQuery.sys", cAlternateFileName="")) returned 1 [0101.160] lstrcmpiW (lpString1="NXQuery.sys", lpString2=".") returned 1 [0101.160] lstrcmpiW (lpString1="NXQuery.sys", lpString2="..") returned 1 [0101.160] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="NXQuery.sys" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys") returned="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys" [0101.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NXQuery.sys", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0101.160] GetProcessHeap () returned 0xd20000 [0101.160] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd44678 [0101.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NXQuery.sys", cchWideChar=-1, lpMultiByteStr=0xd44678, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NXQuery.sys", lpUsedDefaultChar=0x0) returned 12 [0101.160] lstrlenA (lpString="NXQuery.sys") returned 11 [0101.160] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0101.160] lstrlenA (lpString="NXQuery.sys") returned 11 [0101.160] lstrlenA (lpString=".dll") returned 4 [0101.160] lstrlenA (lpString=".dll") returned 4 [0101.160] lstrlenA (lpString="NXQuery.sys") returned 11 [0101.160] lstrcmpiA (lpString1=".sys", lpString2=".dll") returned 1 [0101.160] lstrlenA (lpString="NXQuery.sys") returned 11 [0101.161] lstrlenA (lpString=".ini") returned 4 [0101.161] lstrlenA (lpString=".ini") returned 4 [0101.161] lstrlenA (lpString="NXQuery.sys") returned 11 [0101.161] lstrcmpiA (lpString1=".sys", lpString2=".ini") returned 1 [0101.161] lstrlenA (lpString="NXQuery.sys") returned 11 [0101.161] lstrlenA (lpString=".inc") returned 4 [0101.161] lstrlenA (lpString=".inc") returned 4 [0101.161] lstrlenA (lpString="NXQuery.sys") returned 11 [0101.161] lstrcmpiA (lpString1=".sys", lpString2=".inc") returned 1 [0101.161] lstrcmpiW (lpString1="NXQuery.sys", lpString2="HOW_RECOVER.html") returned 1 [0101.161] lstrcmpiW (lpString1="NXQuery.sys", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0101.161] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0101.161] lstrcmpiW (lpString1="NXQuery.sys", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0101.161] GetProcessHeap () returned 0xd20000 [0101.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42558 [0101.161] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0101.162] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=20144) returned 1 [0101.162] GetProcessHeap () returned 0xd20000 [0101.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c160 [0101.162] GetProcessHeap () returned 0xd20000 [0101.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0101.162] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys") returned 46 [0101.162] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0101.162] GetProcessHeap () returned 0xd20000 [0101.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0101.162] GetProcessHeap () returned 0xd20000 [0101.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4e1a0 [0101.163] lstrlenA (lpString="rsa_encrypt") returned 11 [0101.163] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0101.165] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0101.165] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0101.165] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0101.165] GetProcessHeap () returned 0xd20000 [0101.165] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0101.165] lstrlenA (lpString="010001") returned 6 [0101.165] GetProcessHeap () returned 0xd20000 [0101.165] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd88 [0101.165] GetProcessHeap () returned 0xd20000 [0101.165] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0101.165] GetProcessHeap () returned 0xd20000 [0101.165] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aca8 [0101.165] GetProcessHeap () returned 0xd20000 [0101.165] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0101.165] GetProcessHeap () returned 0xd20000 [0101.165] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b6c8 [0101.165] GetProcessHeap () returned 0xd20000 [0101.165] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44b50 [0101.165] GetProcessHeap () returned 0xd20000 [0101.166] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd28 [0101.166] GetProcessHeap () returned 0xd20000 [0101.166] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44c68 [0101.166] GetProcessHeap () returned 0xd20000 [0101.166] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0101.166] GetProcessHeap () returned 0xd20000 [0101.166] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0101.166] GetProcessHeap () returned 0xd20000 [0101.166] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0101.166] GetProcessHeap () returned 0xd20000 [0101.166] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd45410 [0101.166] GetProcessHeap () returned 0xd20000 [0101.166] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0101.166] GetProcessHeap () returned 0xd20000 [0101.166] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446c0 [0101.166] GetProcessHeap () returned 0xd20000 [0101.166] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0101.166] GetProcessHeap () returned 0xd20000 [0101.166] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0101.166] GetProcessHeap () returned 0xd20000 [0101.166] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0101.166] GetProcessHeap () returned 0xd20000 [0101.166] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0101.167] GetProcessHeap () returned 0xd20000 [0101.167] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0101.167] GetProcessHeap () returned 0xd20000 [0101.167] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44630 [0101.167] GetProcessHeap () returned 0xd20000 [0101.167] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0101.167] GetProcessHeap () returned 0xd20000 [0101.167] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0101.167] GetProcessHeap () returned 0xd20000 [0101.167] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.167] GetProcessHeap () returned 0xd20000 [0101.167] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.167] GetProcessHeap () returned 0xd20000 [0101.167] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0101.167] GetProcessHeap () returned 0xd20000 [0101.167] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0101.167] GetProcessHeap () returned 0xd20000 [0101.167] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b3f8 [0101.167] GetProcessHeap () returned 0xd20000 [0101.167] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44630 | out: hHeap=0xd20000) returned 1 [0101.167] GetProcessHeap () returned 0xd20000 [0101.167] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0101.167] GetProcessHeap () returned 0xd20000 [0101.168] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b3f8 | out: hHeap=0xd20000) returned 1 [0101.168] GetProcessHeap () returned 0xd20000 [0101.168] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0101.168] GetProcessHeap () returned 0xd20000 [0101.168] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0101.168] GetProcessHeap () returned 0xd20000 [0101.168] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.168] GetProcessHeap () returned 0xd20000 [0101.168] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.168] GetProcessHeap () returned 0xd20000 [0101.168] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0101.168] GetProcessHeap () returned 0xd20000 [0101.168] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0101.168] GetProcessHeap () returned 0xd20000 [0101.168] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0101.168] GetProcessHeap () returned 0xd20000 [0101.168] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0101.168] GetProcessHeap () returned 0xd20000 [0101.168] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.168] GetProcessHeap () returned 0xd20000 [0101.168] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.168] GetProcessHeap () returned 0xd20000 [0101.168] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.169] GetProcessHeap () returned 0xd20000 [0101.169] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.169] GetProcessHeap () returned 0xd20000 [0101.169] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0101.169] GetProcessHeap () returned 0xd20000 [0101.169] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0101.169] GetProcessHeap () returned 0xd20000 [0101.169] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.169] GetProcessHeap () returned 0xd20000 [0101.169] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.169] GetProcessHeap () returned 0xd20000 [0101.169] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0101.169] GetProcessHeap () returned 0xd20000 [0101.169] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0101.169] GetProcessHeap () returned 0xd20000 [0101.169] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0101.169] GetProcessHeap () returned 0xd20000 [0101.169] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0101.169] GetProcessHeap () returned 0xd20000 [0101.169] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0101.169] GetProcessHeap () returned 0xd20000 [0101.170] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0101.170] GetProcessHeap () returned 0xd20000 [0101.170] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.170] GetProcessHeap () returned 0xd20000 [0101.170] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.170] GetProcessHeap () returned 0xd20000 [0101.170] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.170] GetProcessHeap () returned 0xd20000 [0101.170] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.170] GetProcessHeap () returned 0xd20000 [0101.170] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0101.170] GetProcessHeap () returned 0xd20000 [0101.170] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0101.170] GetProcessHeap () returned 0xd20000 [0101.170] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.170] GetProcessHeap () returned 0xd20000 [0101.170] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.170] GetProcessHeap () returned 0xd20000 [0101.170] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.170] GetProcessHeap () returned 0xd20000 [0101.170] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.170] GetProcessHeap () returned 0xd20000 [0101.171] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.171] GetProcessHeap () returned 0xd20000 [0101.171] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.171] GetProcessHeap () returned 0xd20000 [0101.171] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.171] GetProcessHeap () returned 0xd20000 [0101.171] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.171] GetProcessHeap () returned 0xd20000 [0101.171] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0101.171] GetProcessHeap () returned 0xd20000 [0101.171] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0101.171] GetProcessHeap () returned 0xd20000 [0101.171] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0101.171] GetProcessHeap () returned 0xd20000 [0101.171] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0101.171] GetProcessHeap () returned 0xd20000 [0101.171] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.171] GetProcessHeap () returned 0xd20000 [0101.171] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.171] GetProcessHeap () returned 0xd20000 [0101.172] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0101.172] GetProcessHeap () returned 0xd20000 [0101.172] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0101.172] GetProcessHeap () returned 0xd20000 [0101.172] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0101.172] GetProcessHeap () returned 0xd20000 [0101.172] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0101.172] GetProcessHeap () returned 0xd20000 [0101.172] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0101.172] GetProcessHeap () returned 0xd20000 [0101.172] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0101.172] GetProcessHeap () returned 0xd20000 [0101.172] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0101.172] GetProcessHeap () returned 0xd20000 [0101.172] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0101.172] GetProcessHeap () returned 0xd20000 [0101.172] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0101.172] GetProcessHeap () returned 0xd20000 [0101.172] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0101.172] GetProcessHeap () returned 0xd20000 [0101.172] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0101.173] GetProcessHeap () returned 0xd20000 [0101.173] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0101.173] GetProcessHeap () returned 0xd20000 [0101.173] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.173] GetProcessHeap () returned 0xd20000 [0101.173] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.173] GetProcessHeap () returned 0xd20000 [0101.173] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.173] GetProcessHeap () returned 0xd20000 [0101.173] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.173] GetProcessHeap () returned 0xd20000 [0101.173] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.173] GetProcessHeap () returned 0xd20000 [0101.173] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.173] GetProcessHeap () returned 0xd20000 [0101.173] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0101.173] GetProcessHeap () returned 0xd20000 [0101.173] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0101.173] GetProcessHeap () returned 0xd20000 [0101.173] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0101.174] GetProcessHeap () returned 0xd20000 [0101.174] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0101.174] GetProcessHeap () returned 0xd20000 [0101.174] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0101.175] GetProcessHeap () returned 0xd20000 [0101.175] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0101.175] GetProcessHeap () returned 0xd20000 [0101.175] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.175] GetProcessHeap () returned 0xd20000 [0101.175] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.175] GetProcessHeap () returned 0xd20000 [0101.175] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0101.175] GetProcessHeap () returned 0xd20000 [0101.175] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0101.175] GetProcessHeap () returned 0xd20000 [0101.175] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0101.175] GetProcessHeap () returned 0xd20000 [0101.175] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0101.175] GetProcessHeap () returned 0xd20000 [0101.175] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0101.175] GetProcessHeap () returned 0xd20000 [0101.176] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0101.176] GetProcessHeap () returned 0xd20000 [0101.176] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0101.176] GetProcessHeap () returned 0xd20000 [0101.176] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0101.176] GetProcessHeap () returned 0xd20000 [0101.176] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0101.176] GetProcessHeap () returned 0xd20000 [0101.176] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0101.176] GetProcessHeap () returned 0xd20000 [0101.176] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0101.176] GetProcessHeap () returned 0xd20000 [0101.176] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0101.176] GetProcessHeap () returned 0xd20000 [0101.176] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0101.176] GetProcessHeap () returned 0xd20000 [0101.176] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0101.177] GetProcessHeap () returned 0xd20000 [0101.177] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.177] GetProcessHeap () returned 0xd20000 [0101.177] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.177] GetProcessHeap () returned 0xd20000 [0101.177] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.177] GetProcessHeap () returned 0xd20000 [0101.177] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.177] GetProcessHeap () returned 0xd20000 [0101.177] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.177] GetProcessHeap () returned 0xd20000 [0101.177] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.177] GetProcessHeap () returned 0xd20000 [0101.177] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.177] GetProcessHeap () returned 0xd20000 [0101.177] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.178] GetProcessHeap () returned 0xd20000 [0101.178] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0101.178] GetProcessHeap () returned 0xd20000 [0101.178] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0101.178] GetProcessHeap () returned 0xd20000 [0101.178] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0101.178] GetProcessHeap () returned 0xd20000 [0101.178] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0101.178] GetProcessHeap () returned 0xd20000 [0101.178] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0101.178] GetProcessHeap () returned 0xd20000 [0101.178] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0101.178] GetProcessHeap () returned 0xd20000 [0101.178] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.178] GetProcessHeap () returned 0xd20000 [0101.178] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.179] GetProcessHeap () returned 0xd20000 [0101.179] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0101.179] GetProcessHeap () returned 0xd20000 [0101.179] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0101.179] GetProcessHeap () returned 0xd20000 [0101.179] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.179] GetProcessHeap () returned 0xd20000 [0101.179] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.179] GetProcessHeap () returned 0xd20000 [0101.179] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0101.179] GetProcessHeap () returned 0xd20000 [0101.179] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0101.179] GetProcessHeap () returned 0xd20000 [0101.179] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.179] GetProcessHeap () returned 0xd20000 [0101.179] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.179] GetProcessHeap () returned 0xd20000 [0101.179] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0101.180] GetProcessHeap () returned 0xd20000 [0101.180] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0101.180] GetProcessHeap () returned 0xd20000 [0101.180] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.180] GetProcessHeap () returned 0xd20000 [0101.180] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.180] GetProcessHeap () returned 0xd20000 [0101.180] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0101.180] GetProcessHeap () returned 0xd20000 [0101.180] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0101.180] GetProcessHeap () returned 0xd20000 [0101.180] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0101.180] GetProcessHeap () returned 0xd20000 [0101.180] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0101.180] GetProcessHeap () returned 0xd20000 [0101.180] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0101.180] GetProcessHeap () returned 0xd20000 [0101.180] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0101.181] GetProcessHeap () returned 0xd20000 [0101.181] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0101.181] GetProcessHeap () returned 0xd20000 [0101.181] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0101.181] GetProcessHeap () returned 0xd20000 [0101.181] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0101.181] GetProcessHeap () returned 0xd20000 [0101.181] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0101.181] GetProcessHeap () returned 0xd20000 [0101.181] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.181] GetProcessHeap () returned 0xd20000 [0101.181] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.181] GetProcessHeap () returned 0xd20000 [0101.181] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.181] GetProcessHeap () returned 0xd20000 [0101.181] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.181] GetProcessHeap () returned 0xd20000 [0101.182] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.182] GetProcessHeap () returned 0xd20000 [0101.182] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.182] GetProcessHeap () returned 0xd20000 [0101.182] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0101.182] GetProcessHeap () returned 0xd20000 [0101.182] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0101.182] GetProcessHeap () returned 0xd20000 [0101.182] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.182] GetProcessHeap () returned 0xd20000 [0101.182] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.182] GetProcessHeap () returned 0xd20000 [0101.182] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0101.182] GetProcessHeap () returned 0xd20000 [0101.182] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0101.182] GetProcessHeap () returned 0xd20000 [0101.182] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.182] GetProcessHeap () returned 0xd20000 [0101.183] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.183] GetProcessHeap () returned 0xd20000 [0101.183] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0101.183] GetProcessHeap () returned 0xd20000 [0101.183] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0101.183] GetProcessHeap () returned 0xd20000 [0101.183] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.183] GetProcessHeap () returned 0xd20000 [0101.183] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.183] GetProcessHeap () returned 0xd20000 [0101.183] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0101.183] GetProcessHeap () returned 0xd20000 [0101.183] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0101.183] GetProcessHeap () returned 0xd20000 [0101.183] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0101.183] GetProcessHeap () returned 0xd20000 [0101.183] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0101.183] GetProcessHeap () returned 0xd20000 [0101.183] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0101.183] GetProcessHeap () returned 0xd20000 [0101.184] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0101.184] GetProcessHeap () returned 0xd20000 [0101.184] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0101.184] GetProcessHeap () returned 0xd20000 [0101.184] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0101.184] GetProcessHeap () returned 0xd20000 [0101.184] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0101.184] GetProcessHeap () returned 0xd20000 [0101.184] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0101.184] GetProcessHeap () returned 0xd20000 [0101.184] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0101.184] GetProcessHeap () returned 0xd20000 [0101.184] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0101.184] GetProcessHeap () returned 0xd20000 [0101.184] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0101.184] GetProcessHeap () returned 0xd20000 [0101.184] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0101.184] GetProcessHeap () returned 0xd20000 [0101.184] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0101.184] GetProcessHeap () returned 0xd20000 [0101.184] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0101.185] GetProcessHeap () returned 0xd20000 [0101.185] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0101.185] GetProcessHeap () returned 0xd20000 [0101.185] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0101.185] GetProcessHeap () returned 0xd20000 [0101.185] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0101.185] GetProcessHeap () returned 0xd20000 [0101.185] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0101.185] GetProcessHeap () returned 0xd20000 [0101.185] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0101.185] GetProcessHeap () returned 0xd20000 [0101.185] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0101.185] GetProcessHeap () returned 0xd20000 [0101.185] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0101.185] GetProcessHeap () returned 0xd20000 [0101.185] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0101.185] GetProcessHeap () returned 0xd20000 [0101.185] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.185] GetProcessHeap () returned 0xd20000 [0101.185] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.185] GetProcessHeap () returned 0xd20000 [0101.185] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.186] GetProcessHeap () returned 0xd20000 [0101.186] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.186] GetProcessHeap () returned 0xd20000 [0101.186] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.186] GetProcessHeap () returned 0xd20000 [0101.186] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.186] GetProcessHeap () returned 0xd20000 [0101.186] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0101.186] GetProcessHeap () returned 0xd20000 [0101.186] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0101.186] GetProcessHeap () returned 0xd20000 [0101.186] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0101.186] GetProcessHeap () returned 0xd20000 [0101.186] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0101.186] GetProcessHeap () returned 0xd20000 [0101.186] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0101.186] GetProcessHeap () returned 0xd20000 [0101.186] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0101.186] GetProcessHeap () returned 0xd20000 [0101.186] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446c0 | out: hHeap=0xd20000) returned 1 [0101.189] GetProcessHeap () returned 0xd20000 [0101.189] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b6c8 | out: hHeap=0xd20000) returned 1 [0101.189] GetProcessHeap () returned 0xd20000 [0101.189] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0101.189] GetProcessHeap () returned 0xd20000 [0101.189] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aca8 | out: hHeap=0xd20000) returned 1 [0101.189] GetProcessHeap () returned 0xd20000 [0101.189] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0101.189] GetProcessHeap () returned 0xd20000 [0101.189] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.202] GetProcessHeap () returned 0xd20000 [0101.202] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0101.202] WriteFile (in: hFile=0x230, lpBuffer=0xd4e1a0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e1a0*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0101.209] GetProcessHeap () returned 0xd20000 [0101.209] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4e1a0, Size=0x30) returned 0xd4e1a0 [0101.209] GetProcessHeap () returned 0xd20000 [0101.209] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0101.209] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0101.209] GetProcessHeap () returned 0xd20000 [0101.209] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4eb0) returned 0xd4e1d8 [0101.210] ReadFile (in: hFile=0x230, lpBuffer=0xd4e1d8, nNumberOfBytesToRead=0x4eb0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4e1d8*, lpNumberOfBytesRead=0x299d7e8*=0x4eb0, lpOverlapped=0x0) returned 1 [0101.212] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0101.212] WriteFile (in: hFile=0x230, lpBuffer=0xd4e1d8*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4e1d8*, lpNumberOfBytesWritten=0x299d7e4*=0x4eb0, lpOverlapped=0x0) returned 1 [0101.214] GetProcessHeap () returned 0xd20000 [0101.214] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4e1d8 | out: hHeap=0xd20000) returned 1 [0101.214] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0101.215] WriteFile (in: hFile=0x230, lpBuffer=0xd4e1a0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e1a0*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0101.216] CloseHandle (hObject=0x230) returned 1 [0101.223] GetProcessHeap () returned 0xd20000 [0101.223] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42558 | out: hHeap=0xd20000) returned 1 [0101.223] GetProcessHeap () returned 0xd20000 [0101.223] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c160 | out: hHeap=0xd20000) returned 1 [0101.223] GetProcessHeap () returned 0xd20000 [0101.223] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0101.223] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys") returned="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys" [0101.223] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys.[ponce.lorena@aol.com]" [0101.223] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.sys"), lpNewFileName="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\i386\\nxquery.sys.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0101.232] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386\\NXQuery.sys" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386") returned 1 [0101.232] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\i386" | out: pszPath="C:\\Windows10Upgrade\\resources\\i386\\") returned="" [0101.232] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\i386\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\i386\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\i386\\HOW_RECOVER.html" [0101.233] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\i386\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\i386\\how_recover.html")) returned 0x20 [0101.233] GetProcessHeap () returned 0xd20000 [0101.233] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44678 | out: hHeap=0xd20000) returned 1 [0101.233] FindNextFileW (in: hFindFile=0xd48f20, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3b2895, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3b2895, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x4eb0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NXQuery.sys", cAlternateFileName="")) returned 0 [0101.233] FindClose (in: hFindFile=0xd48f20 | out: hFindFile=0xd48f20) returned 1 [0101.233] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Windows10Upgrade\\resources\\amd64\\" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\") returned="C:\\Windows10Upgrade\\resources\\amd64\\" [0101.233] GetProcessHeap () returned 0xd20000 [0101.233] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2e898 | out: hHeap=0xd20000) returned 1 [0101.233] GetProcessHeap () returned 0xd20000 [0101.233] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0101.234] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\amd64\\") returned 36 [0101.234] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\*") returned="C:\\Windows10Upgrade\\resources\\amd64\\*" [0101.234] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a5195, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3a652e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd491a0 [0101.238] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0101.238] FindNextFileW (in: hFindFile=0xd491a0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea398e53, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a5195, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea3a652e, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.238] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0101.238] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0101.238] FindNextFileW (in: hFindFile=0xd491a0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39b5b0, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39b5b0, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x16ebc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BiosBlocks.xml", cAlternateFileName="BIOSBL~1.XML")) returned 1 [0101.238] lstrcmpiW (lpString1="BiosBlocks.xml", lpString2=".") returned 1 [0101.238] lstrcmpiW (lpString1="BiosBlocks.xml", lpString2="..") returned 1 [0101.238] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="BiosBlocks.xml" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml") returned="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" [0101.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BiosBlocks.xml", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0101.239] GetProcessHeap () returned 0xd20000 [0101.239] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd44408 [0101.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BiosBlocks.xml", cchWideChar=-1, lpMultiByteStr=0xd44408, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BiosBlocks.xml", lpUsedDefaultChar=0x0) returned 15 [0101.239] lstrlenA (lpString="BiosBlocks.xml") returned 14 [0101.239] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0101.239] lstrlenA (lpString="BiosBlocks.xml") returned 14 [0101.239] lstrlenA (lpString=".dll") returned 4 [0101.239] lstrlenA (lpString=".dll") returned 4 [0101.239] lstrlenA (lpString="BiosBlocks.xml") returned 14 [0101.239] lstrcmpiA (lpString1=".xml", lpString2=".dll") returned 1 [0101.239] lstrlenA (lpString="BiosBlocks.xml") returned 14 [0101.239] lstrlenA (lpString=".ini") returned 4 [0101.239] lstrlenA (lpString=".ini") returned 4 [0101.239] lstrlenA (lpString="BiosBlocks.xml") returned 14 [0101.239] lstrcmpiA (lpString1=".xml", lpString2=".ini") returned 1 [0101.239] lstrlenA (lpString="BiosBlocks.xml") returned 14 [0101.239] lstrlenA (lpString=".inc") returned 4 [0101.239] lstrlenA (lpString=".inc") returned 4 [0101.240] lstrlenA (lpString="BiosBlocks.xml") returned 14 [0101.240] lstrcmpiA (lpString1=".xml", lpString2=".inc") returned 1 [0101.240] lstrcmpiW (lpString1="BiosBlocks.xml", lpString2="HOW_RECOVER.html") returned -1 [0101.240] lstrcmpiW (lpString1="BiosBlocks.xml", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0101.240] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0101.240] lstrcmpiW (lpString1="BiosBlocks.xml", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0101.240] GetProcessHeap () returned 0xd20000 [0101.240] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42580 [0101.240] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0101.242] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=93884) returned 1 [0101.242] GetProcessHeap () returned 0xd20000 [0101.242] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c0e8 [0101.242] GetProcessHeap () returned 0xd20000 [0101.242] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0101.242] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml") returned 50 [0101.242] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0101.242] GetProcessHeap () returned 0xd20000 [0101.242] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0101.242] GetProcessHeap () returned 0xd20000 [0101.242] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4e1d8 [0101.243] lstrlenA (lpString="rsa_encrypt") returned 11 [0101.243] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0101.245] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0101.245] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0101.245] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0101.245] GetProcessHeap () returned 0xd20000 [0101.245] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0101.245] lstrlenA (lpString="010001") returned 6 [0101.245] GetProcessHeap () returned 0xd20000 [0101.245] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cdb8 [0101.245] GetProcessHeap () returned 0xd20000 [0101.245] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0101.245] GetProcessHeap () returned 0xd20000 [0101.245] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b1b8 [0101.245] GetProcessHeap () returned 0xd20000 [0101.245] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0101.245] GetProcessHeap () returned 0xd20000 [0101.245] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b488 [0101.245] GetProcessHeap () returned 0xd20000 [0101.245] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44c68 [0101.245] GetProcessHeap () returned 0xd20000 [0101.246] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc28 [0101.246] GetProcessHeap () returned 0xd20000 [0101.246] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0101.246] GetProcessHeap () returned 0xd20000 [0101.246] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0101.246] GetProcessHeap () returned 0xd20000 [0101.246] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0101.246] GetProcessHeap () returned 0xd20000 [0101.246] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0101.246] GetProcessHeap () returned 0xd20000 [0101.246] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd45528 [0101.246] GetProcessHeap () returned 0xd20000 [0101.246] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.246] GetProcessHeap () returned 0xd20000 [0101.246] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44468 [0101.246] GetProcessHeap () returned 0xd20000 [0101.246] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b248 [0101.246] GetProcessHeap () returned 0xd20000 [0101.246] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0101.246] GetProcessHeap () returned 0xd20000 [0101.246] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0101.247] GetProcessHeap () returned 0xd20000 [0101.247] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b248 | out: hHeap=0xd20000) returned 1 [0101.247] GetProcessHeap () returned 0xd20000 [0101.247] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0101.247] GetProcessHeap () returned 0xd20000 [0101.247] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446d8 [0101.247] GetProcessHeap () returned 0xd20000 [0101.247] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.247] GetProcessHeap () returned 0xd20000 [0101.247] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0101.247] GetProcessHeap () returned 0xd20000 [0101.247] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.247] GetProcessHeap () returned 0xd20000 [0101.247] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.247] GetProcessHeap () returned 0xd20000 [0101.247] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.247] GetProcessHeap () returned 0xd20000 [0101.247] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.247] GetProcessHeap () returned 0xd20000 [0101.247] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b6c8 [0101.247] GetProcessHeap () returned 0xd20000 [0101.248] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446d8 | out: hHeap=0xd20000) returned 1 [0101.248] GetProcessHeap () returned 0xd20000 [0101.248] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0101.248] GetProcessHeap () returned 0xd20000 [0101.248] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b6c8 | out: hHeap=0xd20000) returned 1 [0101.248] GetProcessHeap () returned 0xd20000 [0101.248] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0101.248] GetProcessHeap () returned 0xd20000 [0101.248] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0101.248] GetProcessHeap () returned 0xd20000 [0101.248] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0101.248] GetProcessHeap () returned 0xd20000 [0101.248] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0101.248] GetProcessHeap () returned 0xd20000 [0101.248] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.248] GetProcessHeap () returned 0xd20000 [0101.248] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.248] GetProcessHeap () returned 0xd20000 [0101.248] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0101.248] GetProcessHeap () returned 0xd20000 [0101.248] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0101.248] GetProcessHeap () returned 0xd20000 [0101.249] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0101.249] GetProcessHeap () returned 0xd20000 [0101.249] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0101.249] GetProcessHeap () returned 0xd20000 [0101.249] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.249] GetProcessHeap () returned 0xd20000 [0101.249] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.249] GetProcessHeap () returned 0xd20000 [0101.249] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0101.249] GetProcessHeap () returned 0xd20000 [0101.249] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0101.249] GetProcessHeap () returned 0xd20000 [0101.249] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0101.249] GetProcessHeap () returned 0xd20000 [0101.249] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0101.249] GetProcessHeap () returned 0xd20000 [0101.249] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.249] GetProcessHeap () returned 0xd20000 [0101.249] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.249] GetProcessHeap () returned 0xd20000 [0101.250] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0101.250] GetProcessHeap () returned 0xd20000 [0101.250] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0101.250] GetProcessHeap () returned 0xd20000 [0101.250] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0101.250] GetProcessHeap () returned 0xd20000 [0101.250] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0101.250] GetProcessHeap () returned 0xd20000 [0101.250] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0101.250] GetProcessHeap () returned 0xd20000 [0101.250] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0101.250] GetProcessHeap () returned 0xd20000 [0101.250] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.250] GetProcessHeap () returned 0xd20000 [0101.250] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.250] GetProcessHeap () returned 0xd20000 [0101.250] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0101.250] GetProcessHeap () returned 0xd20000 [0101.250] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0101.250] GetProcessHeap () returned 0xd20000 [0101.250] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.251] GetProcessHeap () returned 0xd20000 [0101.251] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.251] GetProcessHeap () returned 0xd20000 [0101.251] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0101.251] GetProcessHeap () returned 0xd20000 [0101.251] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0101.251] GetProcessHeap () returned 0xd20000 [0101.251] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0101.251] GetProcessHeap () returned 0xd20000 [0101.251] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0101.251] GetProcessHeap () returned 0xd20000 [0101.251] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0101.251] GetProcessHeap () returned 0xd20000 [0101.251] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0101.251] GetProcessHeap () returned 0xd20000 [0101.251] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0101.251] GetProcessHeap () returned 0xd20000 [0101.251] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0101.251] GetProcessHeap () returned 0xd20000 [0101.251] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.252] GetProcessHeap () returned 0xd20000 [0101.252] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.252] GetProcessHeap () returned 0xd20000 [0101.252] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0101.252] GetProcessHeap () returned 0xd20000 [0101.252] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0101.252] GetProcessHeap () returned 0xd20000 [0101.252] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0101.252] GetProcessHeap () returned 0xd20000 [0101.252] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0101.252] GetProcessHeap () returned 0xd20000 [0101.252] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.252] GetProcessHeap () returned 0xd20000 [0101.252] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.252] GetProcessHeap () returned 0xd20000 [0101.252] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0101.252] GetProcessHeap () returned 0xd20000 [0101.252] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0101.252] GetProcessHeap () returned 0xd20000 [0101.252] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0101.253] GetProcessHeap () returned 0xd20000 [0101.253] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0101.253] GetProcessHeap () returned 0xd20000 [0101.253] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0101.253] GetProcessHeap () returned 0xd20000 [0101.253] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0101.253] GetProcessHeap () returned 0xd20000 [0101.253] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.253] GetProcessHeap () returned 0xd20000 [0101.253] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.253] GetProcessHeap () returned 0xd20000 [0101.253] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.253] GetProcessHeap () returned 0xd20000 [0101.253] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.253] GetProcessHeap () returned 0xd20000 [0101.253] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.253] GetProcessHeap () returned 0xd20000 [0101.253] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.254] GetProcessHeap () returned 0xd20000 [0101.254] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.254] GetProcessHeap () returned 0xd20000 [0101.254] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.254] GetProcessHeap () returned 0xd20000 [0101.254] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.254] GetProcessHeap () returned 0xd20000 [0101.254] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.254] GetProcessHeap () returned 0xd20000 [0101.254] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.254] GetProcessHeap () returned 0xd20000 [0101.254] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.254] GetProcessHeap () returned 0xd20000 [0101.254] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.254] GetProcessHeap () returned 0xd20000 [0101.254] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.254] GetProcessHeap () returned 0xd20000 [0101.254] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0101.255] GetProcessHeap () returned 0xd20000 [0101.255] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0101.255] GetProcessHeap () returned 0xd20000 [0101.255] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.255] GetProcessHeap () returned 0xd20000 [0101.255] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.255] GetProcessHeap () returned 0xd20000 [0101.255] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.255] GetProcessHeap () returned 0xd20000 [0101.255] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.255] GetProcessHeap () returned 0xd20000 [0101.255] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.255] GetProcessHeap () returned 0xd20000 [0101.255] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.255] GetProcessHeap () returned 0xd20000 [0101.255] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0101.255] GetProcessHeap () returned 0xd20000 [0101.255] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0101.256] GetProcessHeap () returned 0xd20000 [0101.256] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0101.256] GetProcessHeap () returned 0xd20000 [0101.256] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0101.256] GetProcessHeap () returned 0xd20000 [0101.256] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0101.256] GetProcessHeap () returned 0xd20000 [0101.256] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0101.256] GetProcessHeap () returned 0xd20000 [0101.256] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.256] GetProcessHeap () returned 0xd20000 [0101.256] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.256] GetProcessHeap () returned 0xd20000 [0101.256] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.256] GetProcessHeap () returned 0xd20000 [0101.256] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.256] GetProcessHeap () returned 0xd20000 [0101.256] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.256] GetProcessHeap () returned 0xd20000 [0101.256] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.256] GetProcessHeap () returned 0xd20000 [0101.256] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.257] GetProcessHeap () returned 0xd20000 [0101.257] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.257] GetProcessHeap () returned 0xd20000 [0101.257] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0101.257] GetProcessHeap () returned 0xd20000 [0101.257] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0101.257] GetProcessHeap () returned 0xd20000 [0101.257] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0101.257] GetProcessHeap () returned 0xd20000 [0101.257] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0101.257] GetProcessHeap () returned 0xd20000 [0101.257] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0101.257] GetProcessHeap () returned 0xd20000 [0101.257] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0101.257] GetProcessHeap () returned 0xd20000 [0101.257] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0101.257] GetProcessHeap () returned 0xd20000 [0101.257] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0101.257] GetProcessHeap () returned 0xd20000 [0101.257] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.257] GetProcessHeap () returned 0xd20000 [0101.258] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.258] GetProcessHeap () returned 0xd20000 [0101.258] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0101.258] GetProcessHeap () returned 0xd20000 [0101.258] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0101.258] GetProcessHeap () returned 0xd20000 [0101.258] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0101.258] GetProcessHeap () returned 0xd20000 [0101.258] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0101.258] GetProcessHeap () returned 0xd20000 [0101.258] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.258] GetProcessHeap () returned 0xd20000 [0101.258] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.258] GetProcessHeap () returned 0xd20000 [0101.258] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0101.258] GetProcessHeap () returned 0xd20000 [0101.258] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0101.258] GetProcessHeap () returned 0xd20000 [0101.258] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0101.259] GetProcessHeap () returned 0xd20000 [0101.259] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0101.259] GetProcessHeap () returned 0xd20000 [0101.259] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0101.259] GetProcessHeap () returned 0xd20000 [0101.259] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0101.259] GetProcessHeap () returned 0xd20000 [0101.259] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.259] GetProcessHeap () returned 0xd20000 [0101.259] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.259] GetProcessHeap () returned 0xd20000 [0101.259] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0101.259] GetProcessHeap () returned 0xd20000 [0101.259] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0101.259] GetProcessHeap () returned 0xd20000 [0101.259] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0101.259] GetProcessHeap () returned 0xd20000 [0101.259] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0101.260] GetProcessHeap () returned 0xd20000 [0101.260] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0101.260] GetProcessHeap () returned 0xd20000 [0101.260] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0101.260] GetProcessHeap () returned 0xd20000 [0101.260] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0101.260] GetProcessHeap () returned 0xd20000 [0101.260] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0101.260] GetProcessHeap () returned 0xd20000 [0101.260] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.260] GetProcessHeap () returned 0xd20000 [0101.260] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.260] GetProcessHeap () returned 0xd20000 [0101.260] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0101.260] GetProcessHeap () returned 0xd20000 [0101.260] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0101.260] GetProcessHeap () returned 0xd20000 [0101.260] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0101.260] GetProcessHeap () returned 0xd20000 [0101.260] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0101.261] GetProcessHeap () returned 0xd20000 [0101.261] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0101.261] GetProcessHeap () returned 0xd20000 [0101.261] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0101.261] GetProcessHeap () returned 0xd20000 [0101.261] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.261] GetProcessHeap () returned 0xd20000 [0101.261] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.261] GetProcessHeap () returned 0xd20000 [0101.261] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.261] GetProcessHeap () returned 0xd20000 [0101.261] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.261] GetProcessHeap () returned 0xd20000 [0101.261] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0101.261] GetProcessHeap () returned 0xd20000 [0101.261] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0101.261] GetProcessHeap () returned 0xd20000 [0101.262] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.262] GetProcessHeap () returned 0xd20000 [0101.262] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.262] GetProcessHeap () returned 0xd20000 [0101.262] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.262] GetProcessHeap () returned 0xd20000 [0101.262] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.262] GetProcessHeap () returned 0xd20000 [0101.262] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.262] GetProcessHeap () returned 0xd20000 [0101.262] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.262] GetProcessHeap () returned 0xd20000 [0101.262] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0101.262] GetProcessHeap () returned 0xd20000 [0101.262] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0101.262] GetProcessHeap () returned 0xd20000 [0101.262] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0101.262] GetProcessHeap () returned 0xd20000 [0101.263] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0101.263] GetProcessHeap () returned 0xd20000 [0101.263] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.263] GetProcessHeap () returned 0xd20000 [0101.263] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.263] GetProcessHeap () returned 0xd20000 [0101.263] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0101.263] GetProcessHeap () returned 0xd20000 [0101.263] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0101.263] GetProcessHeap () returned 0xd20000 [0101.263] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.263] GetProcessHeap () returned 0xd20000 [0101.263] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.263] GetProcessHeap () returned 0xd20000 [0101.263] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.263] GetProcessHeap () returned 0xd20000 [0101.263] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.263] GetProcessHeap () returned 0xd20000 [0101.264] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0101.264] GetProcessHeap () returned 0xd20000 [0101.264] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0101.264] GetProcessHeap () returned 0xd20000 [0101.264] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.264] GetProcessHeap () returned 0xd20000 [0101.264] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.264] GetProcessHeap () returned 0xd20000 [0101.264] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.264] GetProcessHeap () returned 0xd20000 [0101.264] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.264] GetProcessHeap () returned 0xd20000 [0101.264] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.264] GetProcessHeap () returned 0xd20000 [0101.264] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.264] GetProcessHeap () returned 0xd20000 [0101.264] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.264] GetProcessHeap () returned 0xd20000 [0101.265] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.265] GetProcessHeap () returned 0xd20000 [0101.265] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0101.265] GetProcessHeap () returned 0xd20000 [0101.265] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0101.265] GetProcessHeap () returned 0xd20000 [0101.265] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0101.265] GetProcessHeap () returned 0xd20000 [0101.265] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0101.265] GetProcessHeap () returned 0xd20000 [0101.265] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0101.265] GetProcessHeap () returned 0xd20000 [0101.265] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0101.265] GetProcessHeap () returned 0xd20000 [0101.265] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.265] GetProcessHeap () returned 0xd20000 [0101.265] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.265] GetProcessHeap () returned 0xd20000 [0101.265] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0101.266] GetProcessHeap () returned 0xd20000 [0101.266] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0101.266] GetProcessHeap () returned 0xd20000 [0101.266] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0101.266] GetProcessHeap () returned 0xd20000 [0101.266] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0101.266] GetProcessHeap () returned 0xd20000 [0101.266] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44468 | out: hHeap=0xd20000) returned 1 [0101.266] GetProcessHeap () returned 0xd20000 [0101.266] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b488 | out: hHeap=0xd20000) returned 1 [0101.266] GetProcessHeap () returned 0xd20000 [0101.266] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0101.266] GetProcessHeap () returned 0xd20000 [0101.266] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b1b8 | out: hHeap=0xd20000) returned 1 [0101.266] GetProcessHeap () returned 0xd20000 [0101.266] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0101.266] GetProcessHeap () returned 0xd20000 [0101.266] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0101.267] GetProcessHeap () returned 0xd20000 [0101.267] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0101.267] WriteFile (in: hFile=0x230, lpBuffer=0xd4e1d8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e1d8*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0101.274] GetProcessHeap () returned 0xd20000 [0101.274] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4e1d8, Size=0x30) returned 0xd4e1d8 [0101.274] GetProcessHeap () returned 0xd20000 [0101.274] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0101.274] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0101.274] GetProcessHeap () returned 0xd20000 [0101.274] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x16ebc) returned 0xd4e210 [0101.277] ReadFile (in: hFile=0x230, lpBuffer=0xd4e210, nNumberOfBytesToRead=0x16ebc, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4e210*, lpNumberOfBytesRead=0x299d7e8*=0x16ebc, lpOverlapped=0x0) returned 1 [0101.281] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0101.281] WriteFile (in: hFile=0x230, lpBuffer=0xd4e210*, nNumberOfBytesToWrite=0x16ebc, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4e210*, lpNumberOfBytesWritten=0x299d7e4*=0x16ebc, lpOverlapped=0x0) returned 1 [0101.285] GetProcessHeap () returned 0xd20000 [0101.285] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4e210 | out: hHeap=0xd20000) returned 1 [0101.285] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0101.285] WriteFile (in: hFile=0x230, lpBuffer=0xd4e1d8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e1d8*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0101.287] CloseHandle (hObject=0x230) returned 1 [0101.293] GetProcessHeap () returned 0xd20000 [0101.293] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42580 | out: hHeap=0xd20000) returned 1 [0101.293] GetProcessHeap () returned 0xd20000 [0101.293] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c0e8 | out: hHeap=0xd20000) returned 1 [0101.293] GetProcessHeap () returned 0xd20000 [0101.293] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0101.293] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml") returned="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" [0101.293] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml.[ponce.lorena@aol.com]" [0101.294] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\amd64\\biosblocks.xml.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0101.294] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\BiosBlocks.xml" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64") returned 1 [0101.295] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\") returned="" [0101.295] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\amd64\\HOW_RECOVER.html" [0101.295] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\amd64\\how_recover.html")) returned 0xffffffff [0101.295] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\amd64\\how_recover.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0101.295] GetProcessHeap () returned 0xd20000 [0101.295] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bf08 [0101.295] GetProcessHeap () returned 0xd20000 [0101.295] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0101.309] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.311] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.311] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.311] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.311] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.312] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.312] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.312] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.312] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.312] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.312] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.312] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.313] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.313] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.313] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.313] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.313] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.313] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.313] GetProcessHeap () returned 0xd20000 [0101.313] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bf08 | out: hHeap=0xd20000) returned 1 [0101.313] GetProcessHeap () returned 0xd20000 [0101.314] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0101.314] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x299d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x299d9d0*=0x300, lpOverlapped=0x0) returned 1 [0101.315] GetProcessHeap () returned 0xd20000 [0101.315] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4be18 [0101.315] GetProcessHeap () returned 0xd20000 [0101.316] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0101.329] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.329] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.329] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.329] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.329] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.329] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.330] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.330] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.330] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.823] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.824] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.824] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.824] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.824] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.824] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.824] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.824] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.825] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.825] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.825] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.825] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.825] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.825] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.825] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.825] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.826] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.826] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.826] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.826] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.826] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.826] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.826] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.826] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.827] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.827] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.827] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.836] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.836] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.836] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.837] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.837] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.837] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.837] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.837] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.837] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.837] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.837] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.838] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.838] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.838] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.838] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.838] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.838] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.838] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.838] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.839] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.839] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.839] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.839] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.839] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.839] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.839] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.839] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.840] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.840] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.840] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.840] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.840] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.840] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.840] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.840] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.841] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.841] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.841] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.841] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.841] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.841] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.841] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.842] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.842] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.842] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.842] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.842] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.842] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.842] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.842] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.843] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.843] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.843] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.843] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.843] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.843] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.843] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.843] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.844] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.844] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.844] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.844] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.844] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.844] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.844] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.845] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.845] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.845] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.845] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.845] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.845] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.845] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.848] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.848] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0101.848] GetProcessHeap () returned 0xd20000 [0101.848] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4be18 | out: hHeap=0xd20000) returned 1 [0101.848] GetProcessHeap () returned 0xd20000 [0101.848] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0101.848] CloseHandle (hObject=0x230) returned 1 [0101.849] GetProcessHeap () returned 0xd20000 [0101.849] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44408 | out: hHeap=0xd20000) returned 1 [0101.849] FindNextFileW (in: hFindFile=0xd491a0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39c8ec, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39c8ec, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x11daf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hwcompat.txt", cAlternateFileName="")) returned 1 [0101.849] lstrcmpiW (lpString1="hwcompat.txt", lpString2=".") returned 1 [0101.849] lstrcmpiW (lpString1="hwcompat.txt", lpString2="..") returned 1 [0101.849] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="hwcompat.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt") returned="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" [0101.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwcompat.txt", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0101.850] GetProcessHeap () returned 0xd20000 [0101.850] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xd) returned 0xd44408 [0101.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwcompat.txt", cchWideChar=-1, lpMultiByteStr=0xd44408, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwcompat.txt", lpUsedDefaultChar=0x0) returned 13 [0101.850] lstrlenA (lpString="hwcompat.txt") returned 12 [0101.850] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0101.850] lstrlenA (lpString="hwcompat.txt") returned 12 [0101.850] lstrlenA (lpString=".dll") returned 4 [0101.850] lstrlenA (lpString=".dll") returned 4 [0101.850] lstrlenA (lpString="hwcompat.txt") returned 12 [0101.850] lstrcmpiA (lpString1=".txt", lpString2=".dll") returned 1 [0101.850] lstrlenA (lpString="hwcompat.txt") returned 12 [0101.850] lstrlenA (lpString=".ini") returned 4 [0101.850] lstrlenA (lpString=".ini") returned 4 [0101.850] lstrlenA (lpString="hwcompat.txt") returned 12 [0101.850] lstrcmpiA (lpString1=".txt", lpString2=".ini") returned 1 [0101.850] lstrlenA (lpString="hwcompat.txt") returned 12 [0101.850] lstrlenA (lpString=".inc") returned 4 [0101.850] lstrlenA (lpString=".inc") returned 4 [0101.851] lstrlenA (lpString="hwcompat.txt") returned 12 [0101.851] lstrcmpiA (lpString1=".txt", lpString2=".inc") returned 1 [0101.851] lstrcmpiW (lpString1="hwcompat.txt", lpString2="HOW_RECOVER.html") returned 1 [0101.851] lstrcmpiW (lpString1="hwcompat.txt", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0101.851] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0101.851] lstrcmpiW (lpString1="hwcompat.txt", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0101.851] GetProcessHeap () returned 0xd20000 [0101.851] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42828 [0101.851] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0101.852] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=73135) returned 1 [0101.852] GetProcessHeap () returned 0xd20000 [0101.852] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c0e8 [0101.852] GetProcessHeap () returned 0xd20000 [0101.852] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0101.852] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt") returned 48 [0101.852] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0101.852] GetProcessHeap () returned 0xd20000 [0101.852] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0101.852] GetProcessHeap () returned 0xd20000 [0101.853] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x381) returned 0xd4e210 [0101.853] lstrlenA (lpString="rsa_encrypt") returned 11 [0101.853] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0101.855] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0101.855] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0101.855] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0101.855] GetProcessHeap () returned 0xd20000 [0101.855] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0101.855] lstrlenA (lpString="010001") returned 6 [0101.856] GetProcessHeap () returned 0xd20000 [0101.856] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0101.856] GetProcessHeap () returned 0xd20000 [0101.856] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0101.856] GetProcessHeap () returned 0xd20000 [0101.856] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b7e8 [0101.856] GetProcessHeap () returned 0xd20000 [0101.856] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0101.856] GetProcessHeap () returned 0xd20000 [0101.856] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b758 [0101.856] GetProcessHeap () returned 0xd20000 [0101.856] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44fb0 [0101.856] GetProcessHeap () returned 0xd20000 [0101.856] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd18 [0101.856] GetProcessHeap () returned 0xd20000 [0101.856] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0101.856] GetProcessHeap () returned 0xd20000 [0101.856] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0101.856] GetProcessHeap () returned 0xd20000 [0101.856] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0101.857] GetProcessHeap () returned 0xd20000 [0101.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0101.857] GetProcessHeap () returned 0xd20000 [0101.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44a38 [0101.857] GetProcessHeap () returned 0xd20000 [0101.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0101.857] GetProcessHeap () returned 0xd20000 [0101.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446d8 [0101.857] GetProcessHeap () returned 0xd20000 [0101.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b128 [0101.857] GetProcessHeap () returned 0xd20000 [0101.857] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0101.857] GetProcessHeap () returned 0xd20000 [0101.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0101.857] GetProcessHeap () returned 0xd20000 [0101.857] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b128 | out: hHeap=0xd20000) returned 1 [0101.857] GetProcessHeap () returned 0xd20000 [0101.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0101.857] GetProcessHeap () returned 0xd20000 [0101.858] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444f8 [0101.858] GetProcessHeap () returned 0xd20000 [0101.858] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0101.858] GetProcessHeap () returned 0xd20000 [0101.858] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0101.858] GetProcessHeap () returned 0xd20000 [0101.858] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.858] GetProcessHeap () returned 0xd20000 [0101.858] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.858] GetProcessHeap () returned 0xd20000 [0101.858] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.858] GetProcessHeap () returned 0xd20000 [0101.858] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.858] GetProcessHeap () returned 0xd20000 [0101.858] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b248 [0101.858] GetProcessHeap () returned 0xd20000 [0101.858] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444f8 | out: hHeap=0xd20000) returned 1 [0101.858] GetProcessHeap () returned 0xd20000 [0101.858] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0101.858] GetProcessHeap () returned 0xd20000 [0101.858] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b248 | out: hHeap=0xd20000) returned 1 [0101.859] GetProcessHeap () returned 0xd20000 [0101.859] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0101.859] GetProcessHeap () returned 0xd20000 [0101.859] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0101.859] GetProcessHeap () returned 0xd20000 [0101.859] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.859] GetProcessHeap () returned 0xd20000 [0101.859] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.859] GetProcessHeap () returned 0xd20000 [0101.859] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0101.859] GetProcessHeap () returned 0xd20000 [0101.859] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0101.859] GetProcessHeap () returned 0xd20000 [0101.859] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0101.859] GetProcessHeap () returned 0xd20000 [0101.859] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0101.859] GetProcessHeap () returned 0xd20000 [0101.859] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.859] GetProcessHeap () returned 0xd20000 [0101.859] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.860] GetProcessHeap () returned 0xd20000 [0101.860] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0101.860] GetProcessHeap () returned 0xd20000 [0101.860] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0101.860] GetProcessHeap () returned 0xd20000 [0101.860] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.860] GetProcessHeap () returned 0xd20000 [0101.860] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.860] GetProcessHeap () returned 0xd20000 [0101.860] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.860] GetProcessHeap () returned 0xd20000 [0101.860] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.860] GetProcessHeap () returned 0xd20000 [0101.860] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0101.860] GetProcessHeap () returned 0xd20000 [0101.860] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0101.860] GetProcessHeap () returned 0xd20000 [0101.860] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0101.860] GetProcessHeap () returned 0xd20000 [0101.861] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0101.861] GetProcessHeap () returned 0xd20000 [0101.861] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0101.861] GetProcessHeap () returned 0xd20000 [0101.861] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0101.861] GetProcessHeap () returned 0xd20000 [0101.861] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0101.861] GetProcessHeap () returned 0xd20000 [0101.861] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0101.861] GetProcessHeap () returned 0xd20000 [0101.861] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0101.861] GetProcessHeap () returned 0xd20000 [0101.861] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0101.861] GetProcessHeap () returned 0xd20000 [0101.861] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0101.861] GetProcessHeap () returned 0xd20000 [0101.862] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0101.862] GetProcessHeap () returned 0xd20000 [0101.862] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.862] GetProcessHeap () returned 0xd20000 [0101.862] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.862] GetProcessHeap () returned 0xd20000 [0101.862] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0101.862] GetProcessHeap () returned 0xd20000 [0101.862] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0101.862] GetProcessHeap () returned 0xd20000 [0101.862] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0101.862] GetProcessHeap () returned 0xd20000 [0101.862] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0101.862] GetProcessHeap () returned 0xd20000 [0101.862] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0101.862] GetProcessHeap () returned 0xd20000 [0101.862] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0101.862] GetProcessHeap () returned 0xd20000 [0101.862] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0101.862] GetProcessHeap () returned 0xd20000 [0101.863] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0101.863] GetProcessHeap () returned 0xd20000 [0101.863] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0101.863] GetProcessHeap () returned 0xd20000 [0101.863] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0101.863] GetProcessHeap () returned 0xd20000 [0101.863] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0101.863] GetProcessHeap () returned 0xd20000 [0101.863] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0101.863] GetProcessHeap () returned 0xd20000 [0101.863] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0101.863] GetProcessHeap () returned 0xd20000 [0101.863] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0101.863] GetProcessHeap () returned 0xd20000 [0101.863] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.863] GetProcessHeap () returned 0xd20000 [0101.863] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.863] GetProcessHeap () returned 0xd20000 [0101.863] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0101.863] GetProcessHeap () returned 0xd20000 [0101.864] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0101.864] GetProcessHeap () returned 0xd20000 [0101.864] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.864] GetProcessHeap () returned 0xd20000 [0101.864] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.864] GetProcessHeap () returned 0xd20000 [0101.864] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0101.864] GetProcessHeap () returned 0xd20000 [0101.864] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0101.864] GetProcessHeap () returned 0xd20000 [0101.864] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0101.864] GetProcessHeap () returned 0xd20000 [0101.864] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0101.864] GetProcessHeap () returned 0xd20000 [0101.864] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.864] GetProcessHeap () returned 0xd20000 [0101.864] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.864] GetProcessHeap () returned 0xd20000 [0101.864] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0101.865] GetProcessHeap () returned 0xd20000 [0101.865] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0101.865] GetProcessHeap () returned 0xd20000 [0101.865] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0101.865] GetProcessHeap () returned 0xd20000 [0101.865] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0101.865] GetProcessHeap () returned 0xd20000 [0101.865] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0101.865] GetProcessHeap () returned 0xd20000 [0101.865] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0101.865] GetProcessHeap () returned 0xd20000 [0101.865] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0101.865] GetProcessHeap () returned 0xd20000 [0101.865] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0101.865] GetProcessHeap () returned 0xd20000 [0101.865] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0101.865] GetProcessHeap () returned 0xd20000 [0101.865] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0101.865] GetProcessHeap () returned 0xd20000 [0101.865] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.866] GetProcessHeap () returned 0xd20000 [0101.866] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.866] GetProcessHeap () returned 0xd20000 [0101.866] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0101.866] GetProcessHeap () returned 0xd20000 [0101.866] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0101.866] GetProcessHeap () returned 0xd20000 [0101.866] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0101.866] GetProcessHeap () returned 0xd20000 [0101.866] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0101.866] GetProcessHeap () returned 0xd20000 [0101.866] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0101.866] GetProcessHeap () returned 0xd20000 [0101.866] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0101.866] GetProcessHeap () returned 0xd20000 [0101.866] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0101.866] GetProcessHeap () returned 0xd20000 [0101.866] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0101.866] GetProcessHeap () returned 0xd20000 [0101.867] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.867] GetProcessHeap () returned 0xd20000 [0101.867] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.867] GetProcessHeap () returned 0xd20000 [0101.867] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0101.867] GetProcessHeap () returned 0xd20000 [0101.867] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0101.867] GetProcessHeap () returned 0xd20000 [0101.867] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0101.867] GetProcessHeap () returned 0xd20000 [0101.867] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0101.867] GetProcessHeap () returned 0xd20000 [0101.867] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0101.867] GetProcessHeap () returned 0xd20000 [0101.867] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0101.867] GetProcessHeap () returned 0xd20000 [0101.867] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0101.867] GetProcessHeap () returned 0xd20000 [0101.867] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0101.868] GetProcessHeap () returned 0xd20000 [0101.868] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0101.868] GetProcessHeap () returned 0xd20000 [0101.868] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0101.868] GetProcessHeap () returned 0xd20000 [0101.868] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0101.868] GetProcessHeap () returned 0xd20000 [0101.868] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0101.868] GetProcessHeap () returned 0xd20000 [0101.868] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0101.868] GetProcessHeap () returned 0xd20000 [0101.868] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0101.868] GetProcessHeap () returned 0xd20000 [0101.868] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0101.868] GetProcessHeap () returned 0xd20000 [0101.868] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0101.868] GetProcessHeap () returned 0xd20000 [0101.868] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0101.868] GetProcessHeap () returned 0xd20000 [0101.869] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0101.869] GetProcessHeap () returned 0xd20000 [0101.869] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0101.869] GetProcessHeap () returned 0xd20000 [0101.869] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0101.869] GetProcessHeap () returned 0xd20000 [0101.869] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0101.869] GetProcessHeap () returned 0xd20000 [0101.869] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0101.869] GetProcessHeap () returned 0xd20000 [0101.869] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0101.869] GetProcessHeap () returned 0xd20000 [0101.869] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.005] GetProcessHeap () returned 0xd20000 [0102.005] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0102.005] GetProcessHeap () returned 0xd20000 [0102.005] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0102.006] GetProcessHeap () returned 0xd20000 [0102.006] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.006] GetProcessHeap () returned 0xd20000 [0102.006] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.006] GetProcessHeap () returned 0xd20000 [0102.006] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0102.006] GetProcessHeap () returned 0xd20000 [0102.006] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0102.006] GetProcessHeap () returned 0xd20000 [0102.006] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.006] GetProcessHeap () returned 0xd20000 [0102.006] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.006] GetProcessHeap () returned 0xd20000 [0102.006] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.006] GetProcessHeap () returned 0xd20000 [0102.006] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.006] GetProcessHeap () returned 0xd20000 [0102.006] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0102.006] GetProcessHeap () returned 0xd20000 [0102.007] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0102.007] GetProcessHeap () returned 0xd20000 [0102.007] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.007] GetProcessHeap () returned 0xd20000 [0102.007] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.007] GetProcessHeap () returned 0xd20000 [0102.007] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.007] GetProcessHeap () returned 0xd20000 [0102.007] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.007] GetProcessHeap () returned 0xd20000 [0102.007] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.007] GetProcessHeap () returned 0xd20000 [0102.007] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.007] GetProcessHeap () returned 0xd20000 [0102.007] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0102.007] GetProcessHeap () returned 0xd20000 [0102.007] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0102.007] GetProcessHeap () returned 0xd20000 [0102.007] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0102.008] GetProcessHeap () returned 0xd20000 [0102.008] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0102.008] GetProcessHeap () returned 0xd20000 [0102.008] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.008] GetProcessHeap () returned 0xd20000 [0102.008] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.008] GetProcessHeap () returned 0xd20000 [0102.008] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.008] GetProcessHeap () returned 0xd20000 [0102.008] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.008] GetProcessHeap () returned 0xd20000 [0102.008] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.008] GetProcessHeap () returned 0xd20000 [0102.008] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.008] GetProcessHeap () returned 0xd20000 [0102.008] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.008] GetProcessHeap () returned 0xd20000 [0102.008] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.008] GetProcessHeap () returned 0xd20000 [0102.008] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.009] GetProcessHeap () returned 0xd20000 [0102.009] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.009] GetProcessHeap () returned 0xd20000 [0102.009] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.009] GetProcessHeap () returned 0xd20000 [0102.009] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.009] GetProcessHeap () returned 0xd20000 [0102.009] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.009] GetProcessHeap () returned 0xd20000 [0102.009] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.009] GetProcessHeap () returned 0xd20000 [0102.009] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.009] GetProcessHeap () returned 0xd20000 [0102.009] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.009] GetProcessHeap () returned 0xd20000 [0102.009] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0102.009] GetProcessHeap () returned 0xd20000 [0102.009] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0102.009] GetProcessHeap () returned 0xd20000 [0102.009] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.010] GetProcessHeap () returned 0xd20000 [0102.010] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.010] GetProcessHeap () returned 0xd20000 [0102.010] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0102.010] GetProcessHeap () returned 0xd20000 [0102.010] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0102.010] GetProcessHeap () returned 0xd20000 [0102.010] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.010] GetProcessHeap () returned 0xd20000 [0102.010] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.010] GetProcessHeap () returned 0xd20000 [0102.010] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.010] GetProcessHeap () returned 0xd20000 [0102.010] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.010] GetProcessHeap () returned 0xd20000 [0102.010] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.010] GetProcessHeap () returned 0xd20000 [0102.010] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.010] GetProcessHeap () returned 0xd20000 [0102.010] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0102.010] GetProcessHeap () returned 0xd20000 [0102.011] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0102.011] GetProcessHeap () returned 0xd20000 [0102.011] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.011] GetProcessHeap () returned 0xd20000 [0102.011] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.011] GetProcessHeap () returned 0xd20000 [0102.011] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.011] GetProcessHeap () returned 0xd20000 [0102.011] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.011] GetProcessHeap () returned 0xd20000 [0102.011] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.011] GetProcessHeap () returned 0xd20000 [0102.011] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.011] GetProcessHeap () returned 0xd20000 [0102.011] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.011] GetProcessHeap () returned 0xd20000 [0102.011] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.011] GetProcessHeap () returned 0xd20000 [0102.011] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.011] GetProcessHeap () returned 0xd20000 [0102.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.012] GetProcessHeap () returned 0xd20000 [0102.012] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0102.012] GetProcessHeap () returned 0xd20000 [0102.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0102.012] GetProcessHeap () returned 0xd20000 [0102.012] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.012] GetProcessHeap () returned 0xd20000 [0102.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.012] GetProcessHeap () returned 0xd20000 [0102.012] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0102.012] GetProcessHeap () returned 0xd20000 [0102.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0102.012] GetProcessHeap () returned 0xd20000 [0102.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0102.012] GetProcessHeap () returned 0xd20000 [0102.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0102.012] GetProcessHeap () returned 0xd20000 [0102.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0102.012] GetProcessHeap () returned 0xd20000 [0102.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0102.013] GetProcessHeap () returned 0xd20000 [0102.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446d8 | out: hHeap=0xd20000) returned 1 [0102.013] GetProcessHeap () returned 0xd20000 [0102.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b758 | out: hHeap=0xd20000) returned 1 [0102.013] GetProcessHeap () returned 0xd20000 [0102.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0102.013] GetProcessHeap () returned 0xd20000 [0102.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0102.013] GetProcessHeap () returned 0xd20000 [0102.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0102.013] GetProcessHeap () returned 0xd20000 [0102.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.013] GetProcessHeap () returned 0xd20000 [0102.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0102.013] WriteFile (in: hFile=0x230, lpBuffer=0xd4e210*, nNumberOfBytesToWrite=0x381, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e210*, lpNumberOfBytesWritten=0x299d864*=0x381, lpOverlapped=0x0) returned 1 [0102.021] GetProcessHeap () returned 0xd20000 [0102.021] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4e210, Size=0x30) returned 0xd4e210 [0102.021] GetProcessHeap () returned 0xd20000 [0102.022] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0102.022] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0102.022] GetProcessHeap () returned 0xd20000 [0102.022] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x11db0) returned 0xd4e248 [0102.022] ReadFile (in: hFile=0x230, lpBuffer=0xd4e248, nNumberOfBytesToRead=0x11db0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4e248*, lpNumberOfBytesRead=0x299d7e8*=0x11db0, lpOverlapped=0x0) returned 1 [0102.024] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0102.024] WriteFile (in: hFile=0x230, lpBuffer=0xd4e248*, nNumberOfBytesToWrite=0x11db0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4e248*, lpNumberOfBytesWritten=0x299d7e4*=0x11db0, lpOverlapped=0x0) returned 1 [0102.027] GetProcessHeap () returned 0xd20000 [0102.027] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4e248 | out: hHeap=0xd20000) returned 1 [0102.027] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0102.028] WriteFile (in: hFile=0x230, lpBuffer=0xd4e210*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e210*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0102.029] CloseHandle (hObject=0x230) returned 1 [0102.042] GetProcessHeap () returned 0xd20000 [0102.042] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42828 | out: hHeap=0xd20000) returned 1 [0102.042] GetProcessHeap () returned 0xd20000 [0102.042] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c0e8 | out: hHeap=0xd20000) returned 1 [0102.042] GetProcessHeap () returned 0xd20000 [0102.042] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0102.042] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt") returned="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" [0102.042] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt.[ponce.lorena@aol.com]" [0102.042] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwcompat.txt.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0102.043] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\hwcompat.txt" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64") returned 1 [0102.043] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\") returned="" [0102.043] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\amd64\\HOW_RECOVER.html" [0102.043] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\amd64\\how_recover.html")) returned 0x20 [0102.043] GetProcessHeap () returned 0xd20000 [0102.044] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44408 | out: hHeap=0xd20000) returned 1 [0102.044] FindNextFileW (in: hFindFile=0xd491a0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39dcc9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39dcc9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x90d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hwexclude.txt", cAlternateFileName="HWEXCL~1.TXT")) returned 1 [0102.044] lstrcmpiW (lpString1="hwexclude.txt", lpString2=".") returned 1 [0102.044] lstrcmpiW (lpString1="hwexclude.txt", lpString2="..") returned 1 [0102.044] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="hwexclude.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt") returned="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" [0102.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwexclude.txt", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0102.044] GetProcessHeap () returned 0xd20000 [0102.044] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xe) returned 0xd44510 [0102.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="hwexclude.txt", cchWideChar=-1, lpMultiByteStr=0xd44510, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="hwexclude.txt", lpUsedDefaultChar=0x0) returned 14 [0102.044] lstrlenA (lpString="hwexclude.txt") returned 13 [0102.044] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0102.044] lstrlenA (lpString="hwexclude.txt") returned 13 [0102.044] lstrlenA (lpString=".dll") returned 4 [0102.044] lstrlenA (lpString=".dll") returned 4 [0102.044] lstrlenA (lpString="hwexclude.txt") returned 13 [0102.044] lstrcmpiA (lpString1=".txt", lpString2=".dll") returned 1 [0102.044] lstrlenA (lpString="hwexclude.txt") returned 13 [0102.044] lstrlenA (lpString=".ini") returned 4 [0102.044] lstrlenA (lpString=".ini") returned 4 [0102.044] lstrlenA (lpString="hwexclude.txt") returned 13 [0102.045] lstrcmpiA (lpString1=".txt", lpString2=".ini") returned 1 [0102.045] lstrlenA (lpString="hwexclude.txt") returned 13 [0102.045] lstrlenA (lpString=".inc") returned 4 [0102.045] lstrlenA (lpString=".inc") returned 4 [0102.045] lstrlenA (lpString="hwexclude.txt") returned 13 [0102.045] lstrcmpiA (lpString1=".txt", lpString2=".inc") returned 1 [0102.045] lstrcmpiW (lpString1="hwexclude.txt", lpString2="HOW_RECOVER.html") returned 1 [0102.045] lstrcmpiW (lpString1="hwexclude.txt", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0102.045] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0102.045] lstrcmpiW (lpString1="hwexclude.txt", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0102.045] GetProcessHeap () returned 0xd20000 [0102.045] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42828 [0102.045] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0102.046] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=2317) returned 1 [0102.046] GetProcessHeap () returned 0xd20000 [0102.046] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4be90 [0102.046] GetProcessHeap () returned 0xd20000 [0102.046] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0102.046] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt") returned 49 [0102.046] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0102.046] GetProcessHeap () returned 0xd20000 [0102.046] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0102.046] GetProcessHeap () returned 0xd20000 [0102.046] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x383) returned 0xd4e248 [0102.046] lstrlenA (lpString="rsa_encrypt") returned 11 [0102.046] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0102.048] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0102.048] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0102.048] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0102.049] GetProcessHeap () returned 0xd20000 [0102.049] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0102.049] lstrlenA (lpString="010001") returned 6 [0102.049] GetProcessHeap () returned 0xd20000 [0102.049] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc38 [0102.049] GetProcessHeap () returned 0xd20000 [0102.049] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0102.049] GetProcessHeap () returned 0xd20000 [0102.049] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ad38 [0102.049] GetProcessHeap () returned 0xd20000 [0102.049] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0102.049] GetProcessHeap () returned 0xd20000 [0102.049] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b638 [0102.049] GetProcessHeap () returned 0xd20000 [0102.049] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44808 [0102.049] GetProcessHeap () returned 0xd20000 [0102.049] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd38 [0102.050] GetProcessHeap () returned 0xd20000 [0102.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0102.050] GetProcessHeap () returned 0xd20000 [0102.050] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0102.050] GetProcessHeap () returned 0xd20000 [0102.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0102.050] GetProcessHeap () returned 0xd20000 [0102.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0102.050] GetProcessHeap () returned 0xd20000 [0102.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44c68 [0102.050] GetProcessHeap () returned 0xd20000 [0102.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.050] GetProcessHeap () returned 0xd20000 [0102.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446d8 [0102.050] GetProcessHeap () returned 0xd20000 [0102.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aaf8 [0102.050] GetProcessHeap () returned 0xd20000 [0102.050] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0102.050] GetProcessHeap () returned 0xd20000 [0102.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0102.050] GetProcessHeap () returned 0xd20000 [0102.050] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aaf8 | out: hHeap=0xd20000) returned 1 [0102.051] GetProcessHeap () returned 0xd20000 [0102.051] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.051] GetProcessHeap () returned 0xd20000 [0102.051] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444c8 [0102.051] GetProcessHeap () returned 0xd20000 [0102.051] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.051] GetProcessHeap () returned 0xd20000 [0102.051] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.051] GetProcessHeap () returned 0xd20000 [0102.051] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.051] GetProcessHeap () returned 0xd20000 [0102.051] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.051] GetProcessHeap () returned 0xd20000 [0102.051] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.051] GetProcessHeap () returned 0xd20000 [0102.051] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.051] GetProcessHeap () returned 0xd20000 [0102.051] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b7e8 [0102.051] GetProcessHeap () returned 0xd20000 [0102.051] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444c8 | out: hHeap=0xd20000) returned 1 [0102.051] GetProcessHeap () returned 0xd20000 [0102.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0102.052] GetProcessHeap () returned 0xd20000 [0102.052] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0102.052] GetProcessHeap () returned 0xd20000 [0102.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.052] GetProcessHeap () returned 0xd20000 [0102.052] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.052] GetProcessHeap () returned 0xd20000 [0102.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.052] GetProcessHeap () returned 0xd20000 [0102.052] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.052] GetProcessHeap () returned 0xd20000 [0102.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0102.052] GetProcessHeap () returned 0xd20000 [0102.052] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0102.052] GetProcessHeap () returned 0xd20000 [0102.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0102.052] GetProcessHeap () returned 0xd20000 [0102.052] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0102.052] GetProcessHeap () returned 0xd20000 [0102.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.053] GetProcessHeap () returned 0xd20000 [0102.053] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.053] GetProcessHeap () returned 0xd20000 [0102.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0102.053] GetProcessHeap () returned 0xd20000 [0102.053] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0102.053] GetProcessHeap () returned 0xd20000 [0102.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.053] GetProcessHeap () returned 0xd20000 [0102.053] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.053] GetProcessHeap () returned 0xd20000 [0102.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0102.053] GetProcessHeap () returned 0xd20000 [0102.053] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0102.053] GetProcessHeap () returned 0xd20000 [0102.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.053] GetProcessHeap () returned 0xd20000 [0102.053] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.054] GetProcessHeap () returned 0xd20000 [0102.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.054] GetProcessHeap () returned 0xd20000 [0102.054] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.054] GetProcessHeap () returned 0xd20000 [0102.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.054] GetProcessHeap () returned 0xd20000 [0102.054] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.054] GetProcessHeap () returned 0xd20000 [0102.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.054] GetProcessHeap () returned 0xd20000 [0102.054] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.054] GetProcessHeap () returned 0xd20000 [0102.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.054] GetProcessHeap () returned 0xd20000 [0102.054] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.054] GetProcessHeap () returned 0xd20000 [0102.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.054] GetProcessHeap () returned 0xd20000 [0102.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.055] GetProcessHeap () returned 0xd20000 [0102.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.055] GetProcessHeap () returned 0xd20000 [0102.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.055] GetProcessHeap () returned 0xd20000 [0102.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0102.055] GetProcessHeap () returned 0xd20000 [0102.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0102.055] GetProcessHeap () returned 0xd20000 [0102.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.055] GetProcessHeap () returned 0xd20000 [0102.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.055] GetProcessHeap () returned 0xd20000 [0102.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.055] GetProcessHeap () returned 0xd20000 [0102.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.055] GetProcessHeap () returned 0xd20000 [0102.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.055] GetProcessHeap () returned 0xd20000 [0102.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.056] GetProcessHeap () returned 0xd20000 [0102.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0102.056] GetProcessHeap () returned 0xd20000 [0102.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0102.056] GetProcessHeap () returned 0xd20000 [0102.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.056] GetProcessHeap () returned 0xd20000 [0102.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.056] GetProcessHeap () returned 0xd20000 [0102.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.056] GetProcessHeap () returned 0xd20000 [0102.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.056] GetProcessHeap () returned 0xd20000 [0102.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.056] GetProcessHeap () returned 0xd20000 [0102.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.056] GetProcessHeap () returned 0xd20000 [0102.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.056] GetProcessHeap () returned 0xd20000 [0102.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.056] GetProcessHeap () returned 0xd20000 [0102.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.057] GetProcessHeap () returned 0xd20000 [0102.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.057] GetProcessHeap () returned 0xd20000 [0102.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.057] GetProcessHeap () returned 0xd20000 [0102.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.057] GetProcessHeap () returned 0xd20000 [0102.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.057] GetProcessHeap () returned 0xd20000 [0102.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.057] GetProcessHeap () returned 0xd20000 [0102.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0102.057] GetProcessHeap () returned 0xd20000 [0102.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0102.057] GetProcessHeap () returned 0xd20000 [0102.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.057] GetProcessHeap () returned 0xd20000 [0102.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.057] GetProcessHeap () returned 0xd20000 [0102.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0102.058] GetProcessHeap () returned 0xd20000 [0102.058] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0102.058] GetProcessHeap () returned 0xd20000 [0102.058] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.058] GetProcessHeap () returned 0xd20000 [0102.058] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.058] GetProcessHeap () returned 0xd20000 [0102.058] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.058] GetProcessHeap () returned 0xd20000 [0102.058] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.058] GetProcessHeap () returned 0xd20000 [0102.058] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0102.058] GetProcessHeap () returned 0xd20000 [0102.058] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0102.058] GetProcessHeap () returned 0xd20000 [0102.058] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.058] GetProcessHeap () returned 0xd20000 [0102.058] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.058] GetProcessHeap () returned 0xd20000 [0102.058] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0102.058] GetProcessHeap () returned 0xd20000 [0102.058] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0102.059] GetProcessHeap () returned 0xd20000 [0102.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0102.059] GetProcessHeap () returned 0xd20000 [0102.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0102.059] GetProcessHeap () returned 0xd20000 [0102.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0102.059] GetProcessHeap () returned 0xd20000 [0102.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0102.059] GetProcessHeap () returned 0xd20000 [0102.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.059] GetProcessHeap () returned 0xd20000 [0102.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.059] GetProcessHeap () returned 0xd20000 [0102.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0102.059] GetProcessHeap () returned 0xd20000 [0102.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0102.059] GetProcessHeap () returned 0xd20000 [0102.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.059] GetProcessHeap () returned 0xd20000 [0102.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.060] GetProcessHeap () returned 0xd20000 [0102.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0102.060] GetProcessHeap () returned 0xd20000 [0102.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0102.060] GetProcessHeap () returned 0xd20000 [0102.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.060] GetProcessHeap () returned 0xd20000 [0102.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.060] GetProcessHeap () returned 0xd20000 [0102.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.060] GetProcessHeap () returned 0xd20000 [0102.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.060] GetProcessHeap () returned 0xd20000 [0102.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.060] GetProcessHeap () returned 0xd20000 [0102.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.060] GetProcessHeap () returned 0xd20000 [0102.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0102.060] GetProcessHeap () returned 0xd20000 [0102.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0102.060] GetProcessHeap () returned 0xd20000 [0102.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0102.061] GetProcessHeap () returned 0xd20000 [0102.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0102.061] GetProcessHeap () returned 0xd20000 [0102.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.061] GetProcessHeap () returned 0xd20000 [0102.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.061] GetProcessHeap () returned 0xd20000 [0102.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.061] GetProcessHeap () returned 0xd20000 [0102.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.061] GetProcessHeap () returned 0xd20000 [0102.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0102.061] GetProcessHeap () returned 0xd20000 [0102.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0102.061] GetProcessHeap () returned 0xd20000 [0102.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.061] GetProcessHeap () returned 0xd20000 [0102.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.062] GetProcessHeap () returned 0xd20000 [0102.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.062] GetProcessHeap () returned 0xd20000 [0102.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.062] GetProcessHeap () returned 0xd20000 [0102.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.062] GetProcessHeap () returned 0xd20000 [0102.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.062] GetProcessHeap () returned 0xd20000 [0102.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0102.062] GetProcessHeap () returned 0xd20000 [0102.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0102.062] GetProcessHeap () returned 0xd20000 [0102.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0102.062] GetProcessHeap () returned 0xd20000 [0102.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0102.062] GetProcessHeap () returned 0xd20000 [0102.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.062] GetProcessHeap () returned 0xd20000 [0102.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.063] GetProcessHeap () returned 0xd20000 [0102.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0102.063] GetProcessHeap () returned 0xd20000 [0102.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0102.063] GetProcessHeap () returned 0xd20000 [0102.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.063] GetProcessHeap () returned 0xd20000 [0102.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.063] GetProcessHeap () returned 0xd20000 [0102.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.063] GetProcessHeap () returned 0xd20000 [0102.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.063] GetProcessHeap () returned 0xd20000 [0102.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0102.063] GetProcessHeap () returned 0xd20000 [0102.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0102.063] GetProcessHeap () returned 0xd20000 [0102.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.063] GetProcessHeap () returned 0xd20000 [0102.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.064] GetProcessHeap () returned 0xd20000 [0102.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.064] GetProcessHeap () returned 0xd20000 [0102.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.064] GetProcessHeap () returned 0xd20000 [0102.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.064] GetProcessHeap () returned 0xd20000 [0102.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.064] GetProcessHeap () returned 0xd20000 [0102.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.064] GetProcessHeap () returned 0xd20000 [0102.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.064] GetProcessHeap () returned 0xd20000 [0102.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0102.064] GetProcessHeap () returned 0xd20000 [0102.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0102.064] GetProcessHeap () returned 0xd20000 [0102.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.064] GetProcessHeap () returned 0xd20000 [0102.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.065] GetProcessHeap () returned 0xd20000 [0102.065] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0102.065] GetProcessHeap () returned 0xd20000 [0102.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0102.065] GetProcessHeap () returned 0xd20000 [0102.065] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.065] GetProcessHeap () returned 0xd20000 [0102.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.066] GetProcessHeap () returned 0xd20000 [0102.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.066] GetProcessHeap () returned 0xd20000 [0102.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.066] GetProcessHeap () returned 0xd20000 [0102.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.066] GetProcessHeap () returned 0xd20000 [0102.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.066] GetProcessHeap () returned 0xd20000 [0102.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.066] GetProcessHeap () returned 0xd20000 [0102.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.066] GetProcessHeap () returned 0xd20000 [0102.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.066] GetProcessHeap () returned 0xd20000 [0102.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.066] GetProcessHeap () returned 0xd20000 [0102.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.066] GetProcessHeap () returned 0xd20000 [0102.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.066] GetProcessHeap () returned 0xd20000 [0102.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0102.067] GetProcessHeap () returned 0xd20000 [0102.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0102.067] GetProcessHeap () returned 0xd20000 [0102.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.067] GetProcessHeap () returned 0xd20000 [0102.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.067] GetProcessHeap () returned 0xd20000 [0102.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.067] GetProcessHeap () returned 0xd20000 [0102.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.067] GetProcessHeap () returned 0xd20000 [0102.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.067] GetProcessHeap () returned 0xd20000 [0102.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.067] GetProcessHeap () returned 0xd20000 [0102.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0102.067] GetProcessHeap () returned 0xd20000 [0102.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0102.068] GetProcessHeap () returned 0xd20000 [0102.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.068] GetProcessHeap () returned 0xd20000 [0102.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.068] GetProcessHeap () returned 0xd20000 [0102.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.068] GetProcessHeap () returned 0xd20000 [0102.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.068] GetProcessHeap () returned 0xd20000 [0102.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.068] GetProcessHeap () returned 0xd20000 [0102.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.068] GetProcessHeap () returned 0xd20000 [0102.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.068] GetProcessHeap () returned 0xd20000 [0102.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.068] GetProcessHeap () returned 0xd20000 [0102.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.068] GetProcessHeap () returned 0xd20000 [0102.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.068] GetProcessHeap () returned 0xd20000 [0102.069] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.069] GetProcessHeap () returned 0xd20000 [0102.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.069] GetProcessHeap () returned 0xd20000 [0102.069] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.069] GetProcessHeap () returned 0xd20000 [0102.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.069] GetProcessHeap () returned 0xd20000 [0102.069] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.069] GetProcessHeap () returned 0xd20000 [0102.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.069] GetProcessHeap () returned 0xd20000 [0102.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0102.069] GetProcessHeap () returned 0xd20000 [0102.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0102.069] GetProcessHeap () returned 0xd20000 [0102.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0102.069] GetProcessHeap () returned 0xd20000 [0102.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0102.070] GetProcessHeap () returned 0xd20000 [0102.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446d8 | out: hHeap=0xd20000) returned 1 [0102.070] GetProcessHeap () returned 0xd20000 [0102.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b638 | out: hHeap=0xd20000) returned 1 [0102.070] GetProcessHeap () returned 0xd20000 [0102.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0102.070] GetProcessHeap () returned 0xd20000 [0102.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ad38 | out: hHeap=0xd20000) returned 1 [0102.070] GetProcessHeap () returned 0xd20000 [0102.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0102.070] GetProcessHeap () returned 0xd20000 [0102.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0102.070] GetProcessHeap () returned 0xd20000 [0102.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0102.070] WriteFile (in: hFile=0x230, lpBuffer=0xd4e248*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e248*, lpNumberOfBytesWritten=0x299d864*=0x383, lpOverlapped=0x0) returned 1 [0102.075] GetProcessHeap () returned 0xd20000 [0102.075] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4e248, Size=0x30) returned 0xd4e248 [0102.075] GetProcessHeap () returned 0xd20000 [0102.075] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0102.075] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0102.075] GetProcessHeap () returned 0xd20000 [0102.075] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x910) returned 0xd4e280 [0102.075] ReadFile (in: hFile=0x230, lpBuffer=0xd4e280, nNumberOfBytesToRead=0x910, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4e280*, lpNumberOfBytesRead=0x299d7e8*=0x910, lpOverlapped=0x0) returned 1 [0102.075] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0102.076] WriteFile (in: hFile=0x230, lpBuffer=0xd4e280*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4e280*, lpNumberOfBytesWritten=0x299d7e4*=0x910, lpOverlapped=0x0) returned 1 [0102.077] GetProcessHeap () returned 0xd20000 [0102.077] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4e280 | out: hHeap=0xd20000) returned 1 [0102.077] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0102.077] WriteFile (in: hFile=0x230, lpBuffer=0xd4e248*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e248*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0102.078] CloseHandle (hObject=0x230) returned 1 [0102.081] GetProcessHeap () returned 0xd20000 [0102.081] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42828 | out: hHeap=0xd20000) returned 1 [0102.081] GetProcessHeap () returned 0xd20000 [0102.081] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4be90 | out: hHeap=0xd20000) returned 1 [0102.081] GetProcessHeap () returned 0xd20000 [0102.081] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0102.081] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt") returned="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" [0102.081] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt.[ponce.lorena@aol.com]" [0102.081] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\amd64\\hwexclude.txt.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0102.082] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\hwexclude.txt" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64") returned 1 [0102.082] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\") returned="" [0102.082] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\amd64\\HOW_RECOVER.html" [0102.082] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\amd64\\how_recover.html")) returned 0x20 [0102.082] GetProcessHeap () returned 0xd20000 [0102.082] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44510 | out: hHeap=0xd20000) returned 1 [0102.082] FindNextFileW (in: hFindFile=0xd491a0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea39eff9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea39eff9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x26b6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nxquery.cat", cAlternateFileName="")) returned 1 [0102.082] lstrcmpiW (lpString1="nxquery.cat", lpString2=".") returned 1 [0102.082] lstrcmpiW (lpString1="nxquery.cat", lpString2="..") returned 1 [0102.083] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="nxquery.cat" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat") returned="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" [0102.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nxquery.cat", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0102.083] GetProcessHeap () returned 0xd20000 [0102.083] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd44510 [0102.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nxquery.cat", cchWideChar=-1, lpMultiByteStr=0xd44510, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nxquery.cat", lpUsedDefaultChar=0x0) returned 12 [0102.083] lstrlenA (lpString="nxquery.cat") returned 11 [0102.083] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0102.083] lstrlenA (lpString="nxquery.cat") returned 11 [0102.083] lstrlenA (lpString=".dll") returned 4 [0102.083] lstrlenA (lpString=".dll") returned 4 [0102.083] lstrlenA (lpString="nxquery.cat") returned 11 [0102.083] lstrcmpiA (lpString1=".cat", lpString2=".dll") returned -1 [0102.083] lstrlenA (lpString="nxquery.cat") returned 11 [0102.083] lstrlenA (lpString=".ini") returned 4 [0102.083] lstrlenA (lpString=".ini") returned 4 [0102.083] lstrlenA (lpString="nxquery.cat") returned 11 [0102.083] lstrcmpiA (lpString1=".cat", lpString2=".ini") returned -1 [0102.083] lstrlenA (lpString="nxquery.cat") returned 11 [0102.083] lstrlenA (lpString=".inc") returned 4 [0102.083] lstrlenA (lpString=".inc") returned 4 [0102.084] lstrlenA (lpString="nxquery.cat") returned 11 [0102.084] lstrcmpiA (lpString1=".cat", lpString2=".inc") returned -1 [0102.084] lstrcmpiW (lpString1="nxquery.cat", lpString2="HOW_RECOVER.html") returned 1 [0102.084] lstrcmpiW (lpString1="nxquery.cat", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0102.084] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0102.084] lstrcmpiW (lpString1="nxquery.cat", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0102.084] GetProcessHeap () returned 0xd20000 [0102.084] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42760 [0102.084] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0102.085] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=9910) returned 1 [0102.085] GetProcessHeap () returned 0xd20000 [0102.085] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c160 [0102.085] GetProcessHeap () returned 0xd20000 [0102.085] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0102.085] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat") returned 47 [0102.085] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0102.085] GetProcessHeap () returned 0xd20000 [0102.085] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0102.085] GetProcessHeap () returned 0xd20000 [0102.085] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4e280 [0102.085] lstrlenA (lpString="rsa_encrypt") returned 11 [0102.085] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0102.087] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0102.087] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0102.087] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0102.087] GetProcessHeap () returned 0xd20000 [0102.088] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0102.088] lstrlenA (lpString="010001") returned 6 [0102.088] GetProcessHeap () returned 0xd20000 [0102.088] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc98 [0102.088] GetProcessHeap () returned 0xd20000 [0102.088] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0102.088] GetProcessHeap () returned 0xd20000 [0102.088] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b248 [0102.088] GetProcessHeap () returned 0xd20000 [0102.088] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0102.088] GetProcessHeap () returned 0xd20000 [0102.088] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ac18 [0102.088] GetProcessHeap () returned 0xd20000 [0102.088] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45640 [0102.088] GetProcessHeap () returned 0xd20000 [0102.088] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0102.088] GetProcessHeap () returned 0xd20000 [0102.088] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0102.088] GetProcessHeap () returned 0xd20000 [0102.088] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.089] GetProcessHeap () returned 0xd20000 [0102.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0102.089] GetProcessHeap () returned 0xd20000 [0102.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0102.089] GetProcessHeap () returned 0xd20000 [0102.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd45410 [0102.089] GetProcessHeap () returned 0xd20000 [0102.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0102.089] GetProcessHeap () returned 0xd20000 [0102.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446a8 [0102.089] GetProcessHeap () returned 0xd20000 [0102.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b5a8 [0102.089] GetProcessHeap () returned 0xd20000 [0102.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0102.089] GetProcessHeap () returned 0xd20000 [0102.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0102.089] GetProcessHeap () returned 0xd20000 [0102.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b5a8 | out: hHeap=0xd20000) returned 1 [0102.089] GetProcessHeap () returned 0xd20000 [0102.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.089] GetProcessHeap () returned 0xd20000 [0102.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44570 [0102.089] GetProcessHeap () returned 0xd20000 [0102.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0102.090] GetProcessHeap () returned 0xd20000 [0102.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.090] GetProcessHeap () returned 0xd20000 [0102.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.090] GetProcessHeap () returned 0xd20000 [0102.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.090] GetProcessHeap () returned 0xd20000 [0102.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0102.090] GetProcessHeap () returned 0xd20000 [0102.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0102.090] GetProcessHeap () returned 0xd20000 [0102.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4a948 [0102.090] GetProcessHeap () returned 0xd20000 [0102.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44570 | out: hHeap=0xd20000) returned 1 [0102.090] GetProcessHeap () returned 0xd20000 [0102.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0102.090] GetProcessHeap () returned 0xd20000 [0102.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a948 | out: hHeap=0xd20000) returned 1 [0102.090] GetProcessHeap () returned 0xd20000 [0102.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0102.090] GetProcessHeap () returned 0xd20000 [0102.091] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0102.091] GetProcessHeap () returned 0xd20000 [0102.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0102.091] GetProcessHeap () returned 0xd20000 [0102.091] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0102.091] GetProcessHeap () returned 0xd20000 [0102.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.091] GetProcessHeap () returned 0xd20000 [0102.091] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.091] GetProcessHeap () returned 0xd20000 [0102.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.091] GetProcessHeap () returned 0xd20000 [0102.091] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.091] GetProcessHeap () returned 0xd20000 [0102.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0102.091] GetProcessHeap () returned 0xd20000 [0102.091] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0102.091] GetProcessHeap () returned 0xd20000 [0102.092] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0102.092] GetProcessHeap () returned 0xd20000 [0102.092] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0102.092] GetProcessHeap () returned 0xd20000 [0102.092] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0102.092] GetProcessHeap () returned 0xd20000 [0102.092] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0102.092] GetProcessHeap () returned 0xd20000 [0102.092] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.092] GetProcessHeap () returned 0xd20000 [0102.092] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.092] GetProcessHeap () returned 0xd20000 [0102.092] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.092] GetProcessHeap () returned 0xd20000 [0102.092] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.092] GetProcessHeap () returned 0xd20000 [0102.092] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.092] GetProcessHeap () returned 0xd20000 [0102.092] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.092] GetProcessHeap () returned 0xd20000 [0102.093] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.093] GetProcessHeap () returned 0xd20000 [0102.093] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.093] GetProcessHeap () returned 0xd20000 [0102.093] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.093] GetProcessHeap () returned 0xd20000 [0102.093] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.093] GetProcessHeap () returned 0xd20000 [0102.093] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.093] GetProcessHeap () returned 0xd20000 [0102.093] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.093] GetProcessHeap () returned 0xd20000 [0102.093] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.093] GetProcessHeap () returned 0xd20000 [0102.093] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.093] GetProcessHeap () returned 0xd20000 [0102.093] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.093] GetProcessHeap () returned 0xd20000 [0102.093] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.093] GetProcessHeap () returned 0xd20000 [0102.093] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0102.093] GetProcessHeap () returned 0xd20000 [0102.094] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0102.094] GetProcessHeap () returned 0xd20000 [0102.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.094] GetProcessHeap () returned 0xd20000 [0102.094] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.094] GetProcessHeap () returned 0xd20000 [0102.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0102.094] GetProcessHeap () returned 0xd20000 [0102.094] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0102.094] GetProcessHeap () returned 0xd20000 [0102.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.094] GetProcessHeap () returned 0xd20000 [0102.094] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.094] GetProcessHeap () returned 0xd20000 [0102.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.094] GetProcessHeap () returned 0xd20000 [0102.094] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.094] GetProcessHeap () returned 0xd20000 [0102.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.094] GetProcessHeap () returned 0xd20000 [0102.094] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.095] GetProcessHeap () returned 0xd20000 [0102.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.095] GetProcessHeap () returned 0xd20000 [0102.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.095] GetProcessHeap () returned 0xd20000 [0102.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.095] GetProcessHeap () returned 0xd20000 [0102.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.095] GetProcessHeap () returned 0xd20000 [0102.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.095] GetProcessHeap () returned 0xd20000 [0102.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.095] GetProcessHeap () returned 0xd20000 [0102.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.095] GetProcessHeap () returned 0xd20000 [0102.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.095] GetProcessHeap () returned 0xd20000 [0102.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.095] GetProcessHeap () returned 0xd20000 [0102.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.095] GetProcessHeap () returned 0xd20000 [0102.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.096] GetProcessHeap () returned 0xd20000 [0102.096] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.128] GetProcessHeap () returned 0xd20000 [0102.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.128] GetProcessHeap () returned 0xd20000 [0102.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.128] GetProcessHeap () returned 0xd20000 [0102.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.129] GetProcessHeap () returned 0xd20000 [0102.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.129] GetProcessHeap () returned 0xd20000 [0102.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0102.129] GetProcessHeap () returned 0xd20000 [0102.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0102.129] GetProcessHeap () returned 0xd20000 [0102.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.129] GetProcessHeap () returned 0xd20000 [0102.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.129] GetProcessHeap () returned 0xd20000 [0102.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0102.129] GetProcessHeap () returned 0xd20000 [0102.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0102.129] GetProcessHeap () returned 0xd20000 [0102.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.129] GetProcessHeap () returned 0xd20000 [0102.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.129] GetProcessHeap () returned 0xd20000 [0102.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.129] GetProcessHeap () returned 0xd20000 [0102.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.130] GetProcessHeap () returned 0xd20000 [0102.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.130] GetProcessHeap () returned 0xd20000 [0102.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.130] GetProcessHeap () returned 0xd20000 [0102.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.130] GetProcessHeap () returned 0xd20000 [0102.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.130] GetProcessHeap () returned 0xd20000 [0102.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0102.130] GetProcessHeap () returned 0xd20000 [0102.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0102.130] GetProcessHeap () returned 0xd20000 [0102.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.130] GetProcessHeap () returned 0xd20000 [0102.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.130] GetProcessHeap () returned 0xd20000 [0102.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0102.130] GetProcessHeap () returned 0xd20000 [0102.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0102.130] GetProcessHeap () returned 0xd20000 [0102.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.131] GetProcessHeap () returned 0xd20000 [0102.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.131] GetProcessHeap () returned 0xd20000 [0102.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.131] GetProcessHeap () returned 0xd20000 [0102.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.131] GetProcessHeap () returned 0xd20000 [0102.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0102.131] GetProcessHeap () returned 0xd20000 [0102.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0102.131] GetProcessHeap () returned 0xd20000 [0102.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.131] GetProcessHeap () returned 0xd20000 [0102.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.131] GetProcessHeap () returned 0xd20000 [0102.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.131] GetProcessHeap () returned 0xd20000 [0102.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.131] GetProcessHeap () returned 0xd20000 [0102.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.132] GetProcessHeap () returned 0xd20000 [0102.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.132] GetProcessHeap () returned 0xd20000 [0102.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0102.132] GetProcessHeap () returned 0xd20000 [0102.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0102.132] GetProcessHeap () returned 0xd20000 [0102.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0102.132] GetProcessHeap () returned 0xd20000 [0102.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0102.132] GetProcessHeap () returned 0xd20000 [0102.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.132] GetProcessHeap () returned 0xd20000 [0102.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.132] GetProcessHeap () returned 0xd20000 [0102.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.132] GetProcessHeap () returned 0xd20000 [0102.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.132] GetProcessHeap () returned 0xd20000 [0102.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.132] GetProcessHeap () returned 0xd20000 [0102.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.133] GetProcessHeap () returned 0xd20000 [0102.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.133] GetProcessHeap () returned 0xd20000 [0102.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.133] GetProcessHeap () returned 0xd20000 [0102.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.133] GetProcessHeap () returned 0xd20000 [0102.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.133] GetProcessHeap () returned 0xd20000 [0102.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.133] GetProcessHeap () returned 0xd20000 [0102.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.133] GetProcessHeap () returned 0xd20000 [0102.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.133] GetProcessHeap () returned 0xd20000 [0102.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.133] GetProcessHeap () returned 0xd20000 [0102.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.134] GetProcessHeap () returned 0xd20000 [0102.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.134] GetProcessHeap () returned 0xd20000 [0102.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0102.134] GetProcessHeap () returned 0xd20000 [0102.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0102.134] GetProcessHeap () returned 0xd20000 [0102.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.134] GetProcessHeap () returned 0xd20000 [0102.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.134] GetProcessHeap () returned 0xd20000 [0102.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0102.134] GetProcessHeap () returned 0xd20000 [0102.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0102.134] GetProcessHeap () returned 0xd20000 [0102.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.134] GetProcessHeap () returned 0xd20000 [0102.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.134] GetProcessHeap () returned 0xd20000 [0102.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.135] GetProcessHeap () returned 0xd20000 [0102.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.135] GetProcessHeap () returned 0xd20000 [0102.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.135] GetProcessHeap () returned 0xd20000 [0102.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.135] GetProcessHeap () returned 0xd20000 [0102.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0102.135] GetProcessHeap () returned 0xd20000 [0102.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0102.135] GetProcessHeap () returned 0xd20000 [0102.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.135] GetProcessHeap () returned 0xd20000 [0102.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.135] GetProcessHeap () returned 0xd20000 [0102.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.135] GetProcessHeap () returned 0xd20000 [0102.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.135] GetProcessHeap () returned 0xd20000 [0102.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.136] GetProcessHeap () returned 0xd20000 [0102.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.136] GetProcessHeap () returned 0xd20000 [0102.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.136] GetProcessHeap () returned 0xd20000 [0102.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.136] GetProcessHeap () returned 0xd20000 [0102.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.136] GetProcessHeap () returned 0xd20000 [0102.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.136] GetProcessHeap () returned 0xd20000 [0102.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0102.136] GetProcessHeap () returned 0xd20000 [0102.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0102.136] GetProcessHeap () returned 0xd20000 [0102.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.136] GetProcessHeap () returned 0xd20000 [0102.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.136] GetProcessHeap () returned 0xd20000 [0102.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0102.137] GetProcessHeap () returned 0xd20000 [0102.137] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0102.137] GetProcessHeap () returned 0xd20000 [0102.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.137] GetProcessHeap () returned 0xd20000 [0102.137] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.137] GetProcessHeap () returned 0xd20000 [0102.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.137] GetProcessHeap () returned 0xd20000 [0102.137] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.137] GetProcessHeap () returned 0xd20000 [0102.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0102.137] GetProcessHeap () returned 0xd20000 [0102.137] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0102.137] GetProcessHeap () returned 0xd20000 [0102.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.137] GetProcessHeap () returned 0xd20000 [0102.137] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.137] GetProcessHeap () returned 0xd20000 [0102.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.138] GetProcessHeap () returned 0xd20000 [0102.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.138] GetProcessHeap () returned 0xd20000 [0102.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.138] GetProcessHeap () returned 0xd20000 [0102.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.138] GetProcessHeap () returned 0xd20000 [0102.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.138] GetProcessHeap () returned 0xd20000 [0102.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.138] GetProcessHeap () returned 0xd20000 [0102.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.138] GetProcessHeap () returned 0xd20000 [0102.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.138] GetProcessHeap () returned 0xd20000 [0102.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.138] GetProcessHeap () returned 0xd20000 [0102.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.139] GetProcessHeap () returned 0xd20000 [0102.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.139] GetProcessHeap () returned 0xd20000 [0102.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.139] GetProcessHeap () returned 0xd20000 [0102.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0102.139] GetProcessHeap () returned 0xd20000 [0102.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0102.139] GetProcessHeap () returned 0xd20000 [0102.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.139] GetProcessHeap () returned 0xd20000 [0102.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.139] GetProcessHeap () returned 0xd20000 [0102.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.139] GetProcessHeap () returned 0xd20000 [0102.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.139] GetProcessHeap () returned 0xd20000 [0102.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0102.139] GetProcessHeap () returned 0xd20000 [0102.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0102.140] GetProcessHeap () returned 0xd20000 [0102.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0102.140] GetProcessHeap () returned 0xd20000 [0102.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0102.140] GetProcessHeap () returned 0xd20000 [0102.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0102.140] GetProcessHeap () returned 0xd20000 [0102.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0102.140] GetProcessHeap () returned 0xd20000 [0102.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0102.140] GetProcessHeap () returned 0xd20000 [0102.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0102.140] GetProcessHeap () returned 0xd20000 [0102.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446a8 | out: hHeap=0xd20000) returned 1 [0102.140] GetProcessHeap () returned 0xd20000 [0102.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ac18 | out: hHeap=0xd20000) returned 1 [0102.140] GetProcessHeap () returned 0xd20000 [0102.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0102.140] GetProcessHeap () returned 0xd20000 [0102.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b248 | out: hHeap=0xd20000) returned 1 [0102.141] GetProcessHeap () returned 0xd20000 [0102.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0102.141] GetProcessHeap () returned 0xd20000 [0102.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.141] GetProcessHeap () returned 0xd20000 [0102.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0102.141] WriteFile (in: hFile=0x230, lpBuffer=0xd4e280*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e280*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0102.252] GetProcessHeap () returned 0xd20000 [0102.252] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4e280, Size=0x30) returned 0xd4e280 [0102.252] GetProcessHeap () returned 0xd20000 [0102.252] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0102.253] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0102.253] GetProcessHeap () returned 0xd20000 [0102.253] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x26b6) returned 0xd4e2b8 [0102.253] ReadFile (in: hFile=0x230, lpBuffer=0xd4e2b8, nNumberOfBytesToRead=0x26b6, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4e2b8*, lpNumberOfBytesRead=0x299d7e8*=0x26b6, lpOverlapped=0x0) returned 1 [0102.254] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0102.254] WriteFile (in: hFile=0x230, lpBuffer=0xd4e2b8*, nNumberOfBytesToWrite=0x26b6, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4e2b8*, lpNumberOfBytesWritten=0x299d7e4*=0x26b6, lpOverlapped=0x0) returned 1 [0102.370] GetProcessHeap () returned 0xd20000 [0102.371] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4e2b8 | out: hHeap=0xd20000) returned 1 [0102.371] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0102.371] WriteFile (in: hFile=0x230, lpBuffer=0xd4e280*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e280*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0102.372] CloseHandle (hObject=0x230) returned 1 [0102.374] GetProcessHeap () returned 0xd20000 [0102.374] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42760 | out: hHeap=0xd20000) returned 1 [0102.374] GetProcessHeap () returned 0xd20000 [0102.374] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c160 | out: hHeap=0xd20000) returned 1 [0102.374] GetProcessHeap () returned 0xd20000 [0102.374] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0102.374] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat") returned="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" [0102.374] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat.[ponce.lorena@aol.com]" [0102.374] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.cat"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.cat.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0102.375] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.cat" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64") returned 1 [0102.375] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\") returned="" [0102.375] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\amd64\\HOW_RECOVER.html" [0102.375] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\amd64\\how_recover.html")) returned 0x20 [0102.376] GetProcessHeap () returned 0xd20000 [0102.376] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44510 | out: hHeap=0xd20000) returned 1 [0102.376] FindNextFileW (in: hFindFile=0xd491a0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a3e27, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a3e27, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x5d7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nxquery.inf", cAlternateFileName="")) returned 1 [0102.376] lstrcmpiW (lpString1="nxquery.inf", lpString2=".") returned 1 [0102.376] lstrcmpiW (lpString1="nxquery.inf", lpString2="..") returned 1 [0102.376] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="nxquery.inf" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf") returned="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" [0102.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nxquery.inf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0102.376] GetProcessHeap () returned 0xd20000 [0102.376] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd44630 [0102.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="nxquery.inf", cchWideChar=-1, lpMultiByteStr=0xd44630, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nxquery.inf", lpUsedDefaultChar=0x0) returned 12 [0102.376] lstrlenA (lpString="nxquery.inf") returned 11 [0102.376] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0102.376] lstrlenA (lpString="nxquery.inf") returned 11 [0102.376] lstrlenA (lpString=".dll") returned 4 [0102.376] lstrlenA (lpString=".dll") returned 4 [0102.376] lstrlenA (lpString="nxquery.inf") returned 11 [0102.376] lstrcmpiA (lpString1=".inf", lpString2=".dll") returned 1 [0102.377] lstrlenA (lpString="nxquery.inf") returned 11 [0102.377] lstrlenA (lpString=".ini") returned 4 [0102.377] lstrlenA (lpString=".ini") returned 4 [0102.377] lstrlenA (lpString="nxquery.inf") returned 11 [0102.377] lstrcmpiA (lpString1=".inf", lpString2=".ini") returned -1 [0102.377] lstrlenA (lpString="nxquery.inf") returned 11 [0102.377] lstrlenA (lpString=".inc") returned 4 [0102.377] lstrlenA (lpString=".inc") returned 4 [0102.377] lstrlenA (lpString="nxquery.inf") returned 11 [0102.377] lstrcmpiA (lpString1=".inf", lpString2=".inc") returned 1 [0102.377] lstrcmpiW (lpString1="nxquery.inf", lpString2="HOW_RECOVER.html") returned 1 [0102.377] lstrcmpiW (lpString1="nxquery.inf", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0102.377] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0102.377] lstrcmpiW (lpString1="nxquery.inf", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0102.377] GetProcessHeap () returned 0xd20000 [0102.377] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42580 [0102.377] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0102.378] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=1495) returned 1 [0102.378] GetProcessHeap () returned 0xd20000 [0102.378] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bcb0 [0102.378] GetProcessHeap () returned 0xd20000 [0102.378] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0102.378] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf") returned 47 [0102.378] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0102.378] GetProcessHeap () returned 0xd20000 [0102.378] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0102.379] GetProcessHeap () returned 0xd20000 [0102.379] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x389) returned 0xd4e2b8 [0102.379] lstrlenA (lpString="rsa_encrypt") returned 11 [0102.379] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0102.381] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0102.381] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0102.381] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0102.381] GetProcessHeap () returned 0xd20000 [0102.381] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0102.381] lstrlenA (lpString="010001") returned 6 [0102.381] GetProcessHeap () returned 0xd20000 [0102.381] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc38 [0102.382] GetProcessHeap () returned 0xd20000 [0102.382] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0102.382] GetProcessHeap () returned 0xd20000 [0102.382] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b638 [0102.382] GetProcessHeap () returned 0xd20000 [0102.382] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0102.382] GetProcessHeap () returned 0xd20000 [0102.382] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b878 [0102.382] GetProcessHeap () returned 0xd20000 [0102.382] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45640 [0102.382] GetProcessHeap () returned 0xd20000 [0102.382] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc28 [0102.382] GetProcessHeap () returned 0xd20000 [0102.382] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0102.382] GetProcessHeap () returned 0xd20000 [0102.382] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0102.382] GetProcessHeap () returned 0xd20000 [0102.382] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0102.382] GetProcessHeap () returned 0xd20000 [0102.382] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0102.382] GetProcessHeap () returned 0xd20000 [0102.382] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44920 [0102.382] GetProcessHeap () returned 0xd20000 [0102.383] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0102.383] GetProcessHeap () returned 0xd20000 [0102.383] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445a0 [0102.383] GetProcessHeap () returned 0xd20000 [0102.383] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aaf8 [0102.383] GetProcessHeap () returned 0xd20000 [0102.383] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0102.383] GetProcessHeap () returned 0xd20000 [0102.383] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0102.383] GetProcessHeap () returned 0xd20000 [0102.383] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aaf8 | out: hHeap=0xd20000) returned 1 [0102.383] GetProcessHeap () returned 0xd20000 [0102.383] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0102.383] GetProcessHeap () returned 0xd20000 [0102.383] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44558 [0102.383] GetProcessHeap () returned 0xd20000 [0102.383] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0102.383] GetProcessHeap () returned 0xd20000 [0102.383] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0102.383] GetProcessHeap () returned 0xd20000 [0102.383] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.383] GetProcessHeap () returned 0xd20000 [0102.384] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.384] GetProcessHeap () returned 0xd20000 [0102.384] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.384] GetProcessHeap () returned 0xd20000 [0102.384] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.384] GetProcessHeap () returned 0xd20000 [0102.384] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b518 [0102.384] GetProcessHeap () returned 0xd20000 [0102.384] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44558 | out: hHeap=0xd20000) returned 1 [0102.384] GetProcessHeap () returned 0xd20000 [0102.384] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0102.384] GetProcessHeap () returned 0xd20000 [0102.384] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0102.384] GetProcessHeap () returned 0xd20000 [0102.384] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.384] GetProcessHeap () returned 0xd20000 [0102.384] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.384] GetProcessHeap () returned 0xd20000 [0102.384] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.384] GetProcessHeap () returned 0xd20000 [0102.384] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.384] GetProcessHeap () returned 0xd20000 [0102.384] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0102.385] GetProcessHeap () returned 0xd20000 [0102.385] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0102.385] GetProcessHeap () returned 0xd20000 [0102.385] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.385] GetProcessHeap () returned 0xd20000 [0102.385] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.385] GetProcessHeap () returned 0xd20000 [0102.385] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.385] GetProcessHeap () returned 0xd20000 [0102.385] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.385] GetProcessHeap () returned 0xd20000 [0102.385] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.385] GetProcessHeap () returned 0xd20000 [0102.385] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.385] GetProcessHeap () returned 0xd20000 [0102.385] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0102.385] GetProcessHeap () returned 0xd20000 [0102.385] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0102.385] GetProcessHeap () returned 0xd20000 [0102.385] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.385] GetProcessHeap () returned 0xd20000 [0102.385] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.386] GetProcessHeap () returned 0xd20000 [0102.386] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.386] GetProcessHeap () returned 0xd20000 [0102.386] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.386] GetProcessHeap () returned 0xd20000 [0102.386] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.386] GetProcessHeap () returned 0xd20000 [0102.386] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.386] GetProcessHeap () returned 0xd20000 [0102.386] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.386] GetProcessHeap () returned 0xd20000 [0102.386] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.386] GetProcessHeap () returned 0xd20000 [0102.386] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.386] GetProcessHeap () returned 0xd20000 [0102.386] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.386] GetProcessHeap () returned 0xd20000 [0102.386] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.386] GetProcessHeap () returned 0xd20000 [0102.386] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.386] GetProcessHeap () returned 0xd20000 [0102.386] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.387] GetProcessHeap () returned 0xd20000 [0102.387] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.387] GetProcessHeap () returned 0xd20000 [0102.387] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0102.387] GetProcessHeap () returned 0xd20000 [0102.387] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0102.387] GetProcessHeap () returned 0xd20000 [0102.387] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.387] GetProcessHeap () returned 0xd20000 [0102.387] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.387] GetProcessHeap () returned 0xd20000 [0102.387] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0102.387] GetProcessHeap () returned 0xd20000 [0102.387] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0102.387] GetProcessHeap () returned 0xd20000 [0102.387] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.387] GetProcessHeap () returned 0xd20000 [0102.387] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.387] GetProcessHeap () returned 0xd20000 [0102.387] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.387] GetProcessHeap () returned 0xd20000 [0102.388] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.388] GetProcessHeap () returned 0xd20000 [0102.388] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0102.388] GetProcessHeap () returned 0xd20000 [0102.388] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0102.388] GetProcessHeap () returned 0xd20000 [0102.388] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.388] GetProcessHeap () returned 0xd20000 [0102.388] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.388] GetProcessHeap () returned 0xd20000 [0102.388] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0102.388] GetProcessHeap () returned 0xd20000 [0102.388] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0102.388] GetProcessHeap () returned 0xd20000 [0102.388] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0102.388] GetProcessHeap () returned 0xd20000 [0102.389] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0102.389] GetProcessHeap () returned 0xd20000 [0102.389] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0102.389] GetProcessHeap () returned 0xd20000 [0102.389] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0102.389] GetProcessHeap () returned 0xd20000 [0102.389] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.389] GetProcessHeap () returned 0xd20000 [0102.389] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.389] GetProcessHeap () returned 0xd20000 [0102.389] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0102.389] GetProcessHeap () returned 0xd20000 [0102.389] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0102.389] GetProcessHeap () returned 0xd20000 [0102.389] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.390] GetProcessHeap () returned 0xd20000 [0102.390] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.390] GetProcessHeap () returned 0xd20000 [0102.390] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0102.390] GetProcessHeap () returned 0xd20000 [0102.390] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0102.390] GetProcessHeap () returned 0xd20000 [0102.390] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.390] GetProcessHeap () returned 0xd20000 [0102.390] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.390] GetProcessHeap () returned 0xd20000 [0102.390] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.390] GetProcessHeap () returned 0xd20000 [0102.390] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.390] GetProcessHeap () returned 0xd20000 [0102.390] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.391] GetProcessHeap () returned 0xd20000 [0102.391] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.391] GetProcessHeap () returned 0xd20000 [0102.391] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0102.391] GetProcessHeap () returned 0xd20000 [0102.391] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0102.391] GetProcessHeap () returned 0xd20000 [0102.391] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0102.391] GetProcessHeap () returned 0xd20000 [0102.391] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0102.391] GetProcessHeap () returned 0xd20000 [0102.391] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.391] GetProcessHeap () returned 0xd20000 [0102.391] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.391] GetProcessHeap () returned 0xd20000 [0102.392] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.392] GetProcessHeap () returned 0xd20000 [0102.392] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.392] GetProcessHeap () returned 0xd20000 [0102.392] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0102.392] GetProcessHeap () returned 0xd20000 [0102.392] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0102.392] GetProcessHeap () returned 0xd20000 [0102.392] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.392] GetProcessHeap () returned 0xd20000 [0102.392] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.392] GetProcessHeap () returned 0xd20000 [0102.392] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.392] GetProcessHeap () returned 0xd20000 [0102.392] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.392] GetProcessHeap () returned 0xd20000 [0102.392] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.392] GetProcessHeap () returned 0xd20000 [0102.393] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.393] GetProcessHeap () returned 0xd20000 [0102.393] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0102.393] GetProcessHeap () returned 0xd20000 [0102.393] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0102.393] GetProcessHeap () returned 0xd20000 [0102.393] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0102.393] GetProcessHeap () returned 0xd20000 [0102.393] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0102.393] GetProcessHeap () returned 0xd20000 [0102.393] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.394] GetProcessHeap () returned 0xd20000 [0102.394] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.394] GetProcessHeap () returned 0xd20000 [0102.394] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0102.394] GetProcessHeap () returned 0xd20000 [0102.394] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0102.394] GetProcessHeap () returned 0xd20000 [0102.394] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.394] GetProcessHeap () returned 0xd20000 [0102.394] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.394] GetProcessHeap () returned 0xd20000 [0102.394] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.394] GetProcessHeap () returned 0xd20000 [0102.394] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.394] GetProcessHeap () returned 0xd20000 [0102.394] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0102.394] GetProcessHeap () returned 0xd20000 [0102.394] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0102.394] GetProcessHeap () returned 0xd20000 [0102.394] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.394] GetProcessHeap () returned 0xd20000 [0102.394] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.395] GetProcessHeap () returned 0xd20000 [0102.395] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.395] GetProcessHeap () returned 0xd20000 [0102.395] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.395] GetProcessHeap () returned 0xd20000 [0102.395] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.395] GetProcessHeap () returned 0xd20000 [0102.395] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.395] GetProcessHeap () returned 0xd20000 [0102.395] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.395] GetProcessHeap () returned 0xd20000 [0102.395] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.395] GetProcessHeap () returned 0xd20000 [0102.395] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0102.395] GetProcessHeap () returned 0xd20000 [0102.395] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0102.395] GetProcessHeap () returned 0xd20000 [0102.395] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.395] GetProcessHeap () returned 0xd20000 [0102.395] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.395] GetProcessHeap () returned 0xd20000 [0102.396] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0102.396] GetProcessHeap () returned 0xd20000 [0102.396] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0102.396] GetProcessHeap () returned 0xd20000 [0102.396] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.396] GetProcessHeap () returned 0xd20000 [0102.396] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.396] GetProcessHeap () returned 0xd20000 [0102.396] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.396] GetProcessHeap () returned 0xd20000 [0102.396] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.396] GetProcessHeap () returned 0xd20000 [0102.396] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.396] GetProcessHeap () returned 0xd20000 [0102.396] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.396] GetProcessHeap () returned 0xd20000 [0102.396] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.396] GetProcessHeap () returned 0xd20000 [0102.396] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.396] GetProcessHeap () returned 0xd20000 [0102.396] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.396] GetProcessHeap () returned 0xd20000 [0102.397] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.397] GetProcessHeap () returned 0xd20000 [0102.397] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.397] GetProcessHeap () returned 0xd20000 [0102.397] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.397] GetProcessHeap () returned 0xd20000 [0102.397] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0102.397] GetProcessHeap () returned 0xd20000 [0102.397] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0102.397] GetProcessHeap () returned 0xd20000 [0102.397] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.397] GetProcessHeap () returned 0xd20000 [0102.397] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.397] GetProcessHeap () returned 0xd20000 [0102.397] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.397] GetProcessHeap () returned 0xd20000 [0102.397] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.397] GetProcessHeap () returned 0xd20000 [0102.397] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.397] GetProcessHeap () returned 0xd20000 [0102.397] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.398] GetProcessHeap () returned 0xd20000 [0102.398] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0102.398] GetProcessHeap () returned 0xd20000 [0102.398] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0102.398] GetProcessHeap () returned 0xd20000 [0102.398] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.398] GetProcessHeap () returned 0xd20000 [0102.398] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.398] GetProcessHeap () returned 0xd20000 [0102.398] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.398] GetProcessHeap () returned 0xd20000 [0102.398] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.398] GetProcessHeap () returned 0xd20000 [0102.398] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.398] GetProcessHeap () returned 0xd20000 [0102.398] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.398] GetProcessHeap () returned 0xd20000 [0102.398] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.398] GetProcessHeap () returned 0xd20000 [0102.398] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.398] GetProcessHeap () returned 0xd20000 [0102.399] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.399] GetProcessHeap () returned 0xd20000 [0102.399] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.399] GetProcessHeap () returned 0xd20000 [0102.399] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.399] GetProcessHeap () returned 0xd20000 [0102.399] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.399] GetProcessHeap () returned 0xd20000 [0102.399] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.399] GetProcessHeap () returned 0xd20000 [0102.399] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.399] GetProcessHeap () returned 0xd20000 [0102.399] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.399] GetProcessHeap () returned 0xd20000 [0102.399] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.399] GetProcessHeap () returned 0xd20000 [0102.399] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.399] GetProcessHeap () returned 0xd20000 [0102.399] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.399] GetProcessHeap () returned 0xd20000 [0102.399] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.400] GetProcessHeap () returned 0xd20000 [0102.400] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.400] GetProcessHeap () returned 0xd20000 [0102.400] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0102.400] GetProcessHeap () returned 0xd20000 [0102.400] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0102.400] GetProcessHeap () returned 0xd20000 [0102.400] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.400] GetProcessHeap () returned 0xd20000 [0102.400] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.400] GetProcessHeap () returned 0xd20000 [0102.400] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0102.400] GetProcessHeap () returned 0xd20000 [0102.400] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0102.400] GetProcessHeap () returned 0xd20000 [0102.400] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.400] GetProcessHeap () returned 0xd20000 [0102.400] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.400] GetProcessHeap () returned 0xd20000 [0102.400] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0102.400] GetProcessHeap () returned 0xd20000 [0102.400] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0102.401] GetProcessHeap () returned 0xd20000 [0102.401] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0102.401] GetProcessHeap () returned 0xd20000 [0102.401] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0102.401] GetProcessHeap () returned 0xd20000 [0102.401] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.401] GetProcessHeap () returned 0xd20000 [0102.401] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.401] GetProcessHeap () returned 0xd20000 [0102.401] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0102.401] GetProcessHeap () returned 0xd20000 [0102.401] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.401] GetProcessHeap () returned 0xd20000 [0102.401] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.401] GetProcessHeap () returned 0xd20000 [0102.401] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.401] GetProcessHeap () returned 0xd20000 [0102.401] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0102.401] GetProcessHeap () returned 0xd20000 [0102.401] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0102.401] GetProcessHeap () returned 0xd20000 [0102.402] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.402] GetProcessHeap () returned 0xd20000 [0102.402] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.402] GetProcessHeap () returned 0xd20000 [0102.402] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0102.402] GetProcessHeap () returned 0xd20000 [0102.402] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0102.402] GetProcessHeap () returned 0xd20000 [0102.402] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0102.402] GetProcessHeap () returned 0xd20000 [0102.402] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0102.402] GetProcessHeap () returned 0xd20000 [0102.402] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445a0 | out: hHeap=0xd20000) returned 1 [0102.402] GetProcessHeap () returned 0xd20000 [0102.402] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b878 | out: hHeap=0xd20000) returned 1 [0102.402] GetProcessHeap () returned 0xd20000 [0102.402] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0102.402] GetProcessHeap () returned 0xd20000 [0102.402] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b638 | out: hHeap=0xd20000) returned 1 [0102.403] GetProcessHeap () returned 0xd20000 [0102.403] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0102.403] GetProcessHeap () returned 0xd20000 [0102.403] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0102.403] GetProcessHeap () returned 0xd20000 [0102.403] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0102.403] WriteFile (in: hFile=0x230, lpBuffer=0xd4e2b8*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e2b8*, lpNumberOfBytesWritten=0x299d864*=0x389, lpOverlapped=0x0) returned 1 [0102.408] GetProcessHeap () returned 0xd20000 [0102.408] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4e2b8, Size=0x30) returned 0xd4e2b8 [0102.408] GetProcessHeap () returned 0xd20000 [0102.408] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0102.408] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0102.408] GetProcessHeap () returned 0xd20000 [0102.409] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x5e0) returned 0xd4e2f0 [0102.409] ReadFile (in: hFile=0x230, lpBuffer=0xd4e2f0, nNumberOfBytesToRead=0x5e0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4e2f0*, lpNumberOfBytesRead=0x299d7e8*=0x5e0, lpOverlapped=0x0) returned 1 [0102.409] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0102.409] WriteFile (in: hFile=0x230, lpBuffer=0xd4e2f0*, nNumberOfBytesToWrite=0x5e0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4e2f0*, lpNumberOfBytesWritten=0x299d7e4*=0x5e0, lpOverlapped=0x0) returned 1 [0102.410] GetProcessHeap () returned 0xd20000 [0102.410] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4e2f0 | out: hHeap=0xd20000) returned 1 [0102.410] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0102.410] WriteFile (in: hFile=0x230, lpBuffer=0xd4e2b8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e2b8*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0102.412] CloseHandle (hObject=0x230) returned 1 [0102.414] GetProcessHeap () returned 0xd20000 [0102.414] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42580 | out: hHeap=0xd20000) returned 1 [0102.414] GetProcessHeap () returned 0xd20000 [0102.414] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bcb0 | out: hHeap=0xd20000) returned 1 [0102.414] GetProcessHeap () returned 0xd20000 [0102.414] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0102.414] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf") returned="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" [0102.414] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf.[ponce.lorena@aol.com]" [0102.414] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.inf"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.inf.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0102.415] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\nxquery.inf" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64") returned 1 [0102.415] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\") returned="" [0102.415] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\amd64\\HOW_RECOVER.html" [0102.415] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\amd64\\how_recover.html")) returned 0x20 [0102.415] GetProcessHeap () returned 0xd20000 [0102.415] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44630 | out: hHeap=0xd20000) returned 1 [0102.416] FindNextFileW (in: hFindFile=0xd491a0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a652e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a652e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x50b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NXQuery.sys", cAlternateFileName="")) returned 1 [0102.416] lstrcmpiW (lpString1="NXQuery.sys", lpString2=".") returned 1 [0102.416] lstrcmpiW (lpString1="NXQuery.sys", lpString2="..") returned 1 [0102.416] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="NXQuery.sys" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys") returned="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys" [0102.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NXQuery.sys", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0102.416] GetProcessHeap () returned 0xd20000 [0102.416] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd446c0 [0102.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NXQuery.sys", cchWideChar=-1, lpMultiByteStr=0xd446c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NXQuery.sys", lpUsedDefaultChar=0x0) returned 12 [0102.416] lstrlenA (lpString="NXQuery.sys") returned 11 [0102.416] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0102.416] lstrlenA (lpString="NXQuery.sys") returned 11 [0102.416] lstrlenA (lpString=".dll") returned 4 [0102.416] lstrlenA (lpString=".dll") returned 4 [0102.416] lstrlenA (lpString="NXQuery.sys") returned 11 [0102.416] lstrcmpiA (lpString1=".sys", lpString2=".dll") returned 1 [0102.416] lstrlenA (lpString="NXQuery.sys") returned 11 [0102.416] lstrlenA (lpString=".ini") returned 4 [0102.417] lstrlenA (lpString=".ini") returned 4 [0102.417] lstrlenA (lpString="NXQuery.sys") returned 11 [0102.417] lstrcmpiA (lpString1=".sys", lpString2=".ini") returned 1 [0102.417] lstrlenA (lpString="NXQuery.sys") returned 11 [0102.417] lstrlenA (lpString=".inc") returned 4 [0102.417] lstrlenA (lpString=".inc") returned 4 [0102.417] lstrlenA (lpString="NXQuery.sys") returned 11 [0102.417] lstrcmpiA (lpString1=".sys", lpString2=".inc") returned 1 [0102.417] lstrcmpiW (lpString1="NXQuery.sys", lpString2="HOW_RECOVER.html") returned 1 [0102.417] lstrcmpiW (lpString1="NXQuery.sys", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0102.417] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0102.417] lstrcmpiW (lpString1="NXQuery.sys", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0102.417] GetProcessHeap () returned 0xd20000 [0102.417] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42738 [0102.417] CreateFileW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0102.418] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=20656) returned 1 [0102.418] GetProcessHeap () returned 0xd20000 [0102.418] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bf08 [0102.418] GetProcessHeap () returned 0xd20000 [0102.418] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0102.418] lstrlenW (lpString="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys") returned 47 [0102.418] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0102.418] GetProcessHeap () returned 0xd20000 [0102.418] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0102.418] GetProcessHeap () returned 0xd20000 [0102.418] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4e2f0 [0102.419] lstrlenA (lpString="rsa_encrypt") returned 11 [0102.419] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0102.421] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0102.421] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0102.421] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0102.421] GetProcessHeap () returned 0xd20000 [0102.421] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0102.421] lstrlenA (lpString="010001") returned 6 [0102.421] GetProcessHeap () returned 0xd20000 [0102.421] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0102.421] GetProcessHeap () returned 0xd20000 [0102.421] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0102.421] GetProcessHeap () returned 0xd20000 [0102.421] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b098 [0102.421] GetProcessHeap () returned 0xd20000 [0102.421] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0102.422] GetProcessHeap () returned 0xd20000 [0102.422] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b7e8 [0102.422] GetProcessHeap () returned 0xd20000 [0102.422] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44a38 [0102.422] GetProcessHeap () returned 0xd20000 [0102.422] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cbc8 [0102.422] GetProcessHeap () returned 0xd20000 [0102.422] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0102.422] GetProcessHeap () returned 0xd20000 [0102.422] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0102.422] GetProcessHeap () returned 0xd20000 [0102.422] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0102.422] GetProcessHeap () returned 0xd20000 [0102.422] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0102.422] GetProcessHeap () returned 0xd20000 [0102.422] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44c68 [0102.422] GetProcessHeap () returned 0xd20000 [0102.422] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.422] GetProcessHeap () returned 0xd20000 [0102.422] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446f0 [0102.423] GetProcessHeap () returned 0xd20000 [0102.423] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4adc8 [0102.423] GetProcessHeap () returned 0xd20000 [0102.423] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0102.423] GetProcessHeap () returned 0xd20000 [0102.423] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0102.423] GetProcessHeap () returned 0xd20000 [0102.423] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4adc8 | out: hHeap=0xd20000) returned 1 [0102.423] GetProcessHeap () returned 0xd20000 [0102.423] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0102.423] GetProcessHeap () returned 0xd20000 [0102.423] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44510 [0102.423] GetProcessHeap () returned 0xd20000 [0102.423] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.423] GetProcessHeap () returned 0xd20000 [0102.423] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0102.423] GetProcessHeap () returned 0xd20000 [0102.423] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.423] GetProcessHeap () returned 0xd20000 [0102.424] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.424] GetProcessHeap () returned 0xd20000 [0102.424] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.424] GetProcessHeap () returned 0xd20000 [0102.424] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.424] GetProcessHeap () returned 0xd20000 [0102.424] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b128 [0102.424] GetProcessHeap () returned 0xd20000 [0102.424] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44510 | out: hHeap=0xd20000) returned 1 [0102.424] GetProcessHeap () returned 0xd20000 [0102.425] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0102.425] GetProcessHeap () returned 0xd20000 [0102.425] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b128 | out: hHeap=0xd20000) returned 1 [0102.425] GetProcessHeap () returned 0xd20000 [0102.425] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.425] GetProcessHeap () returned 0xd20000 [0102.425] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.425] GetProcessHeap () returned 0xd20000 [0102.425] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.425] GetProcessHeap () returned 0xd20000 [0102.425] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.425] GetProcessHeap () returned 0xd20000 [0102.425] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.425] GetProcessHeap () returned 0xd20000 [0102.425] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.425] GetProcessHeap () returned 0xd20000 [0102.425] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0102.425] GetProcessHeap () returned 0xd20000 [0102.425] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0102.426] GetProcessHeap () returned 0xd20000 [0102.426] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.426] GetProcessHeap () returned 0xd20000 [0102.426] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.426] GetProcessHeap () returned 0xd20000 [0102.426] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0102.426] GetProcessHeap () returned 0xd20000 [0102.426] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0102.426] GetProcessHeap () returned 0xd20000 [0102.426] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.426] GetProcessHeap () returned 0xd20000 [0102.426] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.426] GetProcessHeap () returned 0xd20000 [0102.426] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.426] GetProcessHeap () returned 0xd20000 [0102.426] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.426] GetProcessHeap () returned 0xd20000 [0102.426] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.426] GetProcessHeap () returned 0xd20000 [0102.426] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.427] GetProcessHeap () returned 0xd20000 [0102.427] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.427] GetProcessHeap () returned 0xd20000 [0102.427] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.427] GetProcessHeap () returned 0xd20000 [0102.427] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.427] GetProcessHeap () returned 0xd20000 [0102.427] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.427] GetProcessHeap () returned 0xd20000 [0102.427] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.427] GetProcessHeap () returned 0xd20000 [0102.427] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.427] GetProcessHeap () returned 0xd20000 [0102.427] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.427] GetProcessHeap () returned 0xd20000 [0102.427] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.427] GetProcessHeap () returned 0xd20000 [0102.427] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.427] GetProcessHeap () returned 0xd20000 [0102.428] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.428] GetProcessHeap () returned 0xd20000 [0102.428] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.428] GetProcessHeap () returned 0xd20000 [0102.428] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.428] GetProcessHeap () returned 0xd20000 [0102.428] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.428] GetProcessHeap () returned 0xd20000 [0102.428] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.428] GetProcessHeap () returned 0xd20000 [0102.428] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.428] GetProcessHeap () returned 0xd20000 [0102.428] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.428] GetProcessHeap () returned 0xd20000 [0102.428] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0102.428] GetProcessHeap () returned 0xd20000 [0102.428] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0102.428] GetProcessHeap () returned 0xd20000 [0102.428] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.428] GetProcessHeap () returned 0xd20000 [0102.429] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.429] GetProcessHeap () returned 0xd20000 [0102.429] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0102.429] GetProcessHeap () returned 0xd20000 [0102.429] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0102.429] GetProcessHeap () returned 0xd20000 [0102.429] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.429] GetProcessHeap () returned 0xd20000 [0102.429] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.429] GetProcessHeap () returned 0xd20000 [0102.429] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.429] GetProcessHeap () returned 0xd20000 [0102.429] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.429] GetProcessHeap () returned 0xd20000 [0102.429] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.429] GetProcessHeap () returned 0xd20000 [0102.429] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.429] GetProcessHeap () returned 0xd20000 [0102.429] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.429] GetProcessHeap () returned 0xd20000 [0102.430] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.430] GetProcessHeap () returned 0xd20000 [0102.430] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc08 [0102.430] GetProcessHeap () returned 0xd20000 [0102.430] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0102.430] GetProcessHeap () returned 0xd20000 [0102.430] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.430] GetProcessHeap () returned 0xd20000 [0102.430] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.430] GetProcessHeap () returned 0xd20000 [0102.430] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0102.430] GetProcessHeap () returned 0xd20000 [0102.430] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0102.430] GetProcessHeap () returned 0xd20000 [0102.430] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.430] GetProcessHeap () returned 0xd20000 [0102.430] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.430] GetProcessHeap () returned 0xd20000 [0102.430] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.431] GetProcessHeap () returned 0xd20000 [0102.431] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.431] GetProcessHeap () returned 0xd20000 [0102.431] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0102.431] GetProcessHeap () returned 0xd20000 [0102.431] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0102.431] GetProcessHeap () returned 0xd20000 [0102.431] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.431] GetProcessHeap () returned 0xd20000 [0102.431] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.431] GetProcessHeap () returned 0xd20000 [0102.431] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.431] GetProcessHeap () returned 0xd20000 [0102.431] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.431] GetProcessHeap () returned 0xd20000 [0102.431] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.431] GetProcessHeap () returned 0xd20000 [0102.431] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.431] GetProcessHeap () returned 0xd20000 [0102.432] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0102.432] GetProcessHeap () returned 0xd20000 [0102.432] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0102.432] GetProcessHeap () returned 0xd20000 [0102.432] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0102.432] GetProcessHeap () returned 0xd20000 [0102.432] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0102.432] GetProcessHeap () returned 0xd20000 [0102.432] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.432] GetProcessHeap () returned 0xd20000 [0102.432] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.432] GetProcessHeap () returned 0xd20000 [0102.432] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.432] GetProcessHeap () returned 0xd20000 [0102.432] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.432] GetProcessHeap () returned 0xd20000 [0102.432] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.432] GetProcessHeap () returned 0xd20000 [0102.432] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.433] GetProcessHeap () returned 0xd20000 [0102.433] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.433] GetProcessHeap () returned 0xd20000 [0102.433] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.433] GetProcessHeap () returned 0xd20000 [0102.433] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.433] GetProcessHeap () returned 0xd20000 [0102.433] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.433] GetProcessHeap () returned 0xd20000 [0102.433] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.433] GetProcessHeap () returned 0xd20000 [0102.433] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.433] GetProcessHeap () returned 0xd20000 [0102.433] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.433] GetProcessHeap () returned 0xd20000 [0102.433] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.433] GetProcessHeap () returned 0xd20000 [0102.433] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.433] GetProcessHeap () returned 0xd20000 [0102.433] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.433] GetProcessHeap () returned 0xd20000 [0102.434] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0102.434] GetProcessHeap () returned 0xd20000 [0102.434] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0102.434] GetProcessHeap () returned 0xd20000 [0102.434] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.434] GetProcessHeap () returned 0xd20000 [0102.434] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.434] GetProcessHeap () returned 0xd20000 [0102.434] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0102.434] GetProcessHeap () returned 0xd20000 [0102.434] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0102.434] GetProcessHeap () returned 0xd20000 [0102.434] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.434] GetProcessHeap () returned 0xd20000 [0102.434] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.434] GetProcessHeap () returned 0xd20000 [0102.434] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.434] GetProcessHeap () returned 0xd20000 [0102.434] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.435] GetProcessHeap () returned 0xd20000 [0102.435] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.435] GetProcessHeap () returned 0xd20000 [0102.435] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.435] GetProcessHeap () returned 0xd20000 [0102.435] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0102.435] GetProcessHeap () returned 0xd20000 [0102.435] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0102.435] GetProcessHeap () returned 0xd20000 [0102.435] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.435] GetProcessHeap () returned 0xd20000 [0102.435] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.435] GetProcessHeap () returned 0xd20000 [0102.435] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.435] GetProcessHeap () returned 0xd20000 [0102.435] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.435] GetProcessHeap () returned 0xd20000 [0102.435] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.435] GetProcessHeap () returned 0xd20000 [0102.435] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.435] GetProcessHeap () returned 0xd20000 [0102.436] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.436] GetProcessHeap () returned 0xd20000 [0102.436] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.436] GetProcessHeap () returned 0xd20000 [0102.436] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.436] GetProcessHeap () returned 0xd20000 [0102.436] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.436] GetProcessHeap () returned 0xd20000 [0102.436] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0102.436] GetProcessHeap () returned 0xd20000 [0102.436] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0102.436] GetProcessHeap () returned 0xd20000 [0102.436] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.436] GetProcessHeap () returned 0xd20000 [0102.436] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.436] GetProcessHeap () returned 0xd20000 [0102.436] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0102.436] GetProcessHeap () returned 0xd20000 [0102.436] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0102.437] GetProcessHeap () returned 0xd20000 [0102.437] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.437] GetProcessHeap () returned 0xd20000 [0102.437] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.437] GetProcessHeap () returned 0xd20000 [0102.437] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.437] GetProcessHeap () returned 0xd20000 [0102.437] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.437] GetProcessHeap () returned 0xd20000 [0102.437] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0102.437] GetProcessHeap () returned 0xd20000 [0102.437] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0102.437] GetProcessHeap () returned 0xd20000 [0102.437] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.437] GetProcessHeap () returned 0xd20000 [0102.437] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.437] GetProcessHeap () returned 0xd20000 [0102.437] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.437] GetProcessHeap () returned 0xd20000 [0102.437] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.438] GetProcessHeap () returned 0xd20000 [0102.438] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.438] GetProcessHeap () returned 0xd20000 [0102.438] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.438] GetProcessHeap () returned 0xd20000 [0102.438] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.438] GetProcessHeap () returned 0xd20000 [0102.438] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.438] GetProcessHeap () returned 0xd20000 [0102.438] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.438] GetProcessHeap () returned 0xd20000 [0102.438] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.438] GetProcessHeap () returned 0xd20000 [0102.438] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.438] GetProcessHeap () returned 0xd20000 [0102.438] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.438] GetProcessHeap () returned 0xd20000 [0102.438] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.438] GetProcessHeap () returned 0xd20000 [0102.438] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.439] GetProcessHeap () returned 0xd20000 [0102.439] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0102.439] GetProcessHeap () returned 0xd20000 [0102.439] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0102.439] GetProcessHeap () returned 0xd20000 [0102.439] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.439] GetProcessHeap () returned 0xd20000 [0102.439] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.439] GetProcessHeap () returned 0xd20000 [0102.439] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.439] GetProcessHeap () returned 0xd20000 [0102.439] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.439] GetProcessHeap () returned 0xd20000 [0102.439] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0102.439] GetProcessHeap () returned 0xd20000 [0102.439] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0102.440] GetProcessHeap () returned 0xd20000 [0102.440] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc38 [0102.440] GetProcessHeap () returned 0xd20000 [0102.440] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc38 | out: hHeap=0xd20000) returned 1 [0102.440] GetProcessHeap () returned 0xd20000 [0102.441] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdb8 [0102.441] GetProcessHeap () returned 0xd20000 [0102.441] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdb8 | out: hHeap=0xd20000) returned 1 [0102.441] GetProcessHeap () returned 0xd20000 [0102.441] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.441] GetProcessHeap () returned 0xd20000 [0102.441] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.441] GetProcessHeap () returned 0xd20000 [0102.441] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0102.441] GetProcessHeap () returned 0xd20000 [0102.441] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0102.441] GetProcessHeap () returned 0xd20000 [0102.441] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.441] GetProcessHeap () returned 0xd20000 [0102.441] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.441] GetProcessHeap () returned 0xd20000 [0102.441] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0102.441] GetProcessHeap () returned 0xd20000 [0102.441] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0102.441] GetProcessHeap () returned 0xd20000 [0102.442] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.442] GetProcessHeap () returned 0xd20000 [0102.442] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.442] GetProcessHeap () returned 0xd20000 [0102.442] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0102.442] GetProcessHeap () returned 0xd20000 [0102.442] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0102.442] GetProcessHeap () returned 0xd20000 [0102.442] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd88 [0102.442] GetProcessHeap () returned 0xd20000 [0102.442] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0102.442] GetProcessHeap () returned 0xd20000 [0102.442] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.442] GetProcessHeap () returned 0xd20000 [0102.442] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.442] GetProcessHeap () returned 0xd20000 [0102.442] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbf8 [0102.442] GetProcessHeap () returned 0xd20000 [0102.442] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbf8 | out: hHeap=0xd20000) returned 1 [0102.443] GetProcessHeap () returned 0xd20000 [0102.443] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.443] GetProcessHeap () returned 0xd20000 [0102.443] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.443] GetProcessHeap () returned 0xd20000 [0102.443] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.443] GetProcessHeap () returned 0xd20000 [0102.443] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.443] GetProcessHeap () returned 0xd20000 [0102.443] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0102.443] GetProcessHeap () returned 0xd20000 [0102.443] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0102.443] GetProcessHeap () returned 0xd20000 [0102.443] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0102.443] GetProcessHeap () returned 0xd20000 [0102.443] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0102.443] GetProcessHeap () returned 0xd20000 [0102.443] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446f0 | out: hHeap=0xd20000) returned 1 [0102.443] GetProcessHeap () returned 0xd20000 [0102.444] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0102.444] GetProcessHeap () returned 0xd20000 [0102.444] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0102.444] GetProcessHeap () returned 0xd20000 [0102.444] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b098 | out: hHeap=0xd20000) returned 1 [0102.444] GetProcessHeap () returned 0xd20000 [0102.444] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0102.444] GetProcessHeap () returned 0xd20000 [0102.444] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.444] GetProcessHeap () returned 0xd20000 [0102.444] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0102.444] WriteFile (in: hFile=0x230, lpBuffer=0xd4e2f0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e2f0*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0102.450] GetProcessHeap () returned 0xd20000 [0102.450] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4e2f0, Size=0x30) returned 0xd4e2f0 [0102.450] GetProcessHeap () returned 0xd20000 [0102.450] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0102.450] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0102.450] GetProcessHeap () returned 0xd20000 [0102.450] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x50b0) returned 0xd4e328 [0102.450] ReadFile (in: hFile=0x230, lpBuffer=0xd4e328, nNumberOfBytesToRead=0x50b0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4e328*, lpNumberOfBytesRead=0x299d7e8*=0x50b0, lpOverlapped=0x0) returned 1 [0102.452] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0102.452] WriteFile (in: hFile=0x230, lpBuffer=0xd4e328*, nNumberOfBytesToWrite=0x50b0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4e328*, lpNumberOfBytesWritten=0x299d7e4*=0x50b0, lpOverlapped=0x0) returned 1 [0102.457] GetProcessHeap () returned 0xd20000 [0102.457] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4e328 | out: hHeap=0xd20000) returned 1 [0102.457] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0102.458] WriteFile (in: hFile=0x230, lpBuffer=0xd4e2f0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e2f0*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0102.459] CloseHandle (hObject=0x230) returned 1 [0102.461] GetProcessHeap () returned 0xd20000 [0102.461] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42738 | out: hHeap=0xd20000) returned 1 [0102.461] GetProcessHeap () returned 0xd20000 [0102.461] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bf08 | out: hHeap=0xd20000) returned 1 [0102.461] GetProcessHeap () returned 0xd20000 [0102.461] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0102.461] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys") returned="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys" [0102.462] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys.[ponce.lorena@aol.com]") returned="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys.[ponce.lorena@aol.com]" [0102.462] MoveFileExW (lpExistingFileName="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.sys"), lpNewFileName="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys.[ponce.lorena@aol.com]" (normalized: "c:\\windows10upgrade\\resources\\amd64\\nxquery.sys.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0102.462] PathRemoveFileSpecW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\NXQuery.sys" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64") returned 1 [0102.462] PathAddBackslashW (in: pszPath="C:\\Windows10Upgrade\\resources\\amd64" | out: pszPath="C:\\Windows10Upgrade\\resources\\amd64\\") returned="" [0102.463] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Windows10Upgrade\\resources\\amd64\\HOW_RECOVER.html") returned="C:\\Windows10Upgrade\\resources\\amd64\\HOW_RECOVER.html" [0102.463] GetFileAttributesW (lpFileName="C:\\Windows10Upgrade\\resources\\amd64\\HOW_RECOVER.html" (normalized: "c:\\windows10upgrade\\resources\\amd64\\how_recover.html")) returned 0x20 [0102.463] GetProcessHeap () returned 0xd20000 [0102.463] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446c0 | out: hHeap=0xd20000) returned 1 [0102.463] FindNextFileW (in: hFindFile=0xd491a0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3a652e, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea3a652e, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0x50b0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NXQuery.sys", cAlternateFileName="")) returned 0 [0102.463] FindClose (in: hFindFile=0xd491a0 | out: hFindFile=0xd491a0) returned 1 [0102.463] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Windows10Upgrade\\dll2\\" | out: lpString1="C:\\Windows10Upgrade\\dll2\\") returned="C:\\Windows10Upgrade\\dll2\\" [0102.463] GetProcessHeap () returned 0xd20000 [0102.463] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd49160 | out: hHeap=0xd20000) returned 1 [0102.463] GetProcessHeap () returned 0xd20000 [0102.463] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0102.463] lstrlenW (lpString="C:\\Windows10Upgrade\\dll2\\") returned 25 [0102.463] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll2\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\dll2\\*") returned="C:\\Windows10Upgrade\\dll2\\*" [0102.463] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\dll2\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea37cd05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37cd05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37e09b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd36d08 [0102.464] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0102.464] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea37cd05, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37cd05, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37e09b, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.464] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0102.464] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0102.464] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37e09b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37e09b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xb8400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 1 [0102.464] lstrcmpiW (lpString1="webservices.dll", lpString2=".") returned 1 [0102.464] lstrcmpiW (lpString1="webservices.dll", lpString2="..") returned 1 [0102.464] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll2\\", lpString2="webservices.dll" | out: lpString1="C:\\Windows10Upgrade\\dll2\\webservices.dll") returned="C:\\Windows10Upgrade\\dll2\\webservices.dll" [0102.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="webservices.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0102.464] GetProcessHeap () returned 0xd20000 [0102.464] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd446a8 [0102.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="webservices.dll", cchWideChar=-1, lpMultiByteStr=0xd446a8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="webservices.dll", lpUsedDefaultChar=0x0) returned 16 [0102.464] lstrlenA (lpString="webservices.dll") returned 15 [0102.465] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0102.465] lstrlenA (lpString="webservices.dll") returned 15 [0102.465] lstrlenA (lpString=".dll") returned 4 [0102.465] lstrlenA (lpString=".dll") returned 4 [0102.465] lstrlenA (lpString="webservices.dll") returned 15 [0102.465] lstrcmpiA (lpString1=".dll", lpString2=".dll") returned 0 [0102.465] GetProcessHeap () returned 0xd20000 [0102.465] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446a8 | out: hHeap=0xd20000) returned 1 [0102.465] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37e09b, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37e09b, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0x626300, ftLastWriteTime.dwHighDateTime=0x1d2ea8a, nFileSizeHigh=0x0, nFileSizeLow=0xb8400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 0 [0102.465] FindClose (in: hFindFile=0xd36d08 | out: hFindFile=0xd36d08) returned 1 [0102.465] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Windows10Upgrade\\dll1\\" | out: lpString1="C:\\Windows10Upgrade\\dll1\\") returned="C:\\Windows10Upgrade\\dll1\\" [0102.465] GetProcessHeap () returned 0xd20000 [0102.465] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36a88 | out: hHeap=0xd20000) returned 1 [0102.465] GetProcessHeap () returned 0xd20000 [0102.465] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0102.465] lstrlenW (lpString="C:\\Windows10Upgrade\\dll1\\") returned 25 [0102.465] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll1\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\dll1\\*") returned="C:\\Windows10Upgrade\\dll1\\*" [0102.465] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\dll1\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3757e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37926f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd36d08 [0102.466] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0102.466] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea3757e9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea37926f, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.467] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0102.467] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0102.467] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea376b75, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea376b75, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x204c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="cosqueryxp.dll", cAlternateFileName="COSQUE~1.DLL")) returned 1 [0102.467] lstrcmpiW (lpString1="cosqueryxp.dll", lpString2=".") returned 1 [0102.467] lstrcmpiW (lpString1="cosqueryxp.dll", lpString2="..") returned 1 [0102.467] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll1\\", lpString2="cosqueryxp.dll" | out: lpString1="C:\\Windows10Upgrade\\dll1\\cosqueryxp.dll") returned="C:\\Windows10Upgrade\\dll1\\cosqueryxp.dll" [0102.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cosqueryxp.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0102.467] GetProcessHeap () returned 0xd20000 [0102.467] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd444c8 [0102.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="cosqueryxp.dll", cchWideChar=-1, lpMultiByteStr=0xd444c8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cosqueryxp.dll", lpUsedDefaultChar=0x0) returned 15 [0102.467] lstrlenA (lpString="cosqueryxp.dll") returned 14 [0102.467] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0102.467] lstrlenA (lpString="cosqueryxp.dll") returned 14 [0102.467] lstrlenA (lpString=".dll") returned 4 [0102.467] lstrlenA (lpString=".dll") returned 4 [0102.467] lstrlenA (lpString="cosqueryxp.dll") returned 14 [0102.467] lstrcmpiA (lpString1=".dll", lpString2=".dll") returned 0 [0102.467] GetProcessHeap () returned 0xd20000 [0102.467] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444c8 | out: hHeap=0xd20000) returned 1 [0102.467] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea377ed3, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea377ed3, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x3b0c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="wdscore.dll", cAlternateFileName="")) returned 1 [0102.468] lstrcmpiW (lpString1="wdscore.dll", lpString2=".") returned 1 [0102.468] lstrcmpiW (lpString1="wdscore.dll", lpString2="..") returned 1 [0102.468] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll1\\", lpString2="wdscore.dll" | out: lpString1="C:\\Windows10Upgrade\\dll1\\wdscore.dll") returned="C:\\Windows10Upgrade\\dll1\\wdscore.dll" [0102.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wdscore.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0102.468] GetProcessHeap () returned 0xd20000 [0102.468] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd44690 [0102.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="wdscore.dll", cchWideChar=-1, lpMultiByteStr=0xd44690, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wdscore.dll", lpUsedDefaultChar=0x0) returned 12 [0102.468] lstrlenA (lpString="wdscore.dll") returned 11 [0102.468] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0102.468] lstrlenA (lpString="wdscore.dll") returned 11 [0102.468] lstrlenA (lpString=".dll") returned 4 [0102.468] lstrlenA (lpString=".dll") returned 4 [0102.468] lstrlenA (lpString="wdscore.dll") returned 11 [0102.468] lstrcmpiA (lpString1=".dll", lpString2=".dll") returned 0 [0102.468] GetProcessHeap () returned 0xd20000 [0102.468] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44690 | out: hHeap=0xd20000) returned 1 [0102.468] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37926f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37926f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xe9ec8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 1 [0102.468] lstrcmpiW (lpString1="webservices.dll", lpString2=".") returned 1 [0102.468] lstrcmpiW (lpString1="webservices.dll", lpString2="..") returned 1 [0102.468] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\dll1\\", lpString2="webservices.dll" | out: lpString1="C:\\Windows10Upgrade\\dll1\\webservices.dll") returned="C:\\Windows10Upgrade\\dll1\\webservices.dll" [0102.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="webservices.dll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0102.469] GetProcessHeap () returned 0xd20000 [0102.469] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd44408 [0102.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="webservices.dll", cchWideChar=-1, lpMultiByteStr=0xd44408, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="webservices.dll", lpUsedDefaultChar=0x0) returned 16 [0102.469] lstrlenA (lpString="webservices.dll") returned 15 [0102.469] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0102.469] lstrlenA (lpString="webservices.dll") returned 15 [0102.469] lstrlenA (lpString=".dll") returned 4 [0102.469] lstrlenA (lpString=".dll") returned 4 [0102.469] lstrlenA (lpString="webservices.dll") returned 15 [0102.469] lstrcmpiA (lpString1=".dll", lpString2=".dll") returned 0 [0102.469] GetProcessHeap () returned 0xd20000 [0102.469] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44408 | out: hHeap=0xd20000) returned 1 [0102.469] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea37926f, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea37926f, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0xe9ec8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="webservices.dll", cAlternateFileName="WEBSER~1.DLL")) returned 0 [0102.469] FindClose (in: hFindFile=0xd36d08 | out: hFindFile=0xd36d08) returned 1 [0102.469] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Windows10Upgrade\\2052\\" | out: lpString1="C:\\Windows10Upgrade\\2052\\") returned="C:\\Windows10Upgrade\\2052\\" [0102.469] GetProcessHeap () returned 0xd20000 [0102.469] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36948 | out: hHeap=0xd20000) returned 1 [0102.469] GetProcessHeap () returned 0xd20000 [0102.470] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0102.470] lstrlenW (lpString="C:\\Windows10Upgrade\\2052\\") returned 25 [0102.470] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\2052\\", lpString2="*" | out: lpString1="C:\\Windows10Upgrade\\2052\\*") returned="C:\\Windows10Upgrade\\2052\\*" [0102.470] FindFirstFileW (in: lpFileName="C:\\Windows10Upgrade\\2052\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea35483d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea355be9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd36d08 [0102.470] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0102.470] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea35483d, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea355be9, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.470] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0102.470] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0102.470] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea355be9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x1cec8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DWINTL20.DLL", cAlternateFileName="")) returned 1 [0102.470] lstrcmpiW (lpString1="DWINTL20.DLL", lpString2=".") returned 1 [0102.470] lstrcmpiW (lpString1="DWINTL20.DLL", lpString2="..") returned 1 [0102.470] lstrcatW (in: lpString1="C:\\Windows10Upgrade\\2052\\", lpString2="DWINTL20.DLL" | out: lpString1="C:\\Windows10Upgrade\\2052\\DWINTL20.DLL") returned="C:\\Windows10Upgrade\\2052\\DWINTL20.DLL" [0102.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DWINTL20.DLL", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0102.470] GetProcessHeap () returned 0xd20000 [0102.470] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xd) returned 0xd444e0 [0102.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DWINTL20.DLL", cchWideChar=-1, lpMultiByteStr=0xd444e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DWINTL20.DLL", lpUsedDefaultChar=0x0) returned 13 [0102.471] lstrlenA (lpString="DWINTL20.DLL") returned 12 [0102.471] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0102.471] lstrlenA (lpString="DWINTL20.DLL") returned 12 [0102.471] lstrlenA (lpString=".dll") returned 4 [0102.471] lstrlenA (lpString=".dll") returned 4 [0102.471] lstrlenA (lpString="DWINTL20.DLL") returned 12 [0102.472] lstrcmpiA (lpString1=".DLL", lpString2=".dll") returned 0 [0102.472] GetProcessHeap () returned 0xd20000 [0102.472] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444e0 | out: hHeap=0xd20000) returned 1 [0102.472] FindNextFileW (in: hFindFile=0xd36d08, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea355be9, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea355be9, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xfa216a00, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x1cec8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DWINTL20.DLL", cAlternateFileName="")) returned 0 [0102.472] FindClose (in: hFindFile=0xd36d08 | out: hFindFile=0xd36d08) returned 1 [0102.472] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Users\\" | out: lpString1="C:\\Users\\") returned="C:\\Users\\" [0102.472] GetProcessHeap () returned 0xd20000 [0102.472] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36428 | out: hHeap=0xd20000) returned 1 [0102.472] GetProcessHeap () returned 0xd20000 [0102.472] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd48 | out: hHeap=0xd20000) returned 1 [0102.472] lstrlenW (lpString="C:\\Users\\") returned 9 [0102.472] lstrcatW (in: lpString1="C:\\Users\\", lpString2="*" | out: lpString1="C:\\Users\\*") returned="C:\\Users\\*" [0102.472] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd36948 [0102.472] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0102.473] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.473] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0102.473] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0102.473] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0102.473] lstrcmpiW (lpString1="All Users", lpString2=".") returned 1 [0102.473] lstrcmpiW (lpString1="All Users", lpString2="..") returned 1 [0102.473] lstrcatW (in: lpString1="C:\\Users\\", lpString2="All Users" | out: lpString1="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0102.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="All Users", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0102.473] GetProcessHeap () returned 0xd20000 [0102.473] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xa) returned 0xd446d8 [0102.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="All Users", cchWideChar=-1, lpMultiByteStr=0xd446d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="All Users", lpUsedDefaultChar=0x0) returned 10 [0102.473] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0102.473] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0102.473] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0102.473] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0102.474] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0102.474] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0102.474] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0102.474] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0102.474] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0102.474] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0102.474] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0102.474] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0102.474] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0102.474] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0102.474] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0102.474] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0102.474] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0102.474] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0102.474] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0102.474] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0102.475] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0102.475] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0102.475] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0102.475] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0102.475] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0102.475] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0102.475] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0102.475] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0102.475] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0102.475] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0102.475] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0102.475] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0102.475] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0102.475] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0102.475] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0102.475] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0102.475] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0102.475] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0102.476] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0102.476] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0102.476] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0102.476] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0102.476] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="All Users", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0102.476] lstrcatW (in: lpString1="C:\\Users\\All Users", lpString2="\\" | out: lpString1="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0102.476] GetProcessHeap () returned 0xd20000 [0102.476] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cbf8 [0102.476] lstrlenW (lpString="C:\\Users\\All Users\\") returned 19 [0102.476] GetProcessHeap () returned 0xd20000 [0102.476] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x28) returned 0xd34df8 [0102.476] lstrcpyW (in: lpString1=0xd34df8, lpString2="C:\\Users\\All Users\\" | out: lpString1="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0102.476] GetProcessHeap () returned 0xd20000 [0102.476] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446d8 | out: hHeap=0xd20000) returned 1 [0102.476] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0102.476] lstrcmpiW (lpString1="Default", lpString2=".") returned 1 [0102.477] lstrcmpiW (lpString1="Default", lpString2="..") returned 1 [0102.477] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Default" | out: lpString1="C:\\Users\\Default") returned="C:\\Users\\Default" [0102.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Default", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0102.477] GetProcessHeap () returned 0xd20000 [0102.477] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3ccf8 [0102.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Default", cchWideChar=-1, lpMultiByteStr=0xd3ccf8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Default", lpUsedDefaultChar=0x0) returned 8 [0102.477] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0102.477] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0102.477] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0102.477] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0102.477] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0102.477] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0102.477] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0102.477] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0102.477] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0102.477] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0102.477] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0102.477] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0102.478] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0102.478] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0102.478] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0102.478] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0102.478] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0102.478] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0102.478] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0102.478] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0102.478] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0102.478] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0102.478] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0102.478] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0102.478] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0102.478] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0102.478] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0102.478] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0102.478] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0102.478] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0102.478] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0102.479] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0102.479] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0102.479] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0102.479] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0102.479] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0102.479] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0102.479] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0102.479] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0102.479] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0102.479] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0102.479] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0102.479] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0102.479] lstrcatW (in: lpString1="C:\\Users\\Default", lpString2="\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0102.479] GetProcessHeap () returned 0xd20000 [0102.479] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cc38 [0102.479] lstrlenW (lpString="C:\\Users\\Default\\") returned 17 [0102.479] GetProcessHeap () returned 0xd20000 [0102.479] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x24) returned 0xd35098 [0102.479] lstrcpyW (in: lpString1=0xd35098, lpString2="C:\\Users\\Default\\" | out: lpString1="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0102.480] GetProcessHeap () returned 0xd20000 [0102.480] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.480] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xd7b844b1, ftCreationTime.dwHighDateTime=0x1d2a02f, ftLastAccessTime.dwLowDateTime=0xd7b844b1, ftLastAccessTime.dwHighDateTime=0x1d2a02f, ftLastWriteTime.dwLowDateTime=0xd7b844b1, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0102.480] lstrcmpiW (lpString1="Default User", lpString2=".") returned 1 [0102.480] lstrcmpiW (lpString1="Default User", lpString2="..") returned 1 [0102.480] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Default User" | out: lpString1="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0102.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Default User", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0102.480] GetProcessHeap () returned 0xd20000 [0102.480] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xd) returned 0xd446f0 [0102.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Default User", cchWideChar=-1, lpMultiByteStr=0xd446f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Default User", lpUsedDefaultChar=0x0) returned 13 [0102.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0102.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0102.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0102.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0102.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0102.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0102.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0102.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0102.480] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0102.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0102.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0102.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0102.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0102.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0102.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0102.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0102.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0102.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0102.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0102.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0102.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0102.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0102.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0102.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0102.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0102.481] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0102.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0102.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0102.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0102.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0102.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0102.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0102.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0102.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0102.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0102.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0102.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0102.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0102.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0102.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0102.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0102.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0102.482] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default User", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0102.482] lstrcatW (in: lpString1="C:\\Users\\Default User", lpString2="\\" | out: lpString1="C:\\Users\\Default User\\") returned="C:\\Users\\Default User\\" [0102.483] GetProcessHeap () returned 0xd20000 [0102.483] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cdb8 [0102.483] lstrlenW (lpString="C:\\Users\\Default User\\") returned 22 [0102.483] GetProcessHeap () returned 0xd20000 [0102.483] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x2e) returned 0xd3fd28 [0102.483] lstrcpyW (in: lpString1=0xd3fd28, lpString2="C:\\Users\\Default User\\" | out: lpString1="C:\\Users\\Default User\\") returned="C:\\Users\\Default User\\" [0102.483] GetProcessHeap () returned 0xd20000 [0102.483] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446f0 | out: hHeap=0xd20000) returned 1 [0102.483] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc40864ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7205420a, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default.migrated", cAlternateFileName="DEFAUL~1.MIG")) returned 1 [0102.483] lstrcmpiW (lpString1="Default.migrated", lpString2=".") returned 1 [0102.483] lstrcmpiW (lpString1="Default.migrated", lpString2="..") returned 1 [0102.483] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Default.migrated" | out: lpString1="C:\\Users\\Default.migrated") returned="C:\\Users\\Default.migrated" [0102.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Default.migrated", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0102.483] GetProcessHeap () returned 0xd20000 [0102.483] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x11) returned 0xd36488 [0102.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Default.migrated", cchWideChar=-1, lpMultiByteStr=0xd36488, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Default.migrated", lpUsedDefaultChar=0x0) returned 17 [0102.483] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0102.483] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0102.483] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0102.484] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0102.484] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0102.484] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0102.484] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0102.484] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0102.484] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0102.484] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0102.484] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0102.484] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0102.484] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0102.484] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0102.484] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0102.484] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0102.484] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0102.484] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0102.484] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0102.484] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0102.484] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0102.484] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0102.485] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0102.485] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0102.485] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0102.485] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0102.485] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0102.485] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0102.485] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0102.485] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0102.485] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0102.485] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0102.485] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0102.485] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0102.485] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0102.485] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0102.485] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0102.485] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0102.485] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0102.485] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0102.486] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0102.486] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0102.486] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Default.migrated", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0102.486] lstrcatW (in: lpString1="C:\\Users\\Default.migrated", lpString2="\\" | out: lpString1="C:\\Users\\Default.migrated\\") returned="C:\\Users\\Default.migrated\\" [0102.486] GetProcessHeap () returned 0xd20000 [0102.486] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cd48 [0102.486] lstrlenW (lpString="C:\\Users\\Default.migrated\\") returned 26 [0102.486] GetProcessHeap () returned 0xd20000 [0102.486] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x36) returned 0xd36d08 [0102.486] lstrcpyW (in: lpString1=0xd36d08, lpString2="C:\\Users\\Default.migrated\\" | out: lpString1="C:\\Users\\Default.migrated\\") returned="C:\\Users\\Default.migrated\\" [0102.486] GetProcessHeap () returned 0xd20000 [0102.486] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36488 | out: hHeap=0xd20000) returned 1 [0102.486] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9bc987, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0102.487] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0102.487] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0102.487] lstrcatW (in: lpString1="C:\\Users\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\desktop.ini") returned="C:\\Users\\desktop.ini" [0102.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0102.487] GetProcessHeap () returned 0xd20000 [0102.487] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd444e0 [0102.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0xd444e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0102.487] lstrlenA (lpString="desktop.ini") returned 11 [0102.487] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0102.487] lstrlenA (lpString="desktop.ini") returned 11 [0102.488] lstrlenA (lpString=".dll") returned 4 [0102.488] lstrlenA (lpString=".dll") returned 4 [0102.488] lstrlenA (lpString="desktop.ini") returned 11 [0102.488] lstrcmpiA (lpString1=".ini", lpString2=".dll") returned 1 [0102.488] lstrlenA (lpString="desktop.ini") returned 11 [0102.488] lstrlenA (lpString=".ini") returned 4 [0102.488] lstrlenA (lpString=".ini") returned 4 [0102.488] lstrlenA (lpString="desktop.ini") returned 11 [0102.488] lstrcmpiA (lpString1=".ini", lpString2=".ini") returned 0 [0102.488] GetProcessHeap () returned 0xd20000 [0102.488] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444e0 | out: hHeap=0xd20000) returned 1 [0102.488] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 1 [0102.488] lstrcmpiW (lpString1="FD1HVy", lpString2=".") returned 1 [0102.488] lstrcmpiW (lpString1="FD1HVy", lpString2="..") returned 1 [0102.488] lstrcatW (in: lpString1="C:\\Users\\", lpString2="FD1HVy" | out: lpString1="C:\\Users\\FD1HVy") returned="C:\\Users\\FD1HVy" [0102.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FD1HVy", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0102.488] GetProcessHeap () returned 0xd20000 [0102.488] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x7) returned 0xd3ccf8 [0102.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FD1HVy", cchWideChar=-1, lpMultiByteStr=0xd3ccf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FD1HVy", lpUsedDefaultChar=0x0) returned 7 [0102.489] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0102.489] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0102.489] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0102.489] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0102.489] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0102.489] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0102.489] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0102.489] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0102.489] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0102.489] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0102.489] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0102.489] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0102.489] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0102.489] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0102.489] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0102.489] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0102.489] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0102.489] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0102.490] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0102.490] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0102.490] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0102.490] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0102.490] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0102.490] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0102.490] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0102.490] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0102.490] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0102.490] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0102.490] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0102.490] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0102.490] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0102.490] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0102.490] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0102.490] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0102.490] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0102.490] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0102.490] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0102.491] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0102.491] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0102.491] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0102.491] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0102.491] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0102.491] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="FD1HVy", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0102.491] lstrcatW (in: lpString1="C:\\Users\\FD1HVy", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0102.491] GetProcessHeap () returned 0xd20000 [0102.491] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cc08 [0102.491] lstrlenW (lpString="C:\\Users\\FD1HVy\\") returned 16 [0102.491] GetProcessHeap () returned 0xd20000 [0102.491] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x22) returned 0xd34fa8 [0102.491] lstrcpyW (in: lpString1=0xd34fa8, lpString2="C:\\Users\\FD1HVy\\" | out: lpString1="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0102.491] GetProcessHeap () returned 0xd20000 [0102.491] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.491] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0102.491] lstrcmpiW (lpString1="Public", lpString2=".") returned 1 [0102.491] lstrcmpiW (lpString1="Public", lpString2="..") returned 1 [0102.491] lstrcatW (in: lpString1="C:\\Users\\", lpString2="Public" | out: lpString1="C:\\Users\\Public") returned="C:\\Users\\Public" [0102.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Public", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0102.492] GetProcessHeap () returned 0xd20000 [0102.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x7) returned 0xd3cc18 [0102.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Public", cchWideChar=-1, lpMultiByteStr=0xd3cc18, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Public", lpUsedDefaultChar=0x0) returned 7 [0102.492] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0102.492] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0102.492] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0102.492] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0102.492] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0102.492] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0102.492] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0102.492] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0102.492] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0102.492] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0102.492] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0102.492] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0102.492] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0102.492] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0102.492] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0102.493] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0102.493] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0102.493] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0102.493] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0102.493] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0102.493] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0102.493] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0102.493] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0102.493] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0102.493] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0102.493] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0102.493] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0102.493] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0102.493] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0102.493] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0102.493] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0102.493] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0102.493] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0102.494] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0102.494] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0102.494] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0102.494] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0102.494] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0102.494] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0102.494] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0102.494] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0102.494] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0102.494] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Public", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0102.494] lstrcatW (in: lpString1="C:\\Users\\Public", lpString2="\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0102.494] GetProcessHeap () returned 0xd20000 [0102.494] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3ccf8 [0102.494] lstrlenW (lpString="C:\\Users\\Public\\") returned 16 [0102.494] GetProcessHeap () returned 0xd20000 [0102.494] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x22) returned 0xd34f78 [0102.494] lstrcpyW (in: lpString1=0xd34f78, lpString2="C:\\Users\\Public\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0102.494] GetProcessHeap () returned 0xd20000 [0102.495] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0102.495] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0 [0102.495] FindClose (in: hFindFile=0xd36948 | out: hFindFile=0xd36948) returned 1 [0102.495] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Users\\Public\\" | out: lpString1="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0102.495] GetProcessHeap () returned 0xd20000 [0102.495] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd34f78 | out: hHeap=0xd20000) returned 1 [0102.495] GetProcessHeap () returned 0xd20000 [0102.495] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0102.495] lstrlenW (lpString="C:\\Users\\Public\\") returned 16 [0102.495] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\*") returned="C:\\Users\\Public\\*" [0102.495] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x78c2cd6f, ftLastWriteTime.dwHighDateTime=0x1d5c395, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd36948 [0102.496] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0102.496] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x78c2cd6f, ftLastWriteTime.dwHighDateTime=0x1d5c395, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.496] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0102.496] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0102.496] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AccountPictures", cAlternateFileName="ACCOUN~1")) returned 1 [0102.496] lstrcmpiW (lpString1="AccountPictures", lpString2=".") returned 1 [0102.496] lstrcmpiW (lpString1="AccountPictures", lpString2="..") returned 1 [0102.496] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="AccountPictures" | out: lpString1="C:\\Users\\Public\\AccountPictures") returned="C:\\Users\\Public\\AccountPictures" [0102.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AccountPictures", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0102.496] GetProcessHeap () returned 0xd20000 [0102.496] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd44690 [0102.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AccountPictures", cchWideChar=-1, lpMultiByteStr=0xd44690, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AccountPictures", lpUsedDefaultChar=0x0) returned 16 [0102.496] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0102.496] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0102.496] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0102.496] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0102.497] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0102.497] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0102.497] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0102.497] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0102.497] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0102.497] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0102.497] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0102.497] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0102.497] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0102.497] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0102.497] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0102.497] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0102.497] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0102.497] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0102.497] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0102.497] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0102.497] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0102.497] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0102.498] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0102.498] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0102.498] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0102.498] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0102.498] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0102.498] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0102.498] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0102.498] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0102.498] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0102.498] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0102.498] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0102.498] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0102.498] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0102.498] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0102.498] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0102.498] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0102.498] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0102.498] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0102.498] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0102.499] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0102.499] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AccountPictures", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0102.499] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures", lpString2="\\" | out: lpString1="C:\\Users\\Public\\AccountPictures\\") returned="C:\\Users\\Public\\AccountPictures\\" [0102.499] GetProcessHeap () returned 0xd20000 [0102.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cd88 [0102.499] lstrlenW (lpString="C:\\Users\\Public\\AccountPictures\\") returned 32 [0102.499] GetProcessHeap () returned 0xd20000 [0102.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x42) returned 0xd44058 [0102.499] lstrcpyW (in: lpString1=0xd44058, lpString2="C:\\Users\\Public\\AccountPictures\\" | out: lpString1="C:\\Users\\Public\\AccountPictures\\") returned="C:\\Users\\Public\\AccountPictures\\" [0102.499] GetProcessHeap () returned 0xd20000 [0102.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44690 | out: hHeap=0xd20000) returned 1 [0102.499] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0102.499] lstrcmpiW (lpString1="Desktop", lpString2=".") returned 1 [0102.499] lstrcmpiW (lpString1="Desktop", lpString2="..") returned 1 [0102.499] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Desktop" | out: lpString1="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0102.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Desktop", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0102.499] GetProcessHeap () returned 0xd20000 [0102.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cbd8 [0102.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Desktop", cchWideChar=-1, lpMultiByteStr=0xd3cbd8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Desktop", lpUsedDefaultChar=0x0) returned 8 [0102.500] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0102.500] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0102.500] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0102.500] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0102.500] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0102.500] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0102.500] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0102.500] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0102.500] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0102.500] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0102.500] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0102.500] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0102.500] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0102.500] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0102.500] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0102.500] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0102.500] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0102.500] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0102.501] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0102.501] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0102.501] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0102.501] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0102.501] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0102.501] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0102.501] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0102.501] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0102.501] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0102.501] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0102.501] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0102.501] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0102.501] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0102.501] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0102.501] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0102.501] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0102.501] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0102.501] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0102.501] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0102.502] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0102.502] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0102.502] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0102.502] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0102.502] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0102.502] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0102.571] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Desktop\\") returned="C:\\Users\\Public\\Desktop\\" [0102.571] GetProcessHeap () returned 0xd20000 [0102.571] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3ccf8 [0102.571] lstrlenW (lpString="C:\\Users\\Public\\Desktop\\") returned 24 [0102.571] GetProcessHeap () returned 0xd20000 [0102.571] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x32) returned 0xd36a88 [0102.571] lstrcpyW (in: lpString1=0xd36a88, lpString2="C:\\Users\\Public\\Desktop\\" | out: lpString1="C:\\Users\\Public\\Desktop\\") returned="C:\\Users\\Public\\Desktop\\" [0102.571] GetProcessHeap () returned 0xd20000 [0102.571] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0102.571] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0102.571] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0102.572] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0102.572] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\desktop.ini") returned="C:\\Users\\Public\\desktop.ini" [0102.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0102.572] GetProcessHeap () returned 0xd20000 [0102.572] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd44528 [0102.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0xd44528, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0102.572] lstrlenA (lpString="desktop.ini") returned 11 [0102.572] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0102.572] lstrlenA (lpString="desktop.ini") returned 11 [0102.572] lstrlenA (lpString=".dll") returned 4 [0102.572] lstrlenA (lpString=".dll") returned 4 [0102.572] lstrlenA (lpString="desktop.ini") returned 11 [0102.572] lstrcmpiA (lpString1=".ini", lpString2=".dll") returned 1 [0102.572] lstrlenA (lpString="desktop.ini") returned 11 [0102.572] lstrlenA (lpString=".ini") returned 4 [0102.572] lstrlenA (lpString=".ini") returned 4 [0102.572] lstrlenA (lpString="desktop.ini") returned 11 [0102.572] lstrcmpiA (lpString1=".ini", lpString2=".ini") returned 0 [0102.572] GetProcessHeap () returned 0xd20000 [0102.572] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44528 | out: hHeap=0xd20000) returned 1 [0102.573] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0102.573] lstrcmpiW (lpString1="Documents", lpString2=".") returned 1 [0102.573] lstrcmpiW (lpString1="Documents", lpString2="..") returned 1 [0102.573] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Documents" | out: lpString1="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0102.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Documents", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0102.573] GetProcessHeap () returned 0xd20000 [0102.573] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xa) returned 0xd44468 [0102.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Documents", cchWideChar=-1, lpMultiByteStr=0xd44468, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Documents", lpUsedDefaultChar=0x0) returned 10 [0102.573] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0102.573] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0102.573] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0102.573] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0102.573] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0102.573] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0102.573] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0102.573] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0102.573] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0102.573] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0102.573] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0102.573] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0102.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0102.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0102.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0102.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0102.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0102.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0102.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0102.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0102.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0102.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0102.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0102.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0102.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0102.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0102.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0102.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0102.574] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0102.575] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0102.575] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0102.575] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0102.575] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0102.575] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0102.575] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0102.575] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0102.575] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0102.575] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0102.575] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0102.575] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0102.575] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0102.575] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0102.575] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0102.575] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0102.575] GetProcessHeap () returned 0xd20000 [0102.576] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cbc8 [0102.576] lstrlenW (lpString="C:\\Users\\Public\\Documents\\") returned 26 [0102.576] GetProcessHeap () returned 0xd20000 [0102.576] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x36) returned 0xd49420 [0102.576] lstrcpyW (in: lpString1=0xd49420, lpString2="C:\\Users\\Public\\Documents\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0102.576] GetProcessHeap () returned 0xd20000 [0102.576] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44468 | out: hHeap=0xd20000) returned 1 [0102.576] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0102.576] lstrcmpiW (lpString1="Downloads", lpString2=".") returned 1 [0102.576] lstrcmpiW (lpString1="Downloads", lpString2="..") returned 1 [0102.576] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Downloads" | out: lpString1="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0102.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Downloads", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0102.576] GetProcessHeap () returned 0xd20000 [0102.576] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xa) returned 0xd44690 [0102.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Downloads", cchWideChar=-1, lpMultiByteStr=0xd44690, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Downloads", lpUsedDefaultChar=0x0) returned 10 [0102.576] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0102.576] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0102.576] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0102.576] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0102.576] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0102.577] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0102.577] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0102.577] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0102.577] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0102.577] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0102.577] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0102.577] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0102.577] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0102.577] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0102.577] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0102.577] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0102.577] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0102.577] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0102.577] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0102.577] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0102.577] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0102.577] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0102.577] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0102.577] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0102.577] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0102.578] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0102.578] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0102.578] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0102.578] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0102.578] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0102.578] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0102.578] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0102.578] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0102.578] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0102.578] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0102.578] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0102.578] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0102.578] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0102.578] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0102.578] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0102.578] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0102.578] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0102.578] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0102.578] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Downloads\\") returned="C:\\Users\\Public\\Downloads\\" [0102.578] GetProcessHeap () returned 0xd20000 [0102.578] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cc88 [0102.579] lstrlenW (lpString="C:\\Users\\Public\\Downloads\\") returned 26 [0102.579] GetProcessHeap () returned 0xd20000 [0102.579] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x36) returned 0xd48ea0 [0102.579] lstrcpyW (in: lpString1=0xd48ea0, lpString2="C:\\Users\\Public\\Downloads\\" | out: lpString1="C:\\Users\\Public\\Downloads\\") returned="C:\\Users\\Public\\Downloads\\" [0102.579] GetProcessHeap () returned 0xd20000 [0102.579] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44690 | out: hHeap=0xd20000) returned 1 [0102.579] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78c2cd6f, ftCreationTime.dwHighDateTime=0x1d5c395, ftLastAccessTime.dwLowDateTime=0x78c2cd6f, ftLastAccessTime.dwHighDateTime=0x1d5c395, ftLastWriteTime.dwLowDateTime=0x79717e78, ftLastWriteTime.dwHighDateTime=0x1d5c395, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474", cAlternateFileName="F4B9E4~1")) returned 1 [0102.579] lstrcmpiW (lpString1="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474", lpString2=".") returned 1 [0102.579] lstrcmpiW (lpString1="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474", lpString2="..") returned 1 [0102.579] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474" | out: lpString1="C:\\Users\\Public\\F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned="C:\\Users\\Public\\F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474" [0102.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0102.579] GetProcessHeap () returned 0xd20000 [0102.579] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x41) returned 0xd43c48 [0102.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474", cchWideChar=-1, lpMultiByteStr=0xd43c48, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474", lpUsedDefaultChar=0x0) returned 65 [0102.579] lstrlenA (lpString="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 64 [0102.579] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0102.579] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0102.579] lstrlenA (lpString="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 64 [0102.579] lstrcmpiA (lpString1="B1CA4265C360A3997B1A474", lpString2=".[ponce.lorena@aol.com]") returned 1 [0102.579] lstrlenA (lpString="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 64 [0102.579] lstrlenA (lpString=".dll") returned 4 [0102.580] lstrlenA (lpString=".dll") returned 4 [0102.580] lstrlenA (lpString="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 64 [0102.580] lstrcmpiA (lpString1="A474", lpString2=".dll") returned 1 [0102.580] lstrlenA (lpString="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 64 [0102.580] lstrlenA (lpString=".ini") returned 4 [0102.580] lstrlenA (lpString=".ini") returned 4 [0102.580] lstrlenA (lpString="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 64 [0102.580] lstrcmpiA (lpString1="A474", lpString2=".ini") returned 1 [0102.580] lstrlenA (lpString="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 64 [0102.580] lstrlenA (lpString=".inc") returned 4 [0102.581] lstrlenA (lpString=".inc") returned 4 [0102.581] lstrlenA (lpString="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 64 [0102.581] lstrcmpiA (lpString1="A474", lpString2=".inc") returned 1 [0102.581] lstrcmpiW (lpString1="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474", lpString2="HOW_RECOVER.html") returned -1 [0102.581] lstrcmpiW (lpString1="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 0 [0102.581] GetProcessHeap () returned 0xd20000 [0102.581] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43c48 | out: hHeap=0xd20000) returned 1 [0102.581] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb207547d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0102.581] lstrcmpiW (lpString1="Libraries", lpString2=".") returned 1 [0102.581] lstrcmpiW (lpString1="Libraries", lpString2="..") returned 1 [0102.581] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Libraries" | out: lpString1="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0102.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Libraries", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0102.581] GetProcessHeap () returned 0xd20000 [0102.581] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xa) returned 0xd446d8 [0102.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Libraries", cchWideChar=-1, lpMultiByteStr=0xd446d8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Libraries", lpUsedDefaultChar=0x0) returned 10 [0102.582] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0102.582] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0102.582] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0102.582] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0102.582] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0102.582] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0102.582] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0102.582] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0102.582] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0102.582] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0102.582] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0102.582] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0102.582] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0102.582] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0102.582] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0102.582] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0102.582] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0102.582] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0102.582] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0102.582] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0102.582] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0102.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0102.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0102.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0102.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0102.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0102.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0102.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0102.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0102.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0102.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0102.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0102.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0102.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0102.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0102.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0102.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0102.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0102.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0102.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0102.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0102.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0102.584] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Libraries", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0102.584] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0102.584] GetProcessHeap () returned 0xd20000 [0102.584] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cbd8 [0102.584] lstrlenW (lpString="C:\\Users\\Public\\Libraries\\") returned 26 [0102.584] GetProcessHeap () returned 0xd20000 [0102.584] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x36) returned 0xd49060 [0102.584] lstrcpyW (in: lpString1=0xd49060, lpString2="C:\\Users\\Public\\Libraries\\" | out: lpString1="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0102.584] GetProcessHeap () returned 0xd20000 [0102.584] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446d8 | out: hHeap=0xd20000) returned 1 [0102.584] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0102.584] lstrcmpiW (lpString1="Music", lpString2=".") returned 1 [0102.584] lstrcmpiW (lpString1="Music", lpString2="..") returned 1 [0102.584] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Music" | out: lpString1="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0102.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Music", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0102.584] GetProcessHeap () returned 0xd20000 [0102.584] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x6) returned 0xd3cd18 [0102.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Music", cchWideChar=-1, lpMultiByteStr=0xd3cd18, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Music", lpUsedDefaultChar=0x0) returned 6 [0102.584] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0102.584] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0102.584] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0102.584] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0102.585] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0102.585] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0102.585] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0102.585] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0102.585] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0102.585] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0102.585] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0102.585] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0102.585] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0102.585] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0102.585] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0102.585] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0102.585] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0102.585] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0102.585] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0102.585] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0102.585] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0102.585] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0102.585] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0102.585] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0102.586] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0102.586] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0102.586] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0102.586] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0102.586] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0102.586] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0102.586] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0102.586] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0102.586] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0102.586] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0102.586] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0102.586] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0102.586] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0102.586] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0102.586] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0102.586] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0102.586] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0102.586] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0102.586] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0102.586] lstrcatW (in: lpString1="C:\\Users\\Public\\Music", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Music\\") returned="C:\\Users\\Public\\Music\\" [0102.586] GetProcessHeap () returned 0xd20000 [0102.586] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cd28 [0102.587] lstrlenW (lpString="C:\\Users\\Public\\Music\\") returned 22 [0102.587] GetProcessHeap () returned 0xd20000 [0102.587] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x2e) returned 0xd40000 [0102.587] lstrcpyW (in: lpString1=0xd40000, lpString2="C:\\Users\\Public\\Music\\" | out: lpString1="C:\\Users\\Public\\Music\\") returned="C:\\Users\\Public\\Music\\" [0102.587] GetProcessHeap () returned 0xd20000 [0102.587] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.587] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0102.587] lstrcmpiW (lpString1="Pictures", lpString2=".") returned 1 [0102.587] lstrcmpiW (lpString1="Pictures", lpString2="..") returned 1 [0102.587] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Pictures" | out: lpString1="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0102.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Pictures", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0102.587] GetProcessHeap () returned 0xd20000 [0102.587] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x9) returned 0xd44420 [0102.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Pictures", cchWideChar=-1, lpMultiByteStr=0xd44420, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pictures", lpUsedDefaultChar=0x0) returned 9 [0102.587] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0102.587] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0102.587] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0102.587] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0102.587] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0102.587] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0102.587] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0102.587] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0102.587] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0102.587] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0102.588] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0102.588] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0102.588] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0102.588] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0102.588] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0102.588] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0102.588] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0102.588] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0102.588] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0102.588] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0102.588] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0102.588] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0102.588] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0102.588] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0102.588] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0102.588] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0102.588] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0102.588] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0102.588] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0102.588] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0102.588] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0102.588] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0102.589] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0102.589] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0102.589] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0102.589] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0102.589] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0102.589] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0102.589] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0102.589] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0102.589] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0102.589] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0102.589] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0102.589] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Pictures\\") returned="C:\\Users\\Public\\Pictures\\" [0102.589] GetProcessHeap () returned 0xd20000 [0102.589] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cbe8 [0102.589] lstrlenW (lpString="C:\\Users\\Public\\Pictures\\") returned 25 [0102.589] GetProcessHeap () returned 0xd20000 [0102.589] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x34) returned 0xd48e20 [0102.589] lstrcpyW (in: lpString1=0xd48e20, lpString2="C:\\Users\\Public\\Pictures\\" | out: lpString1="C:\\Users\\Public\\Pictures\\") returned="C:\\Users\\Public\\Pictures\\" [0102.589] GetProcessHeap () returned 0xd20000 [0102.589] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44420 | out: hHeap=0xd20000) returned 1 [0102.589] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0102.589] lstrcmpiW (lpString1="Videos", lpString2=".") returned 1 [0102.590] lstrcmpiW (lpString1="Videos", lpString2="..") returned 1 [0102.590] lstrcatW (in: lpString1="C:\\Users\\Public\\", lpString2="Videos" | out: lpString1="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0102.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Videos", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0102.590] GetProcessHeap () returned 0xd20000 [0102.590] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x7) returned 0xd3cd08 [0102.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Videos", cchWideChar=-1, lpMultiByteStr=0xd3cd08, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Videos", lpUsedDefaultChar=0x0) returned 7 [0102.590] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0102.590] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0102.590] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0102.590] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0102.590] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0102.590] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0102.590] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0102.590] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0102.590] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0102.590] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0102.590] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0102.590] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0102.590] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0102.590] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0102.590] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0102.591] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0102.591] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0102.591] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0102.591] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0102.591] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0102.591] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0102.591] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0102.591] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0102.591] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0102.591] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0102.591] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0102.591] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0102.591] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0102.591] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0102.591] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0102.591] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0102.591] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0102.591] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0102.591] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0102.591] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0102.591] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0102.592] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0102.592] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0102.592] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0102.592] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0102.592] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0102.592] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0102.592] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0102.592] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Videos\\") returned="C:\\Users\\Public\\Videos\\" [0102.592] GetProcessHeap () returned 0xd20000 [0102.592] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cd38 [0102.592] lstrlenW (lpString="C:\\Users\\Public\\Videos\\") returned 23 [0102.592] GetProcessHeap () returned 0xd20000 [0102.592] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x30) returned 0xd402a0 [0102.592] lstrcpyW (in: lpString1=0xd402a0, lpString2="C:\\Users\\Public\\Videos\\" | out: lpString1="C:\\Users\\Public\\Videos\\") returned="C:\\Users\\Public\\Videos\\" [0102.592] GetProcessHeap () returned 0xd20000 [0102.592] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0102.592] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0102.592] FindClose (in: hFindFile=0xd36948 | out: hFindFile=0xd36948) returned 1 [0102.593] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Users\\Public\\Videos\\" | out: lpString1="C:\\Users\\Public\\Videos\\") returned="C:\\Users\\Public\\Videos\\" [0102.593] GetProcessHeap () returned 0xd20000 [0102.593] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd402a0 | out: hHeap=0xd20000) returned 1 [0102.593] GetProcessHeap () returned 0xd20000 [0102.593] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0102.593] lstrlenW (lpString="C:\\Users\\Public\\Videos\\") returned 23 [0102.593] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\Videos\\*") returned="C:\\Users\\Public\\Videos\\*" [0102.593] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd48e60 [0102.593] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0102.594] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.594] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0102.594] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0102.594] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0102.594] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0102.594] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0102.594] lstrcatW (in: lpString1="C:\\Users\\Public\\Videos\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\Videos\\desktop.ini") returned="C:\\Users\\Public\\Videos\\desktop.ini" [0102.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0102.594] GetProcessHeap () returned 0xd20000 [0102.594] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd44588 [0102.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0xd44588, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0102.594] lstrlenA (lpString="desktop.ini") returned 11 [0102.594] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0102.594] lstrlenA (lpString="desktop.ini") returned 11 [0102.594] lstrlenA (lpString=".dll") returned 4 [0102.594] lstrlenA (lpString=".dll") returned 4 [0102.594] lstrlenA (lpString="desktop.ini") returned 11 [0102.594] lstrcmpiA (lpString1=".ini", lpString2=".dll") returned 1 [0102.594] lstrlenA (lpString="desktop.ini") returned 11 [0102.594] lstrlenA (lpString=".ini") returned 4 [0102.594] lstrlenA (lpString=".ini") returned 4 [0102.595] lstrlenA (lpString="desktop.ini") returned 11 [0102.595] lstrcmpiA (lpString1=".ini", lpString2=".ini") returned 0 [0102.595] GetProcessHeap () returned 0xd20000 [0102.595] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44588 | out: hHeap=0xd20000) returned 1 [0102.595] FindNextFileW (in: hFindFile=0xd48e60, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0102.595] FindClose (in: hFindFile=0xd48e60 | out: hFindFile=0xd48e60) returned 1 [0102.595] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Users\\Public\\Pictures\\" | out: lpString1="C:\\Users\\Public\\Pictures\\") returned="C:\\Users\\Public\\Pictures\\" [0102.595] GetProcessHeap () returned 0xd20000 [0102.595] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd48e20 | out: hHeap=0xd20000) returned 1 [0102.595] GetProcessHeap () returned 0xd20000 [0102.595] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0102.595] lstrlenW (lpString="C:\\Users\\Public\\Pictures\\") returned 25 [0102.595] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\Pictures\\*") returned="C:\\Users\\Public\\Pictures\\*" [0102.595] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd48ee0 [0102.595] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0102.595] FindNextFileW (in: hFindFile=0xd48ee0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.596] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0102.596] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0102.596] FindNextFileW (in: hFindFile=0xd48ee0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0102.596] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0102.596] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0102.596] lstrcatW (in: lpString1="C:\\Users\\Public\\Pictures\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\Pictures\\desktop.ini") returned="C:\\Users\\Public\\Pictures\\desktop.ini" [0102.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0102.596] GetProcessHeap () returned 0xd20000 [0102.596] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd44618 [0102.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0xd44618, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0102.596] lstrlenA (lpString="desktop.ini") returned 11 [0102.597] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0102.597] lstrlenA (lpString="desktop.ini") returned 11 [0102.597] lstrlenA (lpString=".dll") returned 4 [0102.597] lstrlenA (lpString=".dll") returned 4 [0102.597] lstrlenA (lpString="desktop.ini") returned 11 [0102.597] lstrcmpiA (lpString1=".ini", lpString2=".dll") returned 1 [0102.597] lstrlenA (lpString="desktop.ini") returned 11 [0102.597] lstrlenA (lpString=".ini") returned 4 [0102.597] lstrlenA (lpString=".ini") returned 4 [0102.597] lstrlenA (lpString="desktop.ini") returned 11 [0102.597] lstrcmpiA (lpString1=".ini", lpString2=".ini") returned 0 [0102.597] GetProcessHeap () returned 0xd20000 [0102.597] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44618 | out: hHeap=0xd20000) returned 1 [0102.597] FindNextFileW (in: hFindFile=0xd48ee0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0102.597] FindClose (in: hFindFile=0xd48ee0 | out: hFindFile=0xd48ee0) returned 1 [0102.597] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Users\\Public\\Music\\" | out: lpString1="C:\\Users\\Public\\Music\\") returned="C:\\Users\\Public\\Music\\" [0102.597] GetProcessHeap () returned 0xd20000 [0102.597] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd40000 | out: hHeap=0xd20000) returned 1 [0102.597] GetProcessHeap () returned 0xd20000 [0102.597] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0102.597] lstrlenW (lpString="C:\\Users\\Public\\Music\\") returned 22 [0102.597] lstrcatW (in: lpString1="C:\\Users\\Public\\Music\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\Music\\*") returned="C:\\Users\\Public\\Music\\*" [0102.598] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd490e0 [0102.598] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0102.598] FindNextFileW (in: hFindFile=0xd490e0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.598] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0102.598] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0102.598] FindNextFileW (in: hFindFile=0xd490e0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0102.598] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0102.598] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0102.598] lstrcatW (in: lpString1="C:\\Users\\Public\\Music\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\Music\\desktop.ini") returned="C:\\Users\\Public\\Music\\desktop.ini" [0102.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0102.598] GetProcessHeap () returned 0xd20000 [0102.598] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd44408 [0102.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0xd44408, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0102.598] lstrlenA (lpString="desktop.ini") returned 11 [0102.598] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0102.598] lstrlenA (lpString="desktop.ini") returned 11 [0102.598] lstrlenA (lpString=".dll") returned 4 [0102.598] lstrlenA (lpString=".dll") returned 4 [0102.599] lstrlenA (lpString="desktop.ini") returned 11 [0102.599] lstrcmpiA (lpString1=".ini", lpString2=".dll") returned 1 [0102.599] lstrlenA (lpString="desktop.ini") returned 11 [0102.599] lstrlenA (lpString=".ini") returned 4 [0102.599] lstrlenA (lpString=".ini") returned 4 [0102.599] lstrlenA (lpString="desktop.ini") returned 11 [0102.599] lstrcmpiA (lpString1=".ini", lpString2=".ini") returned 0 [0102.599] GetProcessHeap () returned 0xd20000 [0102.599] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44408 | out: hHeap=0xd20000) returned 1 [0102.599] FindNextFileW (in: hFindFile=0xd490e0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0102.599] FindClose (in: hFindFile=0xd490e0 | out: hFindFile=0xd490e0) returned 1 [0102.599] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Users\\Public\\Libraries\\" | out: lpString1="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0102.599] GetProcessHeap () returned 0xd20000 [0102.599] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd49060 | out: hHeap=0xd20000) returned 1 [0102.599] GetProcessHeap () returned 0xd20000 [0102.599] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0102.599] lstrlenW (lpString="C:\\Users\\Public\\Libraries\\") returned 26 [0102.599] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\Libraries\\*") returned="C:\\Users\\Public\\Libraries\\*" [0102.599] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb207547d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd48fa0 [0102.600] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0102.600] FindNextFileW (in: hFindFile=0xd48fa0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb207547d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.600] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0102.600] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0102.600] FindNextFileW (in: hFindFile=0xd48fa0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0102.600] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0102.600] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0102.600] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\Libraries\\desktop.ini") returned="C:\\Users\\Public\\Libraries\\desktop.ini" [0102.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0102.600] GetProcessHeap () returned 0xd20000 [0102.600] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd445d0 [0102.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0xd445d0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0102.600] lstrlenA (lpString="desktop.ini") returned 11 [0102.600] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0102.600] lstrlenA (lpString="desktop.ini") returned 11 [0102.600] lstrlenA (lpString=".dll") returned 4 [0102.600] lstrlenA (lpString=".dll") returned 4 [0102.600] lstrlenA (lpString="desktop.ini") returned 11 [0102.600] lstrcmpiA (lpString1=".ini", lpString2=".dll") returned 1 [0102.601] lstrlenA (lpString="desktop.ini") returned 11 [0102.601] lstrlenA (lpString=".ini") returned 4 [0102.601] lstrlenA (lpString=".ini") returned 4 [0102.601] lstrlenA (lpString="desktop.ini") returned 11 [0102.601] lstrcmpiA (lpString1=".ini", lpString2=".ini") returned 0 [0102.601] GetProcessHeap () returned 0xd20000 [0102.601] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445d0 | out: hHeap=0xd20000) returned 1 [0102.601] FindNextFileW (in: hFindFile=0xd48fa0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 1 [0102.601] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2=".") returned 1 [0102.601] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2="..") returned 1 [0102.601] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries\\", lpString2="RecordedTV.library-ms" | out: lpString1="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms") returned="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" [0102.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RecordedTV.library-ms", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0102.601] GetProcessHeap () returned 0xd20000 [0102.601] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x16) returned 0xd36448 [0102.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="RecordedTV.library-ms", cchWideChar=-1, lpMultiByteStr=0xd36448, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RecordedTV.library-ms", lpUsedDefaultChar=0x0) returned 22 [0102.601] lstrlenA (lpString="RecordedTV.library-ms") returned 21 [0102.601] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0102.601] lstrlenA (lpString="RecordedTV.library-ms") returned 21 [0102.601] lstrlenA (lpString=".dll") returned 4 [0102.601] lstrlenA (lpString=".dll") returned 4 [0102.601] lstrlenA (lpString="RecordedTV.library-ms") returned 21 [0102.601] lstrcmpiA (lpString1="y-ms", lpString2=".dll") returned 1 [0102.601] lstrlenA (lpString="RecordedTV.library-ms") returned 21 [0102.602] lstrlenA (lpString=".ini") returned 4 [0102.602] lstrlenA (lpString=".ini") returned 4 [0102.602] lstrlenA (lpString="RecordedTV.library-ms") returned 21 [0102.602] lstrcmpiA (lpString1="y-ms", lpString2=".ini") returned 1 [0102.602] lstrlenA (lpString="RecordedTV.library-ms") returned 21 [0102.602] lstrlenA (lpString=".inc") returned 4 [0102.602] lstrlenA (lpString=".inc") returned 4 [0102.602] lstrlenA (lpString="RecordedTV.library-ms") returned 21 [0102.602] lstrcmpiA (lpString1="y-ms", lpString2=".inc") returned 1 [0102.602] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2="HOW_RECOVER.html") returned 1 [0102.602] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0102.602] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0102.602] lstrcmpiW (lpString1="RecordedTV.library-ms", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0102.602] GetProcessHeap () returned 0xd20000 [0102.602] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd428a0 [0102.602] CreateFileW (lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0102.602] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=960) returned 1 [0102.603] GetProcessHeap () returned 0xd20000 [0102.603] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c160 [0102.603] GetProcessHeap () returned 0xd20000 [0102.603] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0102.603] lstrlenW (lpString="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms") returned 47 [0102.603] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0102.603] GetProcessHeap () returned 0xd20000 [0102.603] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0102.603] GetProcessHeap () returned 0xd20000 [0102.603] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4e328 [0102.603] lstrlenA (lpString="rsa_encrypt") returned 11 [0102.603] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0102.605] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0102.605] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0102.605] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0102.605] GetProcessHeap () returned 0xd20000 [0102.605] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0102.605] lstrlenA (lpString="010001") returned 6 [0102.605] GetProcessHeap () returned 0xd20000 [0102.605] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cbd8 [0102.606] GetProcessHeap () returned 0xd20000 [0102.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0102.606] GetProcessHeap () returned 0xd20000 [0102.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b128 [0102.606] GetProcessHeap () returned 0xd20000 [0102.606] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0102.606] GetProcessHeap () returned 0xd20000 [0102.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0102.606] GetProcessHeap () returned 0xd20000 [0102.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44b50 [0102.606] GetProcessHeap () returned 0xd20000 [0102.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd98 [0102.606] GetProcessHeap () returned 0xd20000 [0102.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44c68 [0102.606] GetProcessHeap () returned 0xd20000 [0102.606] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0102.606] GetProcessHeap () returned 0xd20000 [0102.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0102.606] GetProcessHeap () returned 0xd20000 [0102.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0102.606] GetProcessHeap () returned 0xd20000 [0102.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44d80 [0102.606] GetProcessHeap () returned 0xd20000 [0102.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0102.607] GetProcessHeap () returned 0xd20000 [0102.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44678 [0102.607] GetProcessHeap () returned 0xd20000 [0102.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aaf8 [0102.607] GetProcessHeap () returned 0xd20000 [0102.607] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0102.607] GetProcessHeap () returned 0xd20000 [0102.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0102.607] GetProcessHeap () returned 0xd20000 [0102.607] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aaf8 | out: hHeap=0xd20000) returned 1 [0102.607] GetProcessHeap () returned 0xd20000 [0102.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0102.607] GetProcessHeap () returned 0xd20000 [0102.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44570 [0102.607] GetProcessHeap () returned 0xd20000 [0102.607] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0102.607] GetProcessHeap () returned 0xd20000 [0102.607] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0102.607] GetProcessHeap () returned 0xd20000 [0102.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0102.607] GetProcessHeap () returned 0xd20000 [0102.607] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0102.607] GetProcessHeap () returned 0xd20000 [0102.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0102.608] GetProcessHeap () returned 0xd20000 [0102.608] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0102.608] GetProcessHeap () returned 0xd20000 [0102.608] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4af78 [0102.608] GetProcessHeap () returned 0xd20000 [0102.608] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44570 | out: hHeap=0xd20000) returned 1 [0102.608] GetProcessHeap () returned 0xd20000 [0102.608] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0102.608] GetProcessHeap () returned 0xd20000 [0102.608] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4af78 | out: hHeap=0xd20000) returned 1 [0102.608] GetProcessHeap () returned 0xd20000 [0102.608] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.608] GetProcessHeap () returned 0xd20000 [0102.608] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.608] GetProcessHeap () returned 0xd20000 [0102.608] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0102.608] GetProcessHeap () returned 0xd20000 [0102.608] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0102.608] GetProcessHeap () returned 0xd20000 [0102.608] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.608] GetProcessHeap () returned 0xd20000 [0102.608] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.608] GetProcessHeap () returned 0xd20000 [0102.608] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0102.609] GetProcessHeap () returned 0xd20000 [0102.609] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0102.609] GetProcessHeap () returned 0xd20000 [0102.609] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0102.609] GetProcessHeap () returned 0xd20000 [0102.609] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0102.609] GetProcessHeap () returned 0xd20000 [0102.609] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0102.609] GetProcessHeap () returned 0xd20000 [0102.609] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0102.609] GetProcessHeap () returned 0xd20000 [0102.609] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0102.609] GetProcessHeap () returned 0xd20000 [0102.609] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0102.609] GetProcessHeap () returned 0xd20000 [0102.609] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0102.609] GetProcessHeap () returned 0xd20000 [0102.609] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0102.609] GetProcessHeap () returned 0xd20000 [0102.609] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0102.609] GetProcessHeap () returned 0xd20000 [0102.609] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0102.609] GetProcessHeap () returned 0xd20000 [0102.610] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0102.610] GetProcessHeap () returned 0xd20000 [0102.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0102.610] GetProcessHeap () returned 0xd20000 [0102.610] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0102.610] GetProcessHeap () returned 0xd20000 [0102.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0102.610] GetProcessHeap () returned 0xd20000 [0102.610] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0102.610] GetProcessHeap () returned 0xd20000 [0102.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0102.610] GetProcessHeap () returned 0xd20000 [0102.610] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0102.610] GetProcessHeap () returned 0xd20000 [0102.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0102.610] GetProcessHeap () returned 0xd20000 [0102.610] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0102.610] GetProcessHeap () returned 0xd20000 [0102.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0102.610] GetProcessHeap () returned 0xd20000 [0102.610] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0102.610] GetProcessHeap () returned 0xd20000 [0102.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0102.611] GetProcessHeap () returned 0xd20000 [0102.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0102.611] GetProcessHeap () returned 0xd20000 [0102.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0102.611] GetProcessHeap () returned 0xd20000 [0102.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.611] GetProcessHeap () returned 0xd20000 [0102.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.611] GetProcessHeap () returned 0xd20000 [0102.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.611] GetProcessHeap () returned 0xd20000 [0102.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.611] GetProcessHeap () returned 0xd20000 [0102.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.611] GetProcessHeap () returned 0xd20000 [0102.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.611] GetProcessHeap () returned 0xd20000 [0102.729] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0102.729] GetProcessHeap () returned 0xd20000 [0102.729] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0102.729] GetProcessHeap () returned 0xd20000 [0102.729] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0102.729] GetProcessHeap () returned 0xd20000 [0102.729] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0102.729] GetProcessHeap () returned 0xd20000 [0102.729] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0102.729] GetProcessHeap () returned 0xd20000 [0102.729] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0102.729] GetProcessHeap () returned 0xd20000 [0102.729] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.729] GetProcessHeap () returned 0xd20000 [0102.729] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.729] GetProcessHeap () returned 0xd20000 [0102.729] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0102.729] GetProcessHeap () returned 0xd20000 [0102.729] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0102.729] GetProcessHeap () returned 0xd20000 [0102.729] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0102.730] GetProcessHeap () returned 0xd20000 [0102.730] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0102.730] GetProcessHeap () returned 0xd20000 [0102.730] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0102.730] GetProcessHeap () returned 0xd20000 [0102.730] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0102.730] GetProcessHeap () returned 0xd20000 [0102.730] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0102.730] GetProcessHeap () returned 0xd20000 [0102.730] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0102.730] GetProcessHeap () returned 0xd20000 [0102.730] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0102.730] GetProcessHeap () returned 0xd20000 [0102.730] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0102.730] GetProcessHeap () returned 0xd20000 [0102.730] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0102.730] GetProcessHeap () returned 0xd20000 [0102.730] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0102.730] GetProcessHeap () returned 0xd20000 [0102.730] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0102.730] GetProcessHeap () returned 0xd20000 [0102.730] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0102.731] GetProcessHeap () returned 0xd20000 [0102.731] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0102.731] GetProcessHeap () returned 0xd20000 [0102.731] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0102.731] GetProcessHeap () returned 0xd20000 [0102.731] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0102.731] GetProcessHeap () returned 0xd20000 [0102.731] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0102.731] GetProcessHeap () returned 0xd20000 [0102.731] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0102.731] GetProcessHeap () returned 0xd20000 [0102.731] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0102.731] GetProcessHeap () returned 0xd20000 [0102.731] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0102.731] GetProcessHeap () returned 0xd20000 [0102.731] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0102.731] GetProcessHeap () returned 0xd20000 [0102.731] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0102.731] GetProcessHeap () returned 0xd20000 [0102.731] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0102.731] GetProcessHeap () returned 0xd20000 [0102.731] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.731] GetProcessHeap () returned 0xd20000 [0102.732] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.732] GetProcessHeap () returned 0xd20000 [0102.732] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0102.732] GetProcessHeap () returned 0xd20000 [0102.732] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0102.732] GetProcessHeap () returned 0xd20000 [0102.732] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.732] GetProcessHeap () returned 0xd20000 [0102.732] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.732] GetProcessHeap () returned 0xd20000 [0102.732] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0102.732] GetProcessHeap () returned 0xd20000 [0102.732] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0102.732] GetProcessHeap () returned 0xd20000 [0102.732] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0102.732] GetProcessHeap () returned 0xd20000 [0102.732] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0102.732] GetProcessHeap () returned 0xd20000 [0102.732] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0102.732] GetProcessHeap () returned 0xd20000 [0102.732] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0102.732] GetProcessHeap () returned 0xd20000 [0102.732] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0102.732] GetProcessHeap () returned 0xd20000 [0102.732] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0102.733] GetProcessHeap () returned 0xd20000 [0102.733] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0102.733] GetProcessHeap () returned 0xd20000 [0102.733] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0102.733] GetProcessHeap () returned 0xd20000 [0102.733] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.733] GetProcessHeap () returned 0xd20000 [0102.733] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.733] GetProcessHeap () returned 0xd20000 [0102.733] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0102.733] GetProcessHeap () returned 0xd20000 [0102.733] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0102.733] GetProcessHeap () returned 0xd20000 [0102.733] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.733] GetProcessHeap () returned 0xd20000 [0102.733] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.733] GetProcessHeap () returned 0xd20000 [0102.733] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0102.733] GetProcessHeap () returned 0xd20000 [0102.733] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0102.733] GetProcessHeap () returned 0xd20000 [0102.733] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0102.733] GetProcessHeap () returned 0xd20000 [0102.733] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0102.734] GetProcessHeap () returned 0xd20000 [0102.734] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0102.734] GetProcessHeap () returned 0xd20000 [0102.734] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0102.734] GetProcessHeap () returned 0xd20000 [0102.734] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0102.734] GetProcessHeap () returned 0xd20000 [0102.734] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0102.734] GetProcessHeap () returned 0xd20000 [0102.734] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0102.734] GetProcessHeap () returned 0xd20000 [0102.734] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0102.734] GetProcessHeap () returned 0xd20000 [0102.734] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0102.734] GetProcessHeap () returned 0xd20000 [0102.734] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0102.734] GetProcessHeap () returned 0xd20000 [0102.734] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0102.734] GetProcessHeap () returned 0xd20000 [0102.734] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0102.734] GetProcessHeap () returned 0xd20000 [0102.734] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0102.734] GetProcessHeap () returned 0xd20000 [0102.734] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0102.735] GetProcessHeap () returned 0xd20000 [0102.735] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.735] GetProcessHeap () returned 0xd20000 [0102.735] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.735] GetProcessHeap () returned 0xd20000 [0102.735] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0102.735] GetProcessHeap () returned 0xd20000 [0102.735] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0102.735] GetProcessHeap () returned 0xd20000 [0102.735] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0102.735] GetProcessHeap () returned 0xd20000 [0102.735] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0102.735] GetProcessHeap () returned 0xd20000 [0102.735] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.735] GetProcessHeap () returned 0xd20000 [0102.735] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.735] GetProcessHeap () returned 0xd20000 [0102.735] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.735] GetProcessHeap () returned 0xd20000 [0102.735] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.735] GetProcessHeap () returned 0xd20000 [0102.735] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0102.735] GetProcessHeap () returned 0xd20000 [0102.736] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0102.736] GetProcessHeap () returned 0xd20000 [0102.736] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0102.736] GetProcessHeap () returned 0xd20000 [0102.736] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0102.736] GetProcessHeap () returned 0xd20000 [0102.736] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0102.736] GetProcessHeap () returned 0xd20000 [0102.736] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0102.736] GetProcessHeap () returned 0xd20000 [0102.736] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0102.736] GetProcessHeap () returned 0xd20000 [0102.736] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0102.736] GetProcessHeap () returned 0xd20000 [0102.736] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0102.736] GetProcessHeap () returned 0xd20000 [0102.736] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0102.738] GetProcessHeap () returned 0xd20000 [0102.738] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0102.738] GetProcessHeap () returned 0xd20000 [0102.738] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0102.738] GetProcessHeap () returned 0xd20000 [0102.738] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0102.738] GetProcessHeap () returned 0xd20000 [0102.738] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0102.738] GetProcessHeap () returned 0xd20000 [0102.738] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0102.738] GetProcessHeap () returned 0xd20000 [0102.738] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0102.738] GetProcessHeap () returned 0xd20000 [0102.738] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0102.738] GetProcessHeap () returned 0xd20000 [0102.738] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0102.739] GetProcessHeap () returned 0xd20000 [0102.739] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0102.739] GetProcessHeap () returned 0xd20000 [0102.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0102.739] GetProcessHeap () returned 0xd20000 [0102.739] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0102.739] GetProcessHeap () returned 0xd20000 [0102.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0102.739] GetProcessHeap () returned 0xd20000 [0102.739] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.739] GetProcessHeap () returned 0xd20000 [0102.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.739] GetProcessHeap () returned 0xd20000 [0102.739] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0102.739] GetProcessHeap () returned 0xd20000 [0102.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0102.739] GetProcessHeap () returned 0xd20000 [0102.739] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0102.739] GetProcessHeap () returned 0xd20000 [0102.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0102.740] GetProcessHeap () returned 0xd20000 [0102.740] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.740] GetProcessHeap () returned 0xd20000 [0102.740] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.740] GetProcessHeap () returned 0xd20000 [0102.740] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.740] GetProcessHeap () returned 0xd20000 [0102.740] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.740] GetProcessHeap () returned 0xd20000 [0102.740] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0102.740] GetProcessHeap () returned 0xd20000 [0102.740] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0102.740] GetProcessHeap () returned 0xd20000 [0102.740] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0102.740] GetProcessHeap () returned 0xd20000 [0102.740] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0102.741] GetProcessHeap () returned 0xd20000 [0102.741] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0102.741] GetProcessHeap () returned 0xd20000 [0102.741] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0102.741] GetProcessHeap () returned 0xd20000 [0102.741] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0102.741] GetProcessHeap () returned 0xd20000 [0102.741] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0102.741] GetProcessHeap () returned 0xd20000 [0102.741] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0102.741] GetProcessHeap () returned 0xd20000 [0102.741] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0102.741] GetProcessHeap () returned 0xd20000 [0102.741] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0102.741] GetProcessHeap () returned 0xd20000 [0102.741] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0102.741] GetProcessHeap () returned 0xd20000 [0102.741] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0102.741] GetProcessHeap () returned 0xd20000 [0102.741] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0102.742] GetProcessHeap () returned 0xd20000 [0102.742] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0102.742] GetProcessHeap () returned 0xd20000 [0102.742] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0102.742] GetProcessHeap () returned 0xd20000 [0102.742] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0102.742] GetProcessHeap () returned 0xd20000 [0102.742] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0102.742] GetProcessHeap () returned 0xd20000 [0102.742] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0102.742] GetProcessHeap () returned 0xd20000 [0102.742] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0102.742] GetProcessHeap () returned 0xd20000 [0102.742] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0102.742] GetProcessHeap () returned 0xd20000 [0102.742] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0102.742] GetProcessHeap () returned 0xd20000 [0102.742] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0102.742] GetProcessHeap () returned 0xd20000 [0102.742] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0102.742] GetProcessHeap () returned 0xd20000 [0102.742] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44678 | out: hHeap=0xd20000) returned 1 [0102.743] GetProcessHeap () returned 0xd20000 [0102.743] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0102.743] GetProcessHeap () returned 0xd20000 [0102.743] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0102.743] GetProcessHeap () returned 0xd20000 [0102.743] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b128 | out: hHeap=0xd20000) returned 1 [0102.743] GetProcessHeap () returned 0xd20000 [0102.743] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0102.743] GetProcessHeap () returned 0xd20000 [0102.743] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0102.743] GetProcessHeap () returned 0xd20000 [0102.743] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0102.743] WriteFile (in: hFile=0x230, lpBuffer=0xd4e328*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e328*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0102.756] GetProcessHeap () returned 0xd20000 [0102.756] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4e328, Size=0x30) returned 0xd4e328 [0102.756] GetProcessHeap () returned 0xd20000 [0102.756] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0102.756] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0102.756] GetProcessHeap () returned 0xd20000 [0102.756] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x3c0) returned 0xd4e360 [0102.756] ReadFile (in: hFile=0x230, lpBuffer=0xd4e360, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4e360*, lpNumberOfBytesRead=0x299d7e8*=0x3c0, lpOverlapped=0x0) returned 1 [0102.756] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0102.757] WriteFile (in: hFile=0x230, lpBuffer=0xd4e360*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4e360*, lpNumberOfBytesWritten=0x299d7e4*=0x3c0, lpOverlapped=0x0) returned 1 [0102.779] GetProcessHeap () returned 0xd20000 [0102.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4e360 | out: hHeap=0xd20000) returned 1 [0102.779] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0102.779] WriteFile (in: hFile=0x230, lpBuffer=0xd4e328*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e328*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0102.781] CloseHandle (hObject=0x230) returned 1 [0102.787] GetProcessHeap () returned 0xd20000 [0102.787] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd428a0 | out: hHeap=0xd20000) returned 1 [0102.787] GetProcessHeap () returned 0xd20000 [0102.787] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c160 | out: hHeap=0xd20000) returned 1 [0102.787] GetProcessHeap () returned 0xd20000 [0102.787] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0102.787] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" | out: lpString1="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms") returned="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" [0102.787] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.[ponce.lorena@aol.com]") returned="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.[ponce.lorena@aol.com]" [0102.787] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms"), lpNewFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.[ponce.lorena@aol.com]" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0102.788] PathRemoveFileSpecW (in: pszPath="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" | out: pszPath="C:\\Users\\Public\\Libraries") returned 1 [0102.789] PathAddBackslashW (in: pszPath="C:\\Users\\Public\\Libraries" | out: pszPath="C:\\Users\\Public\\Libraries\\") returned="" [0102.789] lstrcatW (in: lpString1="C:\\Users\\Public\\Libraries\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\Public\\Libraries\\HOW_RECOVER.html") returned="C:\\Users\\Public\\Libraries\\HOW_RECOVER.html" [0102.789] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Libraries\\HOW_RECOVER.html" (normalized: "c:\\users\\public\\libraries\\how_recover.html")) returned 0xffffffff [0102.789] CreateFileW (lpFileName="C:\\Users\\Public\\Libraries\\HOW_RECOVER.html" (normalized: "c:\\users\\public\\libraries\\how_recover.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0102.792] GetProcessHeap () returned 0xd20000 [0102.792] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bff8 [0102.792] GetProcessHeap () returned 0xd20000 [0102.792] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0102.799] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.801] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.801] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.801] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.801] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.801] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.801] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.802] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.802] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.802] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.802] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.802] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.802] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.802] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.802] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.803] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.803] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.803] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.803] GetProcessHeap () returned 0xd20000 [0102.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bff8 | out: hHeap=0xd20000) returned 1 [0102.803] GetProcessHeap () returned 0xd20000 [0102.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0102.803] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x299d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x299d9d0*=0x300, lpOverlapped=0x0) returned 1 [0102.804] GetProcessHeap () returned 0xd20000 [0102.804] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c0e8 [0102.804] GetProcessHeap () returned 0xd20000 [0102.804] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0102.811] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.812] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.812] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.812] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.812] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.812] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.812] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.812] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.812] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.813] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.813] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.813] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.813] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.813] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.813] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.813] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.813] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.813] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.814] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.814] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.814] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.814] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.814] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.814] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.815] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.815] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.815] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.816] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.816] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.816] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.816] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.816] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.816] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.816] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.816] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.817] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.817] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.817] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.817] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.817] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.817] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.817] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.817] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.818] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.818] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.818] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.818] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.818] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.818] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.818] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.819] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.819] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.819] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.819] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.819] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.819] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.819] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.819] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.820] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.820] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.820] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.820] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.820] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.820] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.820] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.821] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.821] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.821] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.821] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.821] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.821] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.821] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.821] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.821] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.822] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.822] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.822] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.822] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.822] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.822] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.822] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.822] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.822] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.823] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.823] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.823] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.823] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.823] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0102.823] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.010] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.010] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.010] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.010] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.010] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.010] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.010] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.011] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.011] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.011] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.011] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.011] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.011] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.011] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.011] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.012] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.012] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.012] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.012] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.012] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.012] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.012] GetProcessHeap () returned 0xd20000 [0103.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c0e8 | out: hHeap=0xd20000) returned 1 [0103.013] GetProcessHeap () returned 0xd20000 [0103.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0103.013] CloseHandle (hObject=0x230) returned 1 [0103.013] GetProcessHeap () returned 0xd20000 [0103.013] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36448 | out: hHeap=0xd20000) returned 1 [0103.013] FindNextFileW (in: hFindFile=0xd48fa0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 0 [0103.013] FindClose (in: hFindFile=0xd48fa0 | out: hFindFile=0xd48fa0) returned 1 [0103.014] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Users\\Public\\Downloads\\" | out: lpString1="C:\\Users\\Public\\Downloads\\") returned="C:\\Users\\Public\\Downloads\\" [0103.014] GetProcessHeap () returned 0xd20000 [0103.014] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd48ea0 | out: hHeap=0xd20000) returned 1 [0103.014] GetProcessHeap () returned 0xd20000 [0103.014] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0103.014] lstrlenW (lpString="C:\\Users\\Public\\Downloads\\") returned 26 [0103.014] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\Downloads\\*") returned="C:\\Users\\Public\\Downloads\\*" [0103.014] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd492a0 [0103.014] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0103.014] FindNextFileW (in: hFindFile=0xd492a0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.014] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0103.015] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0103.015] FindNextFileW (in: hFindFile=0xd492a0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0103.015] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0103.015] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0103.015] lstrcatW (in: lpString1="C:\\Users\\Public\\Downloads\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\Downloads\\desktop.ini") returned="C:\\Users\\Public\\Downloads\\desktop.ini" [0103.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0103.015] GetProcessHeap () returned 0xd20000 [0103.015] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd44600 [0103.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0xd44600, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0103.015] lstrlenA (lpString="desktop.ini") returned 11 [0103.015] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0103.015] lstrlenA (lpString="desktop.ini") returned 11 [0103.015] lstrlenA (lpString=".dll") returned 4 [0103.015] lstrlenA (lpString=".dll") returned 4 [0103.015] lstrlenA (lpString="desktop.ini") returned 11 [0103.015] lstrcmpiA (lpString1=".ini", lpString2=".dll") returned 1 [0103.015] lstrlenA (lpString="desktop.ini") returned 11 [0103.016] lstrlenA (lpString=".ini") returned 4 [0103.016] lstrlenA (lpString=".ini") returned 4 [0103.016] lstrlenA (lpString="desktop.ini") returned 11 [0103.016] lstrcmpiA (lpString1=".ini", lpString2=".ini") returned 0 [0103.016] GetProcessHeap () returned 0xd20000 [0103.016] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44600 | out: hHeap=0xd20000) returned 1 [0103.016] FindNextFileW (in: hFindFile=0xd492a0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0103.016] FindClose (in: hFindFile=0xd492a0 | out: hFindFile=0xd492a0) returned 1 [0103.016] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Users\\Public\\Documents\\" | out: lpString1="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0103.016] GetProcessHeap () returned 0xd20000 [0103.016] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd49420 | out: hHeap=0xd20000) returned 1 [0103.016] GetProcessHeap () returned 0xd20000 [0103.016] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.016] lstrlenW (lpString="C:\\Users\\Public\\Documents\\") returned 26 [0103.016] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\Documents\\*") returned="C:\\Users\\Public\\Documents\\*" [0103.016] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd36948 [0103.020] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0103.020] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.020] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0103.020] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0103.020] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0103.020] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0103.020] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0103.020] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\Documents\\desktop.ini") returned="C:\\Users\\Public\\Documents\\desktop.ini" [0103.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0103.020] GetProcessHeap () returned 0xd20000 [0103.021] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd44438 [0103.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0xd44438, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0103.021] lstrlenA (lpString="desktop.ini") returned 11 [0103.021] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0103.021] lstrlenA (lpString="desktop.ini") returned 11 [0103.021] lstrlenA (lpString=".dll") returned 4 [0103.021] lstrlenA (lpString=".dll") returned 4 [0103.021] lstrlenA (lpString="desktop.ini") returned 11 [0103.021] lstrcmpiA (lpString1=".ini", lpString2=".dll") returned 1 [0103.021] lstrlenA (lpString="desktop.ini") returned 11 [0103.021] lstrlenA (lpString=".ini") returned 4 [0103.021] lstrlenA (lpString=".ini") returned 4 [0103.021] lstrlenA (lpString="desktop.ini") returned 11 [0103.021] lstrcmpiA (lpString1=".ini", lpString2=".ini") returned 0 [0103.021] GetProcessHeap () returned 0xd20000 [0103.021] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44438 | out: hHeap=0xd20000) returned 1 [0103.021] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0103.021] lstrcmpiW (lpString1="My Music", lpString2=".") returned 1 [0103.022] lstrcmpiW (lpString1="My Music", lpString2="..") returned 1 [0103.022] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="My Music" | out: lpString1="C:\\Users\\Public\\Documents\\My Music") returned="C:\\Users\\Public\\Documents\\My Music" [0103.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Music", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0103.022] GetProcessHeap () returned 0xd20000 [0103.022] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x9) returned 0xd44660 [0103.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Music", cchWideChar=-1, lpMultiByteStr=0xd44660, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="My Music", lpUsedDefaultChar=0x0) returned 9 [0103.022] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0103.022] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0103.022] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0103.022] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0103.022] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0103.022] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0103.022] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0103.022] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0103.022] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0103.022] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0103.022] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0103.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0103.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0103.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0103.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0103.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0103.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0103.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0103.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0103.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0103.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0103.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0103.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0103.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0103.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0103.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0103.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0103.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0103.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0103.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0103.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0103.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0103.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0103.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0103.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0103.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0103.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0103.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0103.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0103.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0103.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0103.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0103.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Music", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0103.024] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Music", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\") returned="C:\\Users\\Public\\Documents\\My Music\\" [0103.024] GetProcessHeap () returned 0xd20000 [0103.025] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cd08 [0103.025] lstrlenW (lpString="C:\\Users\\Public\\Documents\\My Music\\") returned 35 [0103.025] GetProcessHeap () returned 0xd20000 [0103.025] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x48) returned 0xd43ec8 [0103.025] lstrcpyW (in: lpString1=0xd43ec8, lpString2="C:\\Users\\Public\\Documents\\My Music\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\") returned="C:\\Users\\Public\\Documents\\My Music\\" [0103.025] GetProcessHeap () returned 0xd20000 [0103.025] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44660 | out: hHeap=0xd20000) returned 1 [0103.025] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0103.025] lstrcmpiW (lpString1="My Pictures", lpString2=".") returned 1 [0103.025] lstrcmpiW (lpString1="My Pictures", lpString2="..") returned 1 [0103.025] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="My Pictures" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures") returned="C:\\Users\\Public\\Documents\\My Pictures" [0103.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Pictures", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0103.025] GetProcessHeap () returned 0xd20000 [0103.025] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd44498 [0103.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Pictures", cchWideChar=-1, lpMultiByteStr=0xd44498, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="My Pictures", lpUsedDefaultChar=0x0) returned 12 [0103.025] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0103.025] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0103.025] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0103.025] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0103.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0103.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0103.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0103.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0103.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0103.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0103.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0103.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0103.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0103.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0103.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0103.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0103.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0103.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0103.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0103.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0103.026] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0103.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0103.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0103.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0103.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0103.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0103.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0103.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0103.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0103.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0103.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0103.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0103.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0103.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0103.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0103.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0103.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0103.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0103.027] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0103.028] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0103.028] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0103.028] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0103.028] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Pictures", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0103.028] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Pictures", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\") returned="C:\\Users\\Public\\Documents\\My Pictures\\" [0103.028] GetProcessHeap () returned 0xd20000 [0103.028] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cd58 [0103.028] lstrlenW (lpString="C:\\Users\\Public\\Documents\\My Pictures\\") returned 38 [0103.028] GetProcessHeap () returned 0xd20000 [0103.028] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4e) returned 0xd2e898 [0103.028] lstrcpyW (in: lpString1=0xd2e898, lpString2="C:\\Users\\Public\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\") returned="C:\\Users\\Public\\Documents\\My Pictures\\" [0103.028] GetProcessHeap () returned 0xd20000 [0103.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44498 | out: hHeap=0xd20000) returned 1 [0103.028] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0103.028] lstrcmpiW (lpString1="My Videos", lpString2=".") returned 1 [0103.028] lstrcmpiW (lpString1="My Videos", lpString2="..") returned 1 [0103.028] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\", lpString2="My Videos" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos") returned="C:\\Users\\Public\\Documents\\My Videos" [0103.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Videos", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0103.029] GetProcessHeap () returned 0xd20000 [0103.029] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xa) returned 0xd44528 [0103.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Videos", cchWideChar=-1, lpMultiByteStr=0xd44528, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="My Videos", lpUsedDefaultChar=0x0) returned 10 [0103.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0103.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0103.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0103.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0103.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0103.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0103.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0103.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0103.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0103.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0103.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0103.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0103.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0103.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0103.029] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0103.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0103.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0103.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0103.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0103.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0103.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0103.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0103.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0103.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0103.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0103.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0103.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0103.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0103.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0103.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0103.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0103.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0103.030] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0103.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0103.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0103.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0103.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0103.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0103.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0103.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0103.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0103.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0103.031] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Videos", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0103.031] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Videos", lpString2="\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\") returned="C:\\Users\\Public\\Documents\\My Videos\\" [0103.031] GetProcessHeap () returned 0xd20000 [0103.031] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cd18 [0103.031] lstrlenW (lpString="C:\\Users\\Public\\Documents\\My Videos\\") returned 36 [0103.031] GetProcessHeap () returned 0xd20000 [0103.031] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4a) returned 0xd3c308 [0103.031] lstrcpyW (in: lpString1=0xd3c308, lpString2="C:\\Users\\Public\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\") returned="C:\\Users\\Public\\Documents\\My Videos\\" [0103.031] GetProcessHeap () returned 0xd20000 [0103.032] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44528 | out: hHeap=0xd20000) returned 1 [0103.032] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0103.032] FindClose (in: hFindFile=0xd36948 | out: hFindFile=0xd36948) returned 1 [0103.034] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Users\\Public\\Documents\\My Videos\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\") returned="C:\\Users\\Public\\Documents\\My Videos\\" [0103.034] GetProcessHeap () returned 0xd20000 [0103.034] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3c308 | out: hHeap=0xd20000) returned 1 [0103.034] GetProcessHeap () returned 0xd20000 [0103.034] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0103.034] lstrlenW (lpString="C:\\Users\\Public\\Documents\\My Videos\\") returned 36 [0103.034] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Videos\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\Documents\\My Videos\\*") returned="C:\\Users\\Public\\Documents\\My Videos\\*" [0103.035] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0xffffffff [0103.040] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Users\\Public\\Documents\\My Pictures\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\") returned="C:\\Users\\Public\\Documents\\My Pictures\\" [0103.040] GetProcessHeap () returned 0xd20000 [0103.040] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2e898 | out: hHeap=0xd20000) returned 1 [0103.040] GetProcessHeap () returned 0xd20000 [0103.040] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0103.041] lstrlenW (lpString="C:\\Users\\Public\\Documents\\My Pictures\\") returned 38 [0103.041] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\Documents\\My Pictures\\*") returned="C:\\Users\\Public\\Documents\\My Pictures\\*" [0103.041] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0xffffffff [0103.043] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Users\\Public\\Documents\\My Music\\" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\") returned="C:\\Users\\Public\\Documents\\My Music\\" [0103.043] GetProcessHeap () returned 0xd20000 [0103.043] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd43ec8 | out: hHeap=0xd20000) returned 1 [0103.044] GetProcessHeap () returned 0xd20000 [0103.044] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0103.044] lstrlenW (lpString="C:\\Users\\Public\\Documents\\My Music\\") returned 35 [0103.044] lstrcatW (in: lpString1="C:\\Users\\Public\\Documents\\My Music\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\Documents\\My Music\\*") returned="C:\\Users\\Public\\Documents\\My Music\\*" [0103.044] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0xffffffff [0103.046] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Users\\Public\\Desktop\\" | out: lpString1="C:\\Users\\Public\\Desktop\\") returned="C:\\Users\\Public\\Desktop\\" [0103.046] GetProcessHeap () returned 0xd20000 [0103.046] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36a88 | out: hHeap=0xd20000) returned 1 [0103.046] GetProcessHeap () returned 0xd20000 [0103.046] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.046] lstrlenW (lpString="C:\\Users\\Public\\Desktop\\") returned 24 [0103.046] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\Desktop\\*") returned="C:\\Users\\Public\\Desktop\\*" [0103.046] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd36948 [0103.047] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0103.047] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.047] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0103.047] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0103.047] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38bb5c78, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38bb5c78, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38bb5c78, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x852, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Acrobat Reader DC.lnk", cAlternateFileName="ACROBA~1.LNK")) returned 1 [0103.047] lstrcmpiW (lpString1="Acrobat Reader DC.lnk", lpString2=".") returned 1 [0103.047] lstrcmpiW (lpString1="Acrobat Reader DC.lnk", lpString2="..") returned 1 [0103.047] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="Acrobat Reader DC.lnk" | out: lpString1="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk") returned="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" [0103.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Acrobat Reader DC.lnk", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0103.047] GetProcessHeap () returned 0xd20000 [0103.047] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x16) returned 0xd36768 [0103.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Acrobat Reader DC.lnk", cchWideChar=-1, lpMultiByteStr=0xd36768, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Acrobat Reader DC.lnk", lpUsedDefaultChar=0x0) returned 22 [0103.047] lstrlenA (lpString="Acrobat Reader DC.lnk") returned 21 [0103.047] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0103.047] lstrlenA (lpString="Acrobat Reader DC.lnk") returned 21 [0103.047] lstrlenA (lpString=".dll") returned 4 [0103.048] lstrlenA (lpString=".dll") returned 4 [0103.048] lstrlenA (lpString="Acrobat Reader DC.lnk") returned 21 [0103.048] lstrcmpiA (lpString1=".lnk", lpString2=".dll") returned 1 [0103.048] lstrlenA (lpString="Acrobat Reader DC.lnk") returned 21 [0103.048] lstrlenA (lpString=".ini") returned 4 [0103.048] lstrlenA (lpString=".ini") returned 4 [0103.048] lstrlenA (lpString="Acrobat Reader DC.lnk") returned 21 [0103.048] lstrcmpiA (lpString1=".lnk", lpString2=".ini") returned 1 [0103.048] lstrlenA (lpString="Acrobat Reader DC.lnk") returned 21 [0103.048] lstrlenA (lpString=".inc") returned 4 [0103.048] lstrlenA (lpString=".inc") returned 4 [0103.048] lstrlenA (lpString="Acrobat Reader DC.lnk") returned 21 [0103.048] lstrcmpiA (lpString1=".lnk", lpString2=".inc") returned 1 [0103.048] lstrcmpiW (lpString1="Acrobat Reader DC.lnk", lpString2="HOW_RECOVER.html") returned -1 [0103.048] lstrcmpiW (lpString1="Acrobat Reader DC.lnk", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0103.048] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0103.048] lstrcmpiW (lpString1="Acrobat Reader DC.lnk", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0103.048] GetProcessHeap () returned 0xd20000 [0103.048] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42828 [0103.048] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0103.049] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=2130) returned 1 [0103.049] GetProcessHeap () returned 0xd20000 [0103.049] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c1d8 [0103.049] GetProcessHeap () returned 0xd20000 [0103.049] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0103.049] lstrlenW (lpString="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk") returned 45 [0103.050] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0103.050] GetProcessHeap () returned 0xd20000 [0103.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0103.050] GetProcessHeap () returned 0xd20000 [0103.050] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x38e) returned 0xd4e360 [0103.050] lstrlenA (lpString="rsa_encrypt") returned 11 [0103.050] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0103.052] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0103.052] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0103.052] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0103.052] GetProcessHeap () returned 0xd20000 [0103.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0103.052] lstrlenA (lpString="010001") returned 6 [0103.052] GetProcessHeap () returned 0xd20000 [0103.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc88 [0103.052] GetProcessHeap () returned 0xd20000 [0103.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0103.052] GetProcessHeap () returned 0xd20000 [0103.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b638 [0103.052] GetProcessHeap () returned 0xd20000 [0103.052] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0103.052] GetProcessHeap () returned 0xd20000 [0103.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b6c8 [0103.053] GetProcessHeap () returned 0xd20000 [0103.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44920 [0103.053] GetProcessHeap () returned 0xd20000 [0103.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc48 [0103.053] GetProcessHeap () returned 0xd20000 [0103.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0103.053] GetProcessHeap () returned 0xd20000 [0103.053] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0103.053] GetProcessHeap () returned 0xd20000 [0103.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0103.053] GetProcessHeap () returned 0xd20000 [0103.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0103.053] GetProcessHeap () returned 0xd20000 [0103.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44808 [0103.053] GetProcessHeap () returned 0xd20000 [0103.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0103.053] GetProcessHeap () returned 0xd20000 [0103.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44558 [0103.053] GetProcessHeap () returned 0xd20000 [0103.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4adc8 [0103.053] GetProcessHeap () returned 0xd20000 [0103.053] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0103.053] GetProcessHeap () returned 0xd20000 [0103.053] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0103.053] GetProcessHeap () returned 0xd20000 [0103.053] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4adc8 | out: hHeap=0xd20000) returned 1 [0103.054] GetProcessHeap () returned 0xd20000 [0103.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0103.054] GetProcessHeap () returned 0xd20000 [0103.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446d8 [0103.054] GetProcessHeap () returned 0xd20000 [0103.054] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0103.054] GetProcessHeap () returned 0xd20000 [0103.054] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0103.054] GetProcessHeap () returned 0xd20000 [0103.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0103.054] GetProcessHeap () returned 0xd20000 [0103.054] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0103.054] GetProcessHeap () returned 0xd20000 [0103.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0103.054] GetProcessHeap () returned 0xd20000 [0103.054] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0103.054] GetProcessHeap () returned 0xd20000 [0103.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b008 [0103.054] GetProcessHeap () returned 0xd20000 [0103.054] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446d8 | out: hHeap=0xd20000) returned 1 [0103.054] GetProcessHeap () returned 0xd20000 [0103.054] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0103.054] GetProcessHeap () returned 0xd20000 [0103.054] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b008 | out: hHeap=0xd20000) returned 1 [0103.054] GetProcessHeap () returned 0xd20000 [0103.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0103.055] GetProcessHeap () returned 0xd20000 [0103.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0103.055] GetProcessHeap () returned 0xd20000 [0103.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.055] GetProcessHeap () returned 0xd20000 [0103.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.055] GetProcessHeap () returned 0xd20000 [0103.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.055] GetProcessHeap () returned 0xd20000 [0103.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.055] GetProcessHeap () returned 0xd20000 [0103.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0103.055] GetProcessHeap () returned 0xd20000 [0103.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0103.055] GetProcessHeap () returned 0xd20000 [0103.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0103.055] GetProcessHeap () returned 0xd20000 [0103.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0103.055] GetProcessHeap () returned 0xd20000 [0103.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0103.055] GetProcessHeap () returned 0xd20000 [0103.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0103.056] GetProcessHeap () returned 0xd20000 [0103.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0103.056] GetProcessHeap () returned 0xd20000 [0103.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0103.056] GetProcessHeap () returned 0xd20000 [0103.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0103.056] GetProcessHeap () returned 0xd20000 [0103.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0103.056] GetProcessHeap () returned 0xd20000 [0103.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.056] GetProcessHeap () returned 0xd20000 [0103.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.056] GetProcessHeap () returned 0xd20000 [0103.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0103.056] GetProcessHeap () returned 0xd20000 [0103.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0103.056] GetProcessHeap () returned 0xd20000 [0103.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0103.056] GetProcessHeap () returned 0xd20000 [0103.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0103.056] GetProcessHeap () returned 0xd20000 [0103.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0103.056] GetProcessHeap () returned 0xd20000 [0103.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0103.057] GetProcessHeap () returned 0xd20000 [0103.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.057] GetProcessHeap () returned 0xd20000 [0103.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.057] GetProcessHeap () returned 0xd20000 [0103.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.057] GetProcessHeap () returned 0xd20000 [0103.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.057] GetProcessHeap () returned 0xd20000 [0103.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.057] GetProcessHeap () returned 0xd20000 [0103.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.057] GetProcessHeap () returned 0xd20000 [0103.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0103.057] GetProcessHeap () returned 0xd20000 [0103.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0103.057] GetProcessHeap () returned 0xd20000 [0103.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0103.057] GetProcessHeap () returned 0xd20000 [0103.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0103.057] GetProcessHeap () returned 0xd20000 [0103.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0103.057] GetProcessHeap () returned 0xd20000 [0103.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0103.058] GetProcessHeap () returned 0xd20000 [0103.058] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.058] GetProcessHeap () returned 0xd20000 [0103.058] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.058] GetProcessHeap () returned 0xd20000 [0103.058] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0103.058] GetProcessHeap () returned 0xd20000 [0103.058] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0103.058] GetProcessHeap () returned 0xd20000 [0103.058] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0103.058] GetProcessHeap () returned 0xd20000 [0103.058] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0103.058] GetProcessHeap () returned 0xd20000 [0103.058] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0103.058] GetProcessHeap () returned 0xd20000 [0103.058] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0103.058] GetProcessHeap () returned 0xd20000 [0103.058] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0103.058] GetProcessHeap () returned 0xd20000 [0103.058] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0103.058] GetProcessHeap () returned 0xd20000 [0103.058] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0103.058] GetProcessHeap () returned 0xd20000 [0103.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0103.059] GetProcessHeap () returned 0xd20000 [0103.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0103.059] GetProcessHeap () returned 0xd20000 [0103.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0103.059] GetProcessHeap () returned 0xd20000 [0103.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0103.059] GetProcessHeap () returned 0xd20000 [0103.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0103.059] GetProcessHeap () returned 0xd20000 [0103.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0103.059] GetProcessHeap () returned 0xd20000 [0103.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0103.059] GetProcessHeap () returned 0xd20000 [0103.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.059] GetProcessHeap () returned 0xd20000 [0103.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.059] GetProcessHeap () returned 0xd20000 [0103.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0103.059] GetProcessHeap () returned 0xd20000 [0103.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0103.060] GetProcessHeap () returned 0xd20000 [0103.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0103.060] GetProcessHeap () returned 0xd20000 [0103.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0103.060] GetProcessHeap () returned 0xd20000 [0103.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0103.060] GetProcessHeap () returned 0xd20000 [0103.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0103.060] GetProcessHeap () returned 0xd20000 [0103.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0103.060] GetProcessHeap () returned 0xd20000 [0103.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0103.060] GetProcessHeap () returned 0xd20000 [0103.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.060] GetProcessHeap () returned 0xd20000 [0103.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.060] GetProcessHeap () returned 0xd20000 [0103.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.060] GetProcessHeap () returned 0xd20000 [0103.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.060] GetProcessHeap () returned 0xd20000 [0103.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.060] GetProcessHeap () returned 0xd20000 [0103.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.061] GetProcessHeap () returned 0xd20000 [0103.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0103.061] GetProcessHeap () returned 0xd20000 [0103.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0103.061] GetProcessHeap () returned 0xd20000 [0103.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0103.061] GetProcessHeap () returned 0xd20000 [0103.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0103.061] GetProcessHeap () returned 0xd20000 [0103.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.061] GetProcessHeap () returned 0xd20000 [0103.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.061] GetProcessHeap () returned 0xd20000 [0103.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0103.061] GetProcessHeap () returned 0xd20000 [0103.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0103.061] GetProcessHeap () returned 0xd20000 [0103.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.061] GetProcessHeap () returned 0xd20000 [0103.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.061] GetProcessHeap () returned 0xd20000 [0103.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0103.062] GetProcessHeap () returned 0xd20000 [0103.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0103.062] GetProcessHeap () returned 0xd20000 [0103.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.062] GetProcessHeap () returned 0xd20000 [0103.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.062] GetProcessHeap () returned 0xd20000 [0103.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0103.062] GetProcessHeap () returned 0xd20000 [0103.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0103.062] GetProcessHeap () returned 0xd20000 [0103.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.062] GetProcessHeap () returned 0xd20000 [0103.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.062] GetProcessHeap () returned 0xd20000 [0103.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0103.062] GetProcessHeap () returned 0xd20000 [0103.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0103.062] GetProcessHeap () returned 0xd20000 [0103.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0103.062] GetProcessHeap () returned 0xd20000 [0103.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0103.062] GetProcessHeap () returned 0xd20000 [0103.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.062] GetProcessHeap () returned 0xd20000 [0103.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.063] GetProcessHeap () returned 0xd20000 [0103.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0103.063] GetProcessHeap () returned 0xd20000 [0103.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0103.063] GetProcessHeap () returned 0xd20000 [0103.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0103.063] GetProcessHeap () returned 0xd20000 [0103.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0103.063] GetProcessHeap () returned 0xd20000 [0103.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0103.063] GetProcessHeap () returned 0xd20000 [0103.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0103.063] GetProcessHeap () returned 0xd20000 [0103.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0103.063] GetProcessHeap () returned 0xd20000 [0103.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0103.063] GetProcessHeap () returned 0xd20000 [0103.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.063] GetProcessHeap () returned 0xd20000 [0103.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.063] GetProcessHeap () returned 0xd20000 [0103.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.064] GetProcessHeap () returned 0xd20000 [0103.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.064] GetProcessHeap () returned 0xd20000 [0103.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0103.064] GetProcessHeap () returned 0xd20000 [0103.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0103.064] GetProcessHeap () returned 0xd20000 [0103.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0103.064] GetProcessHeap () returned 0xd20000 [0103.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0103.064] GetProcessHeap () returned 0xd20000 [0103.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.064] GetProcessHeap () returned 0xd20000 [0103.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.064] GetProcessHeap () returned 0xd20000 [0103.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0103.064] GetProcessHeap () returned 0xd20000 [0103.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0103.210] GetProcessHeap () returned 0xd20000 [0103.210] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0103.210] GetProcessHeap () returned 0xd20000 [0103.210] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0103.210] GetProcessHeap () returned 0xd20000 [0103.211] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0103.211] GetProcessHeap () returned 0xd20000 [0103.211] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0103.211] GetProcessHeap () returned 0xd20000 [0103.211] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0103.211] GetProcessHeap () returned 0xd20000 [0103.211] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0103.211] GetProcessHeap () returned 0xd20000 [0103.211] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0103.211] GetProcessHeap () returned 0xd20000 [0103.211] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0103.211] GetProcessHeap () returned 0xd20000 [0103.211] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0103.211] GetProcessHeap () returned 0xd20000 [0103.211] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0103.211] GetProcessHeap () returned 0xd20000 [0103.211] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0103.211] GetProcessHeap () returned 0xd20000 [0103.211] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0103.211] GetProcessHeap () returned 0xd20000 [0103.211] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0103.211] GetProcessHeap () returned 0xd20000 [0103.212] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0103.212] GetProcessHeap () returned 0xd20000 [0103.212] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.212] GetProcessHeap () returned 0xd20000 [0103.212] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.212] GetProcessHeap () returned 0xd20000 [0103.212] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0103.212] GetProcessHeap () returned 0xd20000 [0103.212] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0103.212] GetProcessHeap () returned 0xd20000 [0103.212] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.212] GetProcessHeap () returned 0xd20000 [0103.212] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.212] GetProcessHeap () returned 0xd20000 [0103.212] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0103.212] GetProcessHeap () returned 0xd20000 [0103.212] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0103.212] GetProcessHeap () returned 0xd20000 [0103.212] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.212] GetProcessHeap () returned 0xd20000 [0103.212] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.212] GetProcessHeap () returned 0xd20000 [0103.212] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0103.212] GetProcessHeap () returned 0xd20000 [0103.212] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0103.213] GetProcessHeap () returned 0xd20000 [0103.213] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0103.213] GetProcessHeap () returned 0xd20000 [0103.213] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0103.213] GetProcessHeap () returned 0xd20000 [0103.213] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.213] GetProcessHeap () returned 0xd20000 [0103.213] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.213] GetProcessHeap () returned 0xd20000 [0103.213] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.213] GetProcessHeap () returned 0xd20000 [0103.213] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.213] GetProcessHeap () returned 0xd20000 [0103.213] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0103.213] GetProcessHeap () returned 0xd20000 [0103.213] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0103.213] GetProcessHeap () returned 0xd20000 [0103.213] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.213] GetProcessHeap () returned 0xd20000 [0103.213] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.213] GetProcessHeap () returned 0xd20000 [0103.213] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0103.213] GetProcessHeap () returned 0xd20000 [0103.213] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0103.214] GetProcessHeap () returned 0xd20000 [0103.214] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.214] GetProcessHeap () returned 0xd20000 [0103.214] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.214] GetProcessHeap () returned 0xd20000 [0103.214] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0103.214] GetProcessHeap () returned 0xd20000 [0103.214] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0103.214] GetProcessHeap () returned 0xd20000 [0103.214] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0103.214] GetProcessHeap () returned 0xd20000 [0103.214] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0103.214] GetProcessHeap () returned 0xd20000 [0103.214] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0103.214] GetProcessHeap () returned 0xd20000 [0103.214] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0103.214] GetProcessHeap () returned 0xd20000 [0103.214] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0103.214] GetProcessHeap () returned 0xd20000 [0103.214] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0103.214] GetProcessHeap () returned 0xd20000 [0103.214] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0103.214] GetProcessHeap () returned 0xd20000 [0103.214] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0103.214] GetProcessHeap () returned 0xd20000 [0103.215] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0103.215] GetProcessHeap () returned 0xd20000 [0103.215] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0103.215] GetProcessHeap () returned 0xd20000 [0103.215] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0103.215] GetProcessHeap () returned 0xd20000 [0103.215] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0103.215] GetProcessHeap () returned 0xd20000 [0103.215] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0103.215] GetProcessHeap () returned 0xd20000 [0103.215] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0103.215] GetProcessHeap () returned 0xd20000 [0103.215] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0103.215] GetProcessHeap () returned 0xd20000 [0103.215] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0103.215] GetProcessHeap () returned 0xd20000 [0103.215] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0103.215] GetProcessHeap () returned 0xd20000 [0103.215] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0103.215] GetProcessHeap () returned 0xd20000 [0103.215] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44558 | out: hHeap=0xd20000) returned 1 [0103.215] GetProcessHeap () returned 0xd20000 [0103.215] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b6c8 | out: hHeap=0xd20000) returned 1 [0103.216] GetProcessHeap () returned 0xd20000 [0103.216] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0103.216] GetProcessHeap () returned 0xd20000 [0103.216] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b638 | out: hHeap=0xd20000) returned 1 [0103.216] GetProcessHeap () returned 0xd20000 [0103.216] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0103.216] GetProcessHeap () returned 0xd20000 [0103.216] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0103.216] GetProcessHeap () returned 0xd20000 [0103.216] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0103.216] WriteFile (in: hFile=0x230, lpBuffer=0xd4e360*, nNumberOfBytesToWrite=0x38e, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e360*, lpNumberOfBytesWritten=0x299d864*=0x38e, lpOverlapped=0x0) returned 1 [0103.219] GetProcessHeap () returned 0xd20000 [0103.219] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4e360, Size=0x30) returned 0xd4e360 [0103.219] GetProcessHeap () returned 0xd20000 [0103.219] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0103.219] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0103.219] GetProcessHeap () returned 0xd20000 [0103.219] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x860) returned 0xd4e398 [0103.219] ReadFile (in: hFile=0x230, lpBuffer=0xd4e398, nNumberOfBytesToRead=0x860, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4e398*, lpNumberOfBytesRead=0x299d7e8*=0x860, lpOverlapped=0x0) returned 1 [0103.220] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0103.220] WriteFile (in: hFile=0x230, lpBuffer=0xd4e398*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4e398*, lpNumberOfBytesWritten=0x299d7e4*=0x860, lpOverlapped=0x0) returned 1 [0103.221] GetProcessHeap () returned 0xd20000 [0103.221] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4e398 | out: hHeap=0xd20000) returned 1 [0103.221] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0103.222] WriteFile (in: hFile=0x230, lpBuffer=0xd4e360*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e360*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0103.223] CloseHandle (hObject=0x230) returned 1 [0103.229] GetProcessHeap () returned 0xd20000 [0103.229] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42828 | out: hHeap=0xd20000) returned 1 [0103.229] GetProcessHeap () returned 0xd20000 [0103.229] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c1d8 | out: hHeap=0xd20000) returned 1 [0103.229] GetProcessHeap () returned 0xd20000 [0103.229] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0103.229] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" | out: lpString1="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk") returned="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" [0103.229] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk.[ponce.lorena@aol.com]") returned="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk.[ponce.lorena@aol.com]" [0103.229] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk.[ponce.lorena@aol.com]" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0103.231] PathRemoveFileSpecW (in: pszPath="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" | out: pszPath="C:\\Users\\Public\\Desktop") returned 1 [0103.231] PathAddBackslashW (in: pszPath="C:\\Users\\Public\\Desktop" | out: pszPath="C:\\Users\\Public\\Desktop\\") returned="" [0103.231] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\Public\\Desktop\\HOW_RECOVER.html") returned="C:\\Users\\Public\\Desktop\\HOW_RECOVER.html" [0103.231] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Desktop\\HOW_RECOVER.html" (normalized: "c:\\users\\public\\desktop\\how_recover.html")) returned 0xffffffff [0103.231] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\HOW_RECOVER.html" (normalized: "c:\\users\\public\\desktop\\how_recover.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0103.234] GetProcessHeap () returned 0xd20000 [0103.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c250 [0103.234] GetProcessHeap () returned 0xd20000 [0103.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0103.241] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.244] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.244] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.244] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.244] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.244] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.244] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.244] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.245] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.245] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.245] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.245] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.245] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.245] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.245] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.245] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.245] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.246] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.246] GetProcessHeap () returned 0xd20000 [0103.246] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c250 | out: hHeap=0xd20000) returned 1 [0103.246] GetProcessHeap () returned 0xd20000 [0103.246] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0103.246] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x299d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x299d9d0*=0x300, lpOverlapped=0x0) returned 1 [0103.247] GetProcessHeap () returned 0xd20000 [0103.247] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bf08 [0103.247] GetProcessHeap () returned 0xd20000 [0103.247] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0103.256] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.257] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.257] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.257] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.257] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.257] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.257] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.257] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.257] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.258] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.258] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.258] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.258] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.258] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.258] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.258] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.258] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.258] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.258] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.259] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.259] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.259] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.259] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.259] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.259] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.259] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.259] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.260] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.260] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.260] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.260] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.260] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.260] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.260] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.260] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.261] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.261] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.261] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.261] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.261] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.262] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.262] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.262] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.262] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.262] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.262] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.262] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.262] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.262] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.262] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.263] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.263] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.263] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.263] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.263] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.263] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.263] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.263] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.263] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.263] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.264] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.264] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.264] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.264] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.264] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.264] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.264] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.328] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.329] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.329] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.329] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.329] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.329] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.329] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.329] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.329] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.330] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.330] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.330] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.330] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.331] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.331] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.331] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.332] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.332] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.332] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.332] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.332] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.332] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.332] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.332] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.332] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.333] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.333] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.333] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.333] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.333] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.333] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.334] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.334] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.334] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.334] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.334] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.334] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.334] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.334] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.335] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.335] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.335] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.335] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0103.335] GetProcessHeap () returned 0xd20000 [0103.335] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bf08 | out: hHeap=0xd20000) returned 1 [0103.335] GetProcessHeap () returned 0xd20000 [0103.335] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0103.335] CloseHandle (hObject=0x230) returned 1 [0103.381] GetProcessHeap () returned 0xd20000 [0103.381] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36768 | out: hHeap=0xd20000) returned 1 [0103.381] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0103.381] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0103.381] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0103.381] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\Desktop\\desktop.ini") returned="C:\\Users\\Public\\Desktop\\desktop.ini" [0103.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0103.381] GetProcessHeap () returned 0xd20000 [0103.381] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd44648 [0103.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0xd44648, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0103.381] lstrlenA (lpString="desktop.ini") returned 11 [0103.381] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0103.381] lstrlenA (lpString="desktop.ini") returned 11 [0103.381] lstrlenA (lpString=".dll") returned 4 [0103.381] lstrlenA (lpString=".dll") returned 4 [0103.381] lstrlenA (lpString="desktop.ini") returned 11 [0103.382] lstrcmpiA (lpString1=".ini", lpString2=".dll") returned 1 [0103.382] lstrlenA (lpString="desktop.ini") returned 11 [0103.382] lstrlenA (lpString=".ini") returned 4 [0103.382] lstrlenA (lpString=".ini") returned 4 [0103.382] lstrlenA (lpString="desktop.ini") returned 11 [0103.382] lstrcmpiA (lpString1=".ini", lpString2=".ini") returned 0 [0103.382] GetProcessHeap () returned 0xd20000 [0103.382] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44648 | out: hHeap=0xd20000) returned 1 [0103.382] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4c3ce2c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c6308a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x91a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0103.382] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2=".") returned 1 [0103.382] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="..") returned 1 [0103.382] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="Google Chrome.lnk" | out: lpString1="C:\\Users\\Public\\Desktop\\Google Chrome.lnk") returned="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" [0103.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Google Chrome.lnk", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0103.382] GetProcessHeap () returned 0xd20000 [0103.382] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x12) returned 0xd364c8 [0103.382] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Google Chrome.lnk", cchWideChar=-1, lpMultiByteStr=0xd364c8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Google Chrome.lnk", lpUsedDefaultChar=0x0) returned 18 [0103.382] lstrlenA (lpString="Google Chrome.lnk") returned 17 [0103.382] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0103.382] lstrlenA (lpString="Google Chrome.lnk") returned 17 [0103.382] lstrlenA (lpString=".dll") returned 4 [0103.383] lstrlenA (lpString=".dll") returned 4 [0103.383] lstrlenA (lpString="Google Chrome.lnk") returned 17 [0103.383] lstrcmpiA (lpString1=".lnk", lpString2=".dll") returned 1 [0103.383] lstrlenA (lpString="Google Chrome.lnk") returned 17 [0103.383] lstrlenA (lpString=".ini") returned 4 [0103.383] lstrlenA (lpString=".ini") returned 4 [0103.383] lstrlenA (lpString="Google Chrome.lnk") returned 17 [0103.383] lstrcmpiA (lpString1=".lnk", lpString2=".ini") returned 1 [0103.383] lstrlenA (lpString="Google Chrome.lnk") returned 17 [0103.383] lstrlenA (lpString=".inc") returned 4 [0103.383] lstrlenA (lpString=".inc") returned 4 [0103.383] lstrlenA (lpString="Google Chrome.lnk") returned 17 [0103.383] lstrcmpiA (lpString1=".lnk", lpString2=".inc") returned 1 [0103.383] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="HOW_RECOVER.html") returned -1 [0103.383] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0103.383] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0103.383] lstrcmpiW (lpString1="Google Chrome.lnk", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0103.383] GetProcessHeap () returned 0xd20000 [0103.383] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42850 [0103.383] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0103.384] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=2330) returned 1 [0103.384] GetProcessHeap () returned 0xd20000 [0103.384] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bcb0 [0103.384] GetProcessHeap () returned 0xd20000 [0103.384] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0103.384] lstrlenW (lpString="C:\\Users\\Public\\Desktop\\Google Chrome.lnk") returned 41 [0103.384] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0103.384] GetProcessHeap () returned 0xd20000 [0103.384] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0103.384] GetProcessHeap () returned 0xd20000 [0103.385] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x386) returned 0xd4e398 [0103.385] lstrlenA (lpString="rsa_encrypt") returned 11 [0103.385] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0103.387] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0103.387] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0103.387] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0103.387] GetProcessHeap () returned 0xd20000 [0103.387] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0103.387] lstrlenA (lpString="010001") returned 6 [0103.388] GetProcessHeap () returned 0xd20000 [0103.388] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0103.388] GetProcessHeap () returned 0xd20000 [0103.388] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0103.388] GetProcessHeap () returned 0xd20000 [0103.388] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aa68 [0103.388] GetProcessHeap () returned 0xd20000 [0103.388] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0103.388] GetProcessHeap () returned 0xd20000 [0103.388] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4adc8 [0103.388] GetProcessHeap () returned 0xd20000 [0103.388] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44d80 [0103.388] GetProcessHeap () returned 0xd20000 [0103.388] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc88 [0103.388] GetProcessHeap () returned 0xd20000 [0103.388] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0103.388] GetProcessHeap () returned 0xd20000 [0103.388] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0103.388] GetProcessHeap () returned 0xd20000 [0103.388] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0103.389] GetProcessHeap () returned 0xd20000 [0103.389] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0103.389] GetProcessHeap () returned 0xd20000 [0103.389] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd45640 [0103.389] GetProcessHeap () returned 0xd20000 [0103.389] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0103.389] GetProcessHeap () returned 0xd20000 [0103.389] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44630 [0103.389] GetProcessHeap () returned 0xd20000 [0103.389] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ac18 [0103.389] GetProcessHeap () returned 0xd20000 [0103.389] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0103.389] GetProcessHeap () returned 0xd20000 [0103.389] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0103.389] GetProcessHeap () returned 0xd20000 [0103.389] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ac18 | out: hHeap=0xd20000) returned 1 [0103.389] GetProcessHeap () returned 0xd20000 [0103.389] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0103.389] GetProcessHeap () returned 0xd20000 [0103.389] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446a8 [0103.389] GetProcessHeap () returned 0xd20000 [0103.390] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0103.390] GetProcessHeap () returned 0xd20000 [0103.390] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0103.390] GetProcessHeap () returned 0xd20000 [0103.390] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0103.390] GetProcessHeap () returned 0xd20000 [0103.390] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0103.390] GetProcessHeap () returned 0xd20000 [0103.390] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0103.390] GetProcessHeap () returned 0xd20000 [0103.390] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0103.390] GetProcessHeap () returned 0xd20000 [0103.390] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b248 [0103.390] GetProcessHeap () returned 0xd20000 [0103.390] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446a8 | out: hHeap=0xd20000) returned 1 [0103.390] GetProcessHeap () returned 0xd20000 [0103.390] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0103.390] GetProcessHeap () returned 0xd20000 [0103.390] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b248 | out: hHeap=0xd20000) returned 1 [0103.390] GetProcessHeap () returned 0xd20000 [0103.391] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.391] GetProcessHeap () returned 0xd20000 [0103.391] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.391] GetProcessHeap () returned 0xd20000 [0103.391] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0103.391] GetProcessHeap () returned 0xd20000 [0103.391] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0103.391] GetProcessHeap () returned 0xd20000 [0103.391] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.391] GetProcessHeap () returned 0xd20000 [0103.391] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.391] GetProcessHeap () returned 0xd20000 [0103.391] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0103.391] GetProcessHeap () returned 0xd20000 [0103.391] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0103.391] GetProcessHeap () returned 0xd20000 [0103.391] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0103.391] GetProcessHeap () returned 0xd20000 [0103.391] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0103.391] GetProcessHeap () returned 0xd20000 [0103.392] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0103.392] GetProcessHeap () returned 0xd20000 [0103.392] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0103.392] GetProcessHeap () returned 0xd20000 [0103.392] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.392] GetProcessHeap () returned 0xd20000 [0103.392] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.392] GetProcessHeap () returned 0xd20000 [0103.392] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.392] GetProcessHeap () returned 0xd20000 [0103.392] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.392] GetProcessHeap () returned 0xd20000 [0103.392] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0103.392] GetProcessHeap () returned 0xd20000 [0103.392] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0103.392] GetProcessHeap () returned 0xd20000 [0103.392] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0103.392] GetProcessHeap () returned 0xd20000 [0103.392] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0103.393] GetProcessHeap () returned 0xd20000 [0103.393] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0103.393] GetProcessHeap () returned 0xd20000 [0103.393] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0103.394] GetProcessHeap () returned 0xd20000 [0103.394] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0103.394] GetProcessHeap () returned 0xd20000 [0103.394] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0103.394] GetProcessHeap () returned 0xd20000 [0103.394] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0103.394] GetProcessHeap () returned 0xd20000 [0103.394] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0103.394] GetProcessHeap () returned 0xd20000 [0103.394] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0103.394] GetProcessHeap () returned 0xd20000 [0103.394] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0103.394] GetProcessHeap () returned 0xd20000 [0103.394] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0103.394] GetProcessHeap () returned 0xd20000 [0103.394] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0103.394] GetProcessHeap () returned 0xd20000 [0103.394] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.394] GetProcessHeap () returned 0xd20000 [0103.394] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.394] GetProcessHeap () returned 0xd20000 [0103.395] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0103.395] GetProcessHeap () returned 0xd20000 [0103.395] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0103.395] GetProcessHeap () returned 0xd20000 [0103.395] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.395] GetProcessHeap () returned 0xd20000 [0103.395] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.395] GetProcessHeap () returned 0xd20000 [0103.395] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0103.395] GetProcessHeap () returned 0xd20000 [0103.395] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0103.395] GetProcessHeap () returned 0xd20000 [0103.395] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0103.395] GetProcessHeap () returned 0xd20000 [0103.395] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0103.395] GetProcessHeap () returned 0xd20000 [0103.395] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0103.396] GetProcessHeap () returned 0xd20000 [0103.396] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0103.396] GetProcessHeap () returned 0xd20000 [0103.396] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0103.396] GetProcessHeap () returned 0xd20000 [0103.396] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0103.396] GetProcessHeap () returned 0xd20000 [0103.396] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0103.396] GetProcessHeap () returned 0xd20000 [0103.396] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0103.396] GetProcessHeap () returned 0xd20000 [0103.396] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.396] GetProcessHeap () returned 0xd20000 [0103.396] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.396] GetProcessHeap () returned 0xd20000 [0103.396] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0103.396] GetProcessHeap () returned 0xd20000 [0103.396] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0103.396] GetProcessHeap () returned 0xd20000 [0103.397] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0103.397] GetProcessHeap () returned 0xd20000 [0103.397] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0103.397] GetProcessHeap () returned 0xd20000 [0103.397] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0103.397] GetProcessHeap () returned 0xd20000 [0103.397] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0103.397] GetProcessHeap () returned 0xd20000 [0103.397] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0103.397] GetProcessHeap () returned 0xd20000 [0103.397] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0103.397] GetProcessHeap () returned 0xd20000 [0103.397] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0103.397] GetProcessHeap () returned 0xd20000 [0103.397] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0103.397] GetProcessHeap () returned 0xd20000 [0103.397] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.397] GetProcessHeap () returned 0xd20000 [0103.397] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.397] GetProcessHeap () returned 0xd20000 [0103.398] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0103.398] GetProcessHeap () returned 0xd20000 [0103.398] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0103.398] GetProcessHeap () returned 0xd20000 [0103.398] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0103.398] GetProcessHeap () returned 0xd20000 [0103.398] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0103.398] GetProcessHeap () returned 0xd20000 [0103.398] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0103.398] GetProcessHeap () returned 0xd20000 [0103.398] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0103.398] GetProcessHeap () returned 0xd20000 [0103.398] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0103.398] GetProcessHeap () returned 0xd20000 [0103.398] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0103.398] GetProcessHeap () returned 0xd20000 [0103.398] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0103.398] GetProcessHeap () returned 0xd20000 [0103.398] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0103.398] GetProcessHeap () returned 0xd20000 [0103.399] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0103.399] GetProcessHeap () returned 0xd20000 [0103.399] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0103.399] GetProcessHeap () returned 0xd20000 [0103.399] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0103.399] GetProcessHeap () returned 0xd20000 [0103.399] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0103.399] GetProcessHeap () returned 0xd20000 [0103.399] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0103.399] GetProcessHeap () returned 0xd20000 [0103.399] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0103.399] GetProcessHeap () returned 0xd20000 [0103.399] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0103.399] GetProcessHeap () returned 0xd20000 [0103.399] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0103.399] GetProcessHeap () returned 0xd20000 [0103.399] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0103.399] GetProcessHeap () returned 0xd20000 [0103.399] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0103.399] GetProcessHeap () returned 0xd20000 [0103.400] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0103.400] GetProcessHeap () returned 0xd20000 [0103.400] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0103.400] GetProcessHeap () returned 0xd20000 [0103.400] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0103.400] GetProcessHeap () returned 0xd20000 [0103.400] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0103.400] GetProcessHeap () returned 0xd20000 [0103.400] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0103.400] GetProcessHeap () returned 0xd20000 [0103.400] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0103.400] GetProcessHeap () returned 0xd20000 [0103.400] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0103.400] GetProcessHeap () returned 0xd20000 [0103.400] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0103.400] GetProcessHeap () returned 0xd20000 [0103.400] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0103.400] GetProcessHeap () returned 0xd20000 [0103.400] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0103.400] GetProcessHeap () returned 0xd20000 [0103.400] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0103.401] GetProcessHeap () returned 0xd20000 [0103.401] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0103.401] GetProcessHeap () returned 0xd20000 [0103.401] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0103.401] GetProcessHeap () returned 0xd20000 [0103.401] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0103.401] GetProcessHeap () returned 0xd20000 [0103.401] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.401] GetProcessHeap () returned 0xd20000 [0103.401] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.401] GetProcessHeap () returned 0xd20000 [0103.401] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0103.401] GetProcessHeap () returned 0xd20000 [0103.401] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0103.401] GetProcessHeap () returned 0xd20000 [0103.401] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0103.401] GetProcessHeap () returned 0xd20000 [0103.401] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0103.401] GetProcessHeap () returned 0xd20000 [0103.401] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0103.402] GetProcessHeap () returned 0xd20000 [0103.402] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0103.402] GetProcessHeap () returned 0xd20000 [0103.402] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0103.402] GetProcessHeap () returned 0xd20000 [0103.402] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0103.402] GetProcessHeap () returned 0xd20000 [0103.402] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0103.402] GetProcessHeap () returned 0xd20000 [0103.402] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0103.402] GetProcessHeap () returned 0xd20000 [0103.402] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0103.402] GetProcessHeap () returned 0xd20000 [0103.402] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0103.402] GetProcessHeap () returned 0xd20000 [0103.402] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0103.402] GetProcessHeap () returned 0xd20000 [0103.402] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0103.402] GetProcessHeap () returned 0xd20000 [0103.402] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0103.403] GetProcessHeap () returned 0xd20000 [0103.403] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0103.403] GetProcessHeap () returned 0xd20000 [0103.403] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0103.403] GetProcessHeap () returned 0xd20000 [0103.403] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0103.403] GetProcessHeap () returned 0xd20000 [0103.403] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0103.403] GetProcessHeap () returned 0xd20000 [0103.403] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0103.403] GetProcessHeap () returned 0xd20000 [0103.403] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0103.403] GetProcessHeap () returned 0xd20000 [0103.403] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0103.403] GetProcessHeap () returned 0xd20000 [0103.403] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.403] GetProcessHeap () returned 0xd20000 [0103.403] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.403] GetProcessHeap () returned 0xd20000 [0103.403] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0103.404] GetProcessHeap () returned 0xd20000 [0103.404] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0103.404] GetProcessHeap () returned 0xd20000 [0103.404] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0103.404] GetProcessHeap () returned 0xd20000 [0103.404] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0103.404] GetProcessHeap () returned 0xd20000 [0103.404] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0103.404] GetProcessHeap () returned 0xd20000 [0103.404] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0103.404] GetProcessHeap () returned 0xd20000 [0103.404] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0103.404] GetProcessHeap () returned 0xd20000 [0103.404] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0103.404] GetProcessHeap () returned 0xd20000 [0103.404] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0103.404] GetProcessHeap () returned 0xd20000 [0103.404] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0103.404] GetProcessHeap () returned 0xd20000 [0103.404] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0103.405] GetProcessHeap () returned 0xd20000 [0103.405] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0103.405] GetProcessHeap () returned 0xd20000 [0103.405] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0103.405] GetProcessHeap () returned 0xd20000 [0103.405] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0103.405] GetProcessHeap () returned 0xd20000 [0103.405] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0103.405] GetProcessHeap () returned 0xd20000 [0103.405] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0103.405] GetProcessHeap () returned 0xd20000 [0103.405] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0103.405] GetProcessHeap () returned 0xd20000 [0103.405] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0103.405] GetProcessHeap () returned 0xd20000 [0103.405] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0103.405] GetProcessHeap () returned 0xd20000 [0103.405] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0103.405] GetProcessHeap () returned 0xd20000 [0103.405] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0103.405] GetProcessHeap () returned 0xd20000 [0103.406] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0103.406] GetProcessHeap () returned 0xd20000 [0103.406] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0103.406] GetProcessHeap () returned 0xd20000 [0103.406] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0103.406] GetProcessHeap () returned 0xd20000 [0103.406] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.406] GetProcessHeap () returned 0xd20000 [0103.406] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.406] GetProcessHeap () returned 0xd20000 [0103.406] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0103.406] GetProcessHeap () returned 0xd20000 [0103.406] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0103.406] GetProcessHeap () returned 0xd20000 [0103.406] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.406] GetProcessHeap () returned 0xd20000 [0103.406] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.406] GetProcessHeap () returned 0xd20000 [0103.406] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0103.407] GetProcessHeap () returned 0xd20000 [0103.407] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0103.407] GetProcessHeap () returned 0xd20000 [0103.407] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0103.407] GetProcessHeap () returned 0xd20000 [0103.407] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0103.407] GetProcessHeap () returned 0xd20000 [0103.407] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0103.407] GetProcessHeap () returned 0xd20000 [0103.407] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0103.407] GetProcessHeap () returned 0xd20000 [0103.407] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0103.407] GetProcessHeap () returned 0xd20000 [0103.407] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0103.407] GetProcessHeap () returned 0xd20000 [0103.407] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0103.407] GetProcessHeap () returned 0xd20000 [0103.407] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0103.407] GetProcessHeap () returned 0xd20000 [0103.407] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0103.408] GetProcessHeap () returned 0xd20000 [0103.408] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0103.408] GetProcessHeap () returned 0xd20000 [0103.408] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0103.408] GetProcessHeap () returned 0xd20000 [0103.408] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0103.408] GetProcessHeap () returned 0xd20000 [0103.408] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.408] GetProcessHeap () returned 0xd20000 [0103.408] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.408] GetProcessHeap () returned 0xd20000 [0103.408] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.474] GetProcessHeap () returned 0xd20000 [0103.474] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.474] GetProcessHeap () returned 0xd20000 [0103.474] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0103.474] GetProcessHeap () returned 0xd20000 [0103.474] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0103.474] GetProcessHeap () returned 0xd20000 [0103.474] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0103.474] GetProcessHeap () returned 0xd20000 [0103.474] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0103.474] GetProcessHeap () returned 0xd20000 [0103.474] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0103.474] GetProcessHeap () returned 0xd20000 [0103.474] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0103.474] GetProcessHeap () returned 0xd20000 [0103.474] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44630 | out: hHeap=0xd20000) returned 1 [0103.475] GetProcessHeap () returned 0xd20000 [0103.475] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4adc8 | out: hHeap=0xd20000) returned 1 [0103.475] GetProcessHeap () returned 0xd20000 [0103.475] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0103.475] GetProcessHeap () returned 0xd20000 [0103.475] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aa68 | out: hHeap=0xd20000) returned 1 [0103.475] GetProcessHeap () returned 0xd20000 [0103.475] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0103.475] GetProcessHeap () returned 0xd20000 [0103.475] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.475] GetProcessHeap () returned 0xd20000 [0103.475] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0103.475] WriteFile (in: hFile=0x230, lpBuffer=0xd4e398*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e398*, lpNumberOfBytesWritten=0x299d864*=0x386, lpOverlapped=0x0) returned 1 [0103.733] GetProcessHeap () returned 0xd20000 [0103.733] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4e398, Size=0x30) returned 0xd4e398 [0103.733] GetProcessHeap () returned 0xd20000 [0103.733] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0103.734] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0103.734] GetProcessHeap () returned 0xd20000 [0103.734] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x920) returned 0xd4e3d0 [0103.734] ReadFile (in: hFile=0x230, lpBuffer=0xd4e3d0, nNumberOfBytesToRead=0x920, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4e3d0*, lpNumberOfBytesRead=0x299d7e8*=0x920, lpOverlapped=0x0) returned 1 [0103.734] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0103.734] WriteFile (in: hFile=0x230, lpBuffer=0xd4e3d0*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4e3d0*, lpNumberOfBytesWritten=0x299d7e4*=0x920, lpOverlapped=0x0) returned 1 [0103.735] GetProcessHeap () returned 0xd20000 [0103.736] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4e3d0 | out: hHeap=0xd20000) returned 1 [0103.736] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0103.736] WriteFile (in: hFile=0x230, lpBuffer=0xd4e398*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e398*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0103.737] CloseHandle (hObject=0x230) returned 1 [0103.739] GetProcessHeap () returned 0xd20000 [0103.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42850 | out: hHeap=0xd20000) returned 1 [0103.739] GetProcessHeap () returned 0xd20000 [0103.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bcb0 | out: hHeap=0xd20000) returned 1 [0103.739] GetProcessHeap () returned 0xd20000 [0103.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0103.739] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" | out: lpString1="C:\\Users\\Public\\Desktop\\Google Chrome.lnk") returned="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" [0103.739] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\Public\\Desktop\\Google Chrome.lnk.[ponce.lorena@aol.com]") returned="C:\\Users\\Public\\Desktop\\Google Chrome.lnk.[ponce.lorena@aol.com]" [0103.739] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk.[ponce.lorena@aol.com]" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0103.740] PathRemoveFileSpecW (in: pszPath="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" | out: pszPath="C:\\Users\\Public\\Desktop") returned 1 [0103.740] PathAddBackslashW (in: pszPath="C:\\Users\\Public\\Desktop" | out: pszPath="C:\\Users\\Public\\Desktop\\") returned="" [0103.740] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\Public\\Desktop\\HOW_RECOVER.html") returned="C:\\Users\\Public\\Desktop\\HOW_RECOVER.html" [0103.741] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Desktop\\HOW_RECOVER.html" (normalized: "c:\\users\\public\\desktop\\how_recover.html")) returned 0x20 [0103.741] GetProcessHeap () returned 0xd20000 [0103.741] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd364c8 | out: hHeap=0xd20000) returned 1 [0103.741] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef84fc3f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef84fc3f, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0103.741] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2=".") returned 1 [0103.741] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="..") returned 1 [0103.741] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="Mozilla Firefox.lnk" | out: lpString1="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk") returned="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" [0103.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Mozilla Firefox.lnk", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0103.741] GetProcessHeap () returned 0xd20000 [0103.741] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x14) returned 0xd36568 [0103.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Mozilla Firefox.lnk", cchWideChar=-1, lpMultiByteStr=0xd36568, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mozilla Firefox.lnk", lpUsedDefaultChar=0x0) returned 20 [0103.741] lstrlenA (lpString="Mozilla Firefox.lnk") returned 19 [0103.741] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0103.741] lstrlenA (lpString="Mozilla Firefox.lnk") returned 19 [0103.741] lstrlenA (lpString=".dll") returned 4 [0103.741] lstrlenA (lpString=".dll") returned 4 [0103.741] lstrlenA (lpString="Mozilla Firefox.lnk") returned 19 [0103.741] lstrcmpiA (lpString1=".lnk", lpString2=".dll") returned 1 [0103.741] lstrlenA (lpString="Mozilla Firefox.lnk") returned 19 [0103.742] lstrlenA (lpString=".ini") returned 4 [0103.742] lstrlenA (lpString=".ini") returned 4 [0103.742] lstrlenA (lpString="Mozilla Firefox.lnk") returned 19 [0103.742] lstrcmpiA (lpString1=".lnk", lpString2=".ini") returned 1 [0103.742] lstrlenA (lpString="Mozilla Firefox.lnk") returned 19 [0103.742] lstrlenA (lpString=".inc") returned 4 [0103.742] lstrlenA (lpString=".inc") returned 4 [0103.742] lstrlenA (lpString="Mozilla Firefox.lnk") returned 19 [0103.742] lstrcmpiA (lpString1=".lnk", lpString2=".inc") returned 1 [0103.742] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="HOW_RECOVER.html") returned 1 [0103.742] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0103.742] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0103.742] lstrcmpiW (lpString1="Mozilla Firefox.lnk", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0103.742] GetProcessHeap () returned 0xd20000 [0103.742] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42418 [0103.742] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0103.743] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=999) returned 1 [0103.743] GetProcessHeap () returned 0xd20000 [0103.743] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bcb0 [0103.743] GetProcessHeap () returned 0xd20000 [0103.743] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0103.743] lstrlenW (lpString="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk") returned 43 [0103.743] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0103.743] GetProcessHeap () returned 0xd20000 [0103.743] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0103.743] GetProcessHeap () returned 0xd20000 [0103.743] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x389) returned 0xd4e3d0 [0103.743] lstrlenA (lpString="rsa_encrypt") returned 11 [0103.743] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0103.746] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0103.746] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0103.746] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0103.746] GetProcessHeap () returned 0xd20000 [0103.746] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0103.746] lstrlenA (lpString="010001") returned 6 [0103.746] GetProcessHeap () returned 0xd20000 [0103.746] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd98 [0103.746] GetProcessHeap () returned 0xd20000 [0103.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0103.747] GetProcessHeap () returned 0xd20000 [0103.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b7e8 [0103.747] GetProcessHeap () returned 0xd20000 [0103.747] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0103.747] GetProcessHeap () returned 0xd20000 [0103.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aaf8 [0103.747] GetProcessHeap () returned 0xd20000 [0103.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44a38 [0103.747] GetProcessHeap () returned 0xd20000 [0103.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ccf8 [0103.747] GetProcessHeap () returned 0xd20000 [0103.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0103.747] GetProcessHeap () returned 0xd20000 [0103.747] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.747] GetProcessHeap () returned 0xd20000 [0103.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0103.747] GetProcessHeap () returned 0xd20000 [0103.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0103.747] GetProcessHeap () returned 0xd20000 [0103.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd45640 [0103.747] GetProcessHeap () returned 0xd20000 [0103.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.747] GetProcessHeap () returned 0xd20000 [0103.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44498 [0103.748] GetProcessHeap () returned 0xd20000 [0103.748] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aca8 [0103.748] GetProcessHeap () returned 0xd20000 [0103.748] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0103.748] GetProcessHeap () returned 0xd20000 [0103.748] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0103.748] GetProcessHeap () returned 0xd20000 [0103.748] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aca8 | out: hHeap=0xd20000) returned 1 [0103.748] GetProcessHeap () returned 0xd20000 [0103.748] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0103.748] GetProcessHeap () returned 0xd20000 [0103.748] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444e0 [0103.748] GetProcessHeap () returned 0xd20000 [0103.748] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.748] GetProcessHeap () returned 0xd20000 [0103.748] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0103.748] GetProcessHeap () returned 0xd20000 [0103.748] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.748] GetProcessHeap () returned 0xd20000 [0103.748] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.748] GetProcessHeap () returned 0xd20000 [0103.748] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0103.748] GetProcessHeap () returned 0xd20000 [0103.748] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0103.749] GetProcessHeap () returned 0xd20000 [0103.749] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b2d8 [0103.749] GetProcessHeap () returned 0xd20000 [0103.749] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444e0 | out: hHeap=0xd20000) returned 1 [0103.749] GetProcessHeap () returned 0xd20000 [0103.749] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44c68 [0103.749] GetProcessHeap () returned 0xd20000 [0103.749] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b2d8 | out: hHeap=0xd20000) returned 1 [0103.749] GetProcessHeap () returned 0xd20000 [0103.749] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.749] GetProcessHeap () returned 0xd20000 [0103.749] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.749] GetProcessHeap () returned 0xd20000 [0103.749] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.749] GetProcessHeap () returned 0xd20000 [0103.749] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.749] GetProcessHeap () returned 0xd20000 [0103.749] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.749] GetProcessHeap () returned 0xd20000 [0103.749] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.749] GetProcessHeap () returned 0xd20000 [0103.749] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0103.749] GetProcessHeap () returned 0xd20000 [0103.750] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0103.750] GetProcessHeap () returned 0xd20000 [0103.750] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.750] GetProcessHeap () returned 0xd20000 [0103.750] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.750] GetProcessHeap () returned 0xd20000 [0103.750] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.750] GetProcessHeap () returned 0xd20000 [0103.750] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.750] GetProcessHeap () returned 0xd20000 [0103.750] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.750] GetProcessHeap () returned 0xd20000 [0103.750] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.750] GetProcessHeap () returned 0xd20000 [0103.750] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0103.750] GetProcessHeap () returned 0xd20000 [0103.750] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0103.750] GetProcessHeap () returned 0xd20000 [0103.750] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0103.750] GetProcessHeap () returned 0xd20000 [0103.750] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0103.750] GetProcessHeap () returned 0xd20000 [0103.750] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd08 [0103.750] GetProcessHeap () returned 0xd20000 [0103.751] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd08 | out: hHeap=0xd20000) returned 1 [0103.751] GetProcessHeap () returned 0xd20000 [0103.751] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.751] GetProcessHeap () returned 0xd20000 [0103.751] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.751] GetProcessHeap () returned 0xd20000 [0103.751] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0103.751] GetProcessHeap () returned 0xd20000 [0103.751] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0103.751] GetProcessHeap () returned 0xd20000 [0103.751] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0103.751] GetProcessHeap () returned 0xd20000 [0103.751] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0103.751] GetProcessHeap () returned 0xd20000 [0103.751] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0103.751] GetProcessHeap () returned 0xd20000 [0103.751] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0103.751] GetProcessHeap () returned 0xd20000 [0103.751] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0103.751] GetProcessHeap () returned 0xd20000 [0103.751] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0103.751] GetProcessHeap () returned 0xd20000 [0103.751] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.752] GetProcessHeap () returned 0xd20000 [0103.752] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.752] GetProcessHeap () returned 0xd20000 [0103.752] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.752] GetProcessHeap () returned 0xd20000 [0103.752] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.752] GetProcessHeap () returned 0xd20000 [0103.752] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0103.752] GetProcessHeap () returned 0xd20000 [0103.752] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0103.752] GetProcessHeap () returned 0xd20000 [0103.752] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0103.752] GetProcessHeap () returned 0xd20000 [0103.752] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0103.752] GetProcessHeap () returned 0xd20000 [0103.752] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbe8 [0103.752] GetProcessHeap () returned 0xd20000 [0103.752] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbe8 | out: hHeap=0xd20000) returned 1 [0103.752] GetProcessHeap () returned 0xd20000 [0103.752] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.752] GetProcessHeap () returned 0xd20000 [0103.752] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.752] GetProcessHeap () returned 0xd20000 [0103.753] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.753] GetProcessHeap () returned 0xd20000 [0103.753] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.753] GetProcessHeap () returned 0xd20000 [0103.753] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.753] GetProcessHeap () returned 0xd20000 [0103.753] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.753] GetProcessHeap () returned 0xd20000 [0103.753] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd18 [0103.753] GetProcessHeap () returned 0xd20000 [0103.753] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd18 | out: hHeap=0xd20000) returned 1 [0103.753] GetProcessHeap () returned 0xd20000 [0103.753] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0103.753] GetProcessHeap () returned 0xd20000 [0103.753] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0103.753] GetProcessHeap () returned 0xd20000 [0103.753] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.753] GetProcessHeap () returned 0xd20000 [0103.753] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.753] GetProcessHeap () returned 0xd20000 [0103.753] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0103.753] GetProcessHeap () returned 0xd20000 [0103.753] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0103.753] GetProcessHeap () returned 0xd20000 [0103.754] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.754] GetProcessHeap () returned 0xd20000 [0103.754] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.754] GetProcessHeap () returned 0xd20000 [0103.754] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc28 [0103.754] GetProcessHeap () returned 0xd20000 [0103.754] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc28 | out: hHeap=0xd20000) returned 1 [0103.754] GetProcessHeap () returned 0xd20000 [0103.754] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.754] GetProcessHeap () returned 0xd20000 [0103.754] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.754] GetProcessHeap () returned 0xd20000 [0103.754] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0103.754] GetProcessHeap () returned 0xd20000 [0103.754] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0103.754] GetProcessHeap () returned 0xd20000 [0103.754] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.754] GetProcessHeap () returned 0xd20000 [0103.754] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.754] GetProcessHeap () returned 0xd20000 [0103.754] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd38 [0103.755] GetProcessHeap () returned 0xd20000 [0103.755] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd38 | out: hHeap=0xd20000) returned 1 [0103.755] GetProcessHeap () returned 0xd20000 [0103.755] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0103.755] GetProcessHeap () returned 0xd20000 [0103.755] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0103.755] GetProcessHeap () returned 0xd20000 [0103.755] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.755] GetProcessHeap () returned 0xd20000 [0103.755] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.755] GetProcessHeap () returned 0xd20000 [0103.755] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0103.755] GetProcessHeap () returned 0xd20000 [0103.755] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0103.755] GetProcessHeap () returned 0xd20000 [0103.755] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0103.755] GetProcessHeap () returned 0xd20000 [0103.755] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0103.755] GetProcessHeap () returned 0xd20000 [0103.755] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0103.755] GetProcessHeap () returned 0xd20000 [0103.755] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0103.756] GetProcessHeap () returned 0xd20000 [0103.756] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.756] GetProcessHeap () returned 0xd20000 [0103.756] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.756] GetProcessHeap () returned 0xd20000 [0103.756] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.756] GetProcessHeap () returned 0xd20000 [0103.756] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.756] GetProcessHeap () returned 0xd20000 [0103.756] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.756] GetProcessHeap () returned 0xd20000 [0103.756] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.756] GetProcessHeap () returned 0xd20000 [0103.756] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0103.756] GetProcessHeap () returned 0xd20000 [0103.756] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0103.756] GetProcessHeap () returned 0xd20000 [0103.756] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0103.756] GetProcessHeap () returned 0xd20000 [0103.756] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0103.756] GetProcessHeap () returned 0xd20000 [0103.756] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.756] GetProcessHeap () returned 0xd20000 [0103.756] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.757] GetProcessHeap () returned 0xd20000 [0103.757] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0103.757] GetProcessHeap () returned 0xd20000 [0103.757] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0103.757] GetProcessHeap () returned 0xd20000 [0103.757] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.757] GetProcessHeap () returned 0xd20000 [0103.757] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.757] GetProcessHeap () returned 0xd20000 [0103.757] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.757] GetProcessHeap () returned 0xd20000 [0103.757] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.757] GetProcessHeap () returned 0xd20000 [0103.757] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0103.757] GetProcessHeap () returned 0xd20000 [0103.757] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0103.757] GetProcessHeap () returned 0xd20000 [0103.757] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.757] GetProcessHeap () returned 0xd20000 [0103.757] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.757] GetProcessHeap () returned 0xd20000 [0103.757] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0103.757] GetProcessHeap () returned 0xd20000 [0103.757] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0103.758] GetProcessHeap () returned 0xd20000 [0103.758] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0103.758] GetProcessHeap () returned 0xd20000 [0103.758] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0103.758] GetProcessHeap () returned 0xd20000 [0103.758] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0103.758] GetProcessHeap () returned 0xd20000 [0103.758] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0103.758] GetProcessHeap () returned 0xd20000 [0103.758] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.758] GetProcessHeap () returned 0xd20000 [0103.758] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.758] GetProcessHeap () returned 0xd20000 [0103.758] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0103.758] GetProcessHeap () returned 0xd20000 [0103.758] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0103.758] GetProcessHeap () returned 0xd20000 [0103.758] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.758] GetProcessHeap () returned 0xd20000 [0103.758] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.758] GetProcessHeap () returned 0xd20000 [0103.758] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.759] GetProcessHeap () returned 0xd20000 [0103.759] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.759] GetProcessHeap () returned 0xd20000 [0103.759] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.759] GetProcessHeap () returned 0xd20000 [0103.759] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.759] GetProcessHeap () returned 0xd20000 [0103.759] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0103.759] GetProcessHeap () returned 0xd20000 [0103.759] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0103.759] GetProcessHeap () returned 0xd20000 [0103.759] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0103.759] GetProcessHeap () returned 0xd20000 [0103.759] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0103.759] GetProcessHeap () returned 0xd20000 [0103.759] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.759] GetProcessHeap () returned 0xd20000 [0103.759] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.759] GetProcessHeap () returned 0xd20000 [0103.759] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.759] GetProcessHeap () returned 0xd20000 [0103.759] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.760] GetProcessHeap () returned 0xd20000 [0103.760] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0103.760] GetProcessHeap () returned 0xd20000 [0103.760] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0103.760] GetProcessHeap () returned 0xd20000 [0103.760] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.761] GetProcessHeap () returned 0xd20000 [0103.761] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.761] GetProcessHeap () returned 0xd20000 [0103.761] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc98 [0103.761] GetProcessHeap () returned 0xd20000 [0103.761] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc98 | out: hHeap=0xd20000) returned 1 [0103.761] GetProcessHeap () returned 0xd20000 [0103.761] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.761] GetProcessHeap () returned 0xd20000 [0103.761] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.761] GetProcessHeap () returned 0xd20000 [0103.761] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0103.761] GetProcessHeap () returned 0xd20000 [0103.761] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0103.761] GetProcessHeap () returned 0xd20000 [0103.761] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.761] GetProcessHeap () returned 0xd20000 [0103.761] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.761] GetProcessHeap () returned 0xd20000 [0103.761] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0103.761] GetProcessHeap () returned 0xd20000 [0103.761] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0103.761] GetProcessHeap () returned 0xd20000 [0103.761] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbd8 [0103.761] GetProcessHeap () returned 0xd20000 [0103.762] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbd8 | out: hHeap=0xd20000) returned 1 [0103.762] GetProcessHeap () returned 0xd20000 [0103.762] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0103.762] GetProcessHeap () returned 0xd20000 [0103.762] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0103.762] GetProcessHeap () returned 0xd20000 [0103.762] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0103.762] GetProcessHeap () returned 0xd20000 [0103.762] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0103.762] GetProcessHeap () returned 0xd20000 [0103.762] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.762] GetProcessHeap () returned 0xd20000 [0103.762] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.762] GetProcessHeap () returned 0xd20000 [0103.762] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0103.762] GetProcessHeap () returned 0xd20000 [0103.762] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0103.762] GetProcessHeap () returned 0xd20000 [0103.762] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.762] GetProcessHeap () returned 0xd20000 [0103.762] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.762] GetProcessHeap () returned 0xd20000 [0103.762] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ccf8 [0103.762] GetProcessHeap () returned 0xd20000 [0103.763] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ccf8 | out: hHeap=0xd20000) returned 1 [0103.763] GetProcessHeap () returned 0xd20000 [0103.763] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd58 [0103.763] GetProcessHeap () returned 0xd20000 [0103.763] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd58 | out: hHeap=0xd20000) returned 1 [0103.763] GetProcessHeap () returned 0xd20000 [0103.763] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0103.763] GetProcessHeap () returned 0xd20000 [0103.763] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0103.763] GetProcessHeap () returned 0xd20000 [0103.763] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.763] GetProcessHeap () returned 0xd20000 [0103.763] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.763] GetProcessHeap () returned 0xd20000 [0103.763] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0103.763] GetProcessHeap () returned 0xd20000 [0103.763] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0103.763] GetProcessHeap () returned 0xd20000 [0103.763] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0103.763] GetProcessHeap () returned 0xd20000 [0103.763] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0103.763] GetProcessHeap () returned 0xd20000 [0103.763] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc88 [0103.763] GetProcessHeap () returned 0xd20000 [0103.764] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc88 | out: hHeap=0xd20000) returned 1 [0103.764] GetProcessHeap () returned 0xd20000 [0103.764] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd28 [0103.764] GetProcessHeap () returned 0xd20000 [0103.764] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0103.764] GetProcessHeap () returned 0xd20000 [0103.764] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.764] GetProcessHeap () returned 0xd20000 [0103.764] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.764] GetProcessHeap () returned 0xd20000 [0103.764] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0103.764] GetProcessHeap () returned 0xd20000 [0103.764] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0103.764] GetProcessHeap () returned 0xd20000 [0103.764] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cbc8 [0103.764] GetProcessHeap () returned 0xd20000 [0103.764] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cbc8 | out: hHeap=0xd20000) returned 1 [0103.764] GetProcessHeap () returned 0xd20000 [0103.764] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0103.764] GetProcessHeap () returned 0xd20000 [0103.764] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0103.764] GetProcessHeap () returned 0xd20000 [0103.764] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0103.764] GetProcessHeap () returned 0xd20000 [0103.764] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0103.765] GetProcessHeap () returned 0xd20000 [0103.765] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44498 | out: hHeap=0xd20000) returned 1 [0103.765] GetProcessHeap () returned 0xd20000 [0103.765] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aaf8 | out: hHeap=0xd20000) returned 1 [0103.765] GetProcessHeap () returned 0xd20000 [0103.765] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0103.765] GetProcessHeap () returned 0xd20000 [0103.765] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0103.765] GetProcessHeap () returned 0xd20000 [0103.765] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0103.765] GetProcessHeap () returned 0xd20000 [0103.765] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0103.765] GetProcessHeap () returned 0xd20000 [0103.765] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0103.765] WriteFile (in: hFile=0x230, lpBuffer=0xd4e3d0*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e3d0*, lpNumberOfBytesWritten=0x299d864*=0x389, lpOverlapped=0x0) returned 1 [0103.769] GetProcessHeap () returned 0xd20000 [0103.769] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4e3d0, Size=0x30) returned 0xd4e3d0 [0103.769] GetProcessHeap () returned 0xd20000 [0103.769] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0103.769] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0103.769] GetProcessHeap () returned 0xd20000 [0103.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x3f0) returned 0xd4e408 [0103.769] ReadFile (in: hFile=0x230, lpBuffer=0xd4e408, nNumberOfBytesToRead=0x3f0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4e408*, lpNumberOfBytesRead=0x299d7e8*=0x3f0, lpOverlapped=0x0) returned 1 [0103.769] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0103.769] WriteFile (in: hFile=0x230, lpBuffer=0xd4e408*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4e408*, lpNumberOfBytesWritten=0x299d7e4*=0x3f0, lpOverlapped=0x0) returned 1 [0103.771] GetProcessHeap () returned 0xd20000 [0103.771] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4e408 | out: hHeap=0xd20000) returned 1 [0103.771] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0103.771] WriteFile (in: hFile=0x230, lpBuffer=0xd4e3d0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e3d0*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0103.772] CloseHandle (hObject=0x230) returned 1 [0103.774] GetProcessHeap () returned 0xd20000 [0103.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42418 | out: hHeap=0xd20000) returned 1 [0103.774] GetProcessHeap () returned 0xd20000 [0103.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bcb0 | out: hHeap=0xd20000) returned 1 [0103.774] GetProcessHeap () returned 0xd20000 [0103.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0103.774] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" | out: lpString1="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk") returned="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" [0103.774] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk.[ponce.lorena@aol.com]") returned="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk.[ponce.lorena@aol.com]" [0103.774] MoveFileExW (lpExistingFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk.[ponce.lorena@aol.com]" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0103.776] PathRemoveFileSpecW (in: pszPath="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" | out: pszPath="C:\\Users\\Public\\Desktop") returned 1 [0103.776] PathAddBackslashW (in: pszPath="C:\\Users\\Public\\Desktop" | out: pszPath="C:\\Users\\Public\\Desktop\\") returned="" [0103.776] lstrcatW (in: lpString1="C:\\Users\\Public\\Desktop\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\Public\\Desktop\\HOW_RECOVER.html") returned="C:\\Users\\Public\\Desktop\\HOW_RECOVER.html" [0103.776] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Desktop\\HOW_RECOVER.html" (normalized: "c:\\users\\public\\desktop\\how_recover.html")) returned 0x20 [0103.776] GetProcessHeap () returned 0xd20000 [0103.776] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36568 | out: hHeap=0xd20000) returned 1 [0103.776] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef84fc3f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef84fc3f, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 0 [0103.776] FindClose (in: hFindFile=0xd36948 | out: hFindFile=0xd36948) returned 1 [0103.777] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Users\\Public\\AccountPictures\\" | out: lpString1="C:\\Users\\Public\\AccountPictures\\") returned="C:\\Users\\Public\\AccountPictures\\" [0103.777] GetProcessHeap () returned 0xd20000 [0103.777] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44058 | out: hHeap=0xd20000) returned 1 [0103.777] GetProcessHeap () returned 0xd20000 [0103.777] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0103.777] lstrlenW (lpString="C:\\Users\\Public\\AccountPictures\\") returned 32 [0103.777] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures\\", lpString2="*" | out: lpString1="C:\\Users\\Public\\AccountPictures\\*") returned="C:\\Users\\Public\\AccountPictures\\*" [0103.777] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\AccountPictures\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd36948 [0103.777] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0103.777] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.778] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0103.778] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0103.778] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xce317778, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0103.778] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0103.778] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0103.778] lstrcatW (in: lpString1="C:\\Users\\Public\\AccountPictures\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\Public\\AccountPictures\\desktop.ini") returned="C:\\Users\\Public\\AccountPictures\\desktop.ini" [0103.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0103.778] GetProcessHeap () returned 0xd20000 [0103.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd445e8 [0103.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0xd445e8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0103.778] lstrlenA (lpString="desktop.ini") returned 11 [0103.778] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0103.778] lstrlenA (lpString="desktop.ini") returned 11 [0103.778] lstrlenA (lpString=".dll") returned 4 [0103.778] lstrlenA (lpString=".dll") returned 4 [0103.778] lstrlenA (lpString="desktop.ini") returned 11 [0103.778] lstrcmpiA (lpString1=".ini", lpString2=".dll") returned 1 [0103.778] lstrlenA (lpString="desktop.ini") returned 11 [0103.778] lstrlenA (lpString=".ini") returned 4 [0103.778] lstrlenA (lpString=".ini") returned 4 [0103.778] lstrlenA (lpString="desktop.ini") returned 11 [0103.779] lstrcmpiA (lpString1=".ini", lpString2=".ini") returned 0 [0103.779] GetProcessHeap () returned 0xd20000 [0103.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445e8 | out: hHeap=0xd20000) returned 1 [0103.779] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xce317778, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0103.779] FindClose (in: hFindFile=0xd36948 | out: hFindFile=0xd36948) returned 1 [0103.779] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Users\\FD1HVy\\" | out: lpString1="C:\\Users\\FD1HVy\\") returned="C:\\Users\\FD1HVy\\" [0103.779] GetProcessHeap () returned 0xd20000 [0103.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd34fa8 | out: hHeap=0xd20000) returned 1 [0103.779] GetProcessHeap () returned 0xd20000 [0103.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc08 | out: hHeap=0xd20000) returned 1 [0103.779] lstrlenW (lpString="C:\\Users\\FD1HVy\\") returned 16 [0103.779] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\*") returned="C:\\Users\\FD1HVy\\*" [0103.779] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd36948 [0103.780] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0103.780] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.780] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0103.780] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0103.780] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x3b5a0677, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3b5a0677, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0103.780] lstrcmpiW (lpString1="AppData", lpString2=".") returned 1 [0103.780] lstrcmpiW (lpString1="AppData", lpString2="..") returned 1 [0103.780] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="AppData" | out: lpString1="C:\\Users\\FD1HVy\\AppData") returned="C:\\Users\\FD1HVy\\AppData" [0103.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AppData", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0103.780] GetProcessHeap () returned 0xd20000 [0103.780] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cd88 [0103.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="AppData", cchWideChar=-1, lpMultiByteStr=0xd3cd88, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AppData", lpUsedDefaultChar=0x0) returned 8 [0103.780] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0103.780] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0103.780] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0103.780] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0103.780] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0103.780] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0103.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0103.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0103.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0103.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0103.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0103.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0103.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0103.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0103.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0103.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0103.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0103.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0103.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0103.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0103.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0103.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0103.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0103.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0103.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0103.781] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0103.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0103.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0103.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0103.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0103.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0103.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0103.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0103.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0103.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0103.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0103.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0103.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0103.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0103.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0103.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0103.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0103.782] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="AppData", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0103.782] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\AppData", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\") returned="C:\\Users\\FD1HVy\\AppData\\" [0103.782] GetProcessHeap () returned 0xd20000 [0103.783] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cd18 [0103.783] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\") returned 24 [0103.783] GetProcessHeap () returned 0xd20000 [0103.783] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x32) returned 0xd36a88 [0103.783] lstrcpyW (in: lpString1=0xd36a88, lpString2="C:\\Users\\FD1HVy\\AppData\\" | out: lpString1="C:\\Users\\FD1HVy\\AppData\\") returned="C:\\Users\\FD1HVy\\AppData\\" [0103.783] GetProcessHeap () returned 0xd20000 [0103.783] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0103.783] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0103.783] lstrcmpiW (lpString1="Application Data", lpString2=".") returned 1 [0103.783] lstrcmpiW (lpString1="Application Data", lpString2="..") returned 1 [0103.783] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Application Data" | out: lpString1="C:\\Users\\FD1HVy\\Application Data") returned="C:\\Users\\FD1HVy\\Application Data" [0103.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Application Data", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0103.783] GetProcessHeap () returned 0xd20000 [0103.783] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x11) returned 0xd36648 [0103.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Application Data", cchWideChar=-1, lpMultiByteStr=0xd36648, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Application Data", lpUsedDefaultChar=0x0) returned 17 [0103.783] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0103.783] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0103.783] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0103.784] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0103.784] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0103.784] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0103.784] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0103.784] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0103.784] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0103.784] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0103.784] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0103.784] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0103.784] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0103.784] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0103.784] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0103.784] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0103.784] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0103.784] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0103.784] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0103.784] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0103.784] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0103.784] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0103.784] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0103.784] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 1 [0103.785] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0103.785] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0103.785] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 1 [0103.785] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0103.785] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0103.785] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0103.785] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0103.785] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 1 [0103.785] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0103.785] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0103.785] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0103.785] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0103.785] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0103.785] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0103.785] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0103.785] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0103.785] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0103.785] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0103.785] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Application Data", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0103.786] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Application Data", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Application Data\\") returned="C:\\Users\\FD1HVy\\Application Data\\" [0103.786] GetProcessHeap () returned 0xd20000 [0103.786] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3ccf8 [0103.786] lstrlenW (lpString="C:\\Users\\FD1HVy\\Application Data\\") returned 33 [0103.786] GetProcessHeap () returned 0xd20000 [0103.786] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x44) returned 0xd44328 [0103.786] lstrcpyW (in: lpString1=0xd44328, lpString2="C:\\Users\\FD1HVy\\Application Data\\" | out: lpString1="C:\\Users\\FD1HVy\\Application Data\\") returned="C:\\Users\\FD1HVy\\Application Data\\" [0103.786] GetProcessHeap () returned 0xd20000 [0103.786] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36648 | out: hHeap=0xd20000) returned 1 [0103.786] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0103.786] lstrcmpiW (lpString1="Contacts", lpString2=".") returned 1 [0103.786] lstrcmpiW (lpString1="Contacts", lpString2="..") returned 1 [0103.786] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Contacts" | out: lpString1="C:\\Users\\FD1HVy\\Contacts") returned="C:\\Users\\FD1HVy\\Contacts" [0103.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Contacts", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0103.786] GetProcessHeap () returned 0xd20000 [0103.786] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x9) returned 0xd446c0 [0103.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Contacts", cchWideChar=-1, lpMultiByteStr=0xd446c0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Contacts", lpUsedDefaultChar=0x0) returned 9 [0103.786] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0103.786] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0103.786] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0103.786] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0103.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0103.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0103.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0103.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0103.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0103.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0103.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0103.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0103.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0103.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0103.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0103.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0103.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0103.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0103.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0103.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0103.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0103.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0103.787] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0103.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0103.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0103.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0103.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0103.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0103.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0103.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0103.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0103.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0103.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0103.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0103.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0103.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0103.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0103.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0103.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0103.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0103.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0103.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0103.788] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Contacts", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0103.789] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Contacts", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Contacts\\") returned="C:\\Users\\FD1HVy\\Contacts\\" [0103.789] GetProcessHeap () returned 0xd20000 [0103.789] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cd08 [0103.789] lstrlenW (lpString="C:\\Users\\FD1HVy\\Contacts\\") returned 25 [0103.789] GetProcessHeap () returned 0xd20000 [0103.789] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x34) returned 0xd493a0 [0103.789] lstrcpyW (in: lpString1=0xd493a0, lpString2="C:\\Users\\FD1HVy\\Contacts\\" | out: lpString1="C:\\Users\\FD1HVy\\Contacts\\") returned="C:\\Users\\FD1HVy\\Contacts\\" [0103.789] GetProcessHeap () returned 0xd20000 [0103.789] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446c0 | out: hHeap=0xd20000) returned 1 [0103.789] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0103.789] lstrcmpiW (lpString1="Cookies", lpString2=".") returned 1 [0103.789] lstrcmpiW (lpString1="Cookies", lpString2="..") returned 1 [0103.789] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Cookies" | out: lpString1="C:\\Users\\FD1HVy\\Cookies") returned="C:\\Users\\FD1HVy\\Cookies" [0103.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Cookies", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0103.789] GetProcessHeap () returned 0xd20000 [0103.789] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cc58 [0103.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Cookies", cchWideChar=-1, lpMultiByteStr=0xd3cc58, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Cookies", lpUsedDefaultChar=0x0) returned 8 [0103.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0103.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0103.789] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0103.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0103.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0103.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0103.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0103.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0103.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0103.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0103.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0103.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0103.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0103.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0103.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0103.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0103.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0103.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0103.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0103.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0103.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0103.790] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0103.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0103.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0103.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0103.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0103.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0103.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0103.791] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0103.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0103.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0103.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0103.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0103.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0103.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0103.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0103.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0103.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0103.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0103.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0103.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0103.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0103.792] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Cookies", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0103.792] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Cookies", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Cookies\\") returned="C:\\Users\\FD1HVy\\Cookies\\" [0103.792] GetProcessHeap () returned 0xd20000 [0103.792] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cc88 [0103.792] lstrlenW (lpString="C:\\Users\\FD1HVy\\Cookies\\") returned 24 [0103.792] GetProcessHeap () returned 0xd20000 [0103.792] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x32) returned 0xd492e0 [0103.793] lstrcpyW (in: lpString1=0xd492e0, lpString2="C:\\Users\\FD1HVy\\Cookies\\" | out: lpString1="C:\\Users\\FD1HVy\\Cookies\\") returned="C:\\Users\\FD1HVy\\Cookies\\" [0103.793] GetProcessHeap () returned 0xd20000 [0103.793] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0103.793] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x5ad5dbb2, ftLastAccessTime.dwHighDateTime=0x1d5c395, ftLastWriteTime.dwLowDateTime=0x5ad5dbb2, ftLastWriteTime.dwHighDateTime=0x1d5c395, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0103.793] lstrcmpiW (lpString1="Desktop", lpString2=".") returned 1 [0103.793] lstrcmpiW (lpString1="Desktop", lpString2="..") returned 1 [0103.793] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Desktop" | out: lpString1="C:\\Users\\FD1HVy\\Desktop") returned="C:\\Users\\FD1HVy\\Desktop" [0103.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Desktop", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0103.793] GetProcessHeap () returned 0xd20000 [0103.793] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cd28 [0103.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Desktop", cchWideChar=-1, lpMultiByteStr=0xd3cd28, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Desktop", lpUsedDefaultChar=0x0) returned 8 [0103.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0103.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0103.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0103.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0103.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0103.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0103.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0103.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0103.793] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0103.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0103.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0103.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0103.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0103.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0103.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0103.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0103.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0103.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0103.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0103.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0103.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0103.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0103.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0103.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0103.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0103.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0103.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0103.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0103.794] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0103.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0103.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0103.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0103.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0103.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0103.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0103.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0103.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0103.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0103.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0103.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0103.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0103.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0103.795] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Desktop", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0103.795] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Desktop", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0103.795] GetProcessHeap () returned 0xd20000 [0103.795] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cd38 [0103.795] lstrlenW (lpString="C:\\Users\\FD1HVy\\Desktop\\") returned 24 [0103.795] GetProcessHeap () returned 0xd20000 [0103.796] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x32) returned 0xd48d20 [0103.796] lstrcpyW (in: lpString1=0xd48d20, lpString2="C:\\Users\\FD1HVy\\Desktop\\" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\") returned="C:\\Users\\FD1HVy\\Desktop\\" [0103.796] GetProcessHeap () returned 0xd20000 [0103.796] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd28 | out: hHeap=0xd20000) returned 1 [0103.796] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x529b9136, ftLastAccessTime.dwHighDateTime=0x1d5c395, ftLastWriteTime.dwLowDateTime=0x529b9136, ftLastWriteTime.dwHighDateTime=0x1d5c395, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0103.796] lstrcmpiW (lpString1="Documents", lpString2=".") returned 1 [0103.796] lstrcmpiW (lpString1="Documents", lpString2="..") returned 1 [0103.796] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Documents" | out: lpString1="C:\\Users\\FD1HVy\\Documents") returned="C:\\Users\\FD1HVy\\Documents" [0103.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Documents", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0103.796] GetProcessHeap () returned 0xd20000 [0103.796] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xa) returned 0xd444f8 [0103.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Documents", cchWideChar=-1, lpMultiByteStr=0xd444f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Documents", lpUsedDefaultChar=0x0) returned 10 [0103.796] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0103.796] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0103.796] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0103.796] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0103.796] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0103.796] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0103.796] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0103.796] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0103.796] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0103.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0103.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0103.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0103.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0103.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0103.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0103.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0103.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0103.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0103.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0103.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0103.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0103.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0103.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0103.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0103.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0103.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0103.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0103.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0103.797] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0103.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0103.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0103.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0103.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0103.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0103.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0103.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0103.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0103.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0103.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0103.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0103.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0103.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0103.798] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Documents", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0103.798] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Documents", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0103.798] GetProcessHeap () returned 0xd20000 [0103.798] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cc98 [0103.798] lstrlenW (lpString="C:\\Users\\FD1HVy\\Documents\\") returned 26 [0103.798] GetProcessHeap () returned 0xd20000 [0103.798] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x36) returned 0xd48f20 [0103.799] lstrcpyW (in: lpString1=0xd48f20, lpString2="C:\\Users\\FD1HVy\\Documents\\" | out: lpString1="C:\\Users\\FD1HVy\\Documents\\") returned="C:\\Users\\FD1HVy\\Documents\\" [0103.799] GetProcessHeap () returned 0xd20000 [0103.799] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444f8 | out: hHeap=0xd20000) returned 1 [0103.799] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc19bd8f2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc19bd8f2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0103.799] lstrcmpiW (lpString1="Downloads", lpString2=".") returned 1 [0103.799] lstrcmpiW (lpString1="Downloads", lpString2="..") returned 1 [0103.799] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Downloads" | out: lpString1="C:\\Users\\FD1HVy\\Downloads") returned="C:\\Users\\FD1HVy\\Downloads" [0103.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Downloads", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0103.799] GetProcessHeap () returned 0xd20000 [0103.799] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xa) returned 0xd445d0 [0103.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Downloads", cchWideChar=-1, lpMultiByteStr=0xd445d0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Downloads", lpUsedDefaultChar=0x0) returned 10 [0103.799] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0103.799] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0103.799] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0103.799] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0103.799] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0103.799] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0103.799] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0103.799] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0103.799] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0103.799] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0103.800] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0103.800] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0103.800] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0103.800] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0103.800] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0103.800] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0103.800] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0103.800] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0103.800] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0103.800] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0103.800] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0103.800] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0103.800] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0103.800] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0103.800] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0103.800] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0103.800] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0103.800] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0103.800] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0103.800] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0103.801] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0103.801] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0103.801] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0103.801] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0103.801] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0103.801] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0103.801] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0103.801] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0103.801] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0103.801] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0103.801] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0103.801] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0103.801] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Downloads", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0103.801] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Downloads", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Downloads\\") returned="C:\\Users\\FD1HVy\\Downloads\\" [0103.801] GetProcessHeap () returned 0xd20000 [0103.801] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cc28 [0103.801] lstrlenW (lpString="C:\\Users\\FD1HVy\\Downloads\\") returned 26 [0103.801] GetProcessHeap () returned 0xd20000 [0103.801] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x36) returned 0xd493e0 [0103.802] lstrcpyW (in: lpString1=0xd493e0, lpString2="C:\\Users\\FD1HVy\\Downloads\\" | out: lpString1="C:\\Users\\FD1HVy\\Downloads\\") returned="C:\\Users\\FD1HVy\\Downloads\\" [0103.802] GetProcessHeap () returned 0xd20000 [0103.802] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445d0 | out: hHeap=0xd20000) returned 1 [0103.802] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0103.802] lstrcmpiW (lpString1="Favorites", lpString2=".") returned 1 [0103.802] lstrcmpiW (lpString1="Favorites", lpString2="..") returned 1 [0103.802] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Favorites" | out: lpString1="C:\\Users\\FD1HVy\\Favorites") returned="C:\\Users\\FD1HVy\\Favorites" [0103.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Favorites", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0103.802] GetProcessHeap () returned 0xd20000 [0103.802] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xa) returned 0xd44540 [0103.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Favorites", cchWideChar=-1, lpMultiByteStr=0xd44540, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Favorites", lpUsedDefaultChar=0x0) returned 10 [0103.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0103.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0103.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0103.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0103.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0103.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0103.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0103.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0103.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0103.802] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0103.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0103.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0103.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0103.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0103.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0103.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0103.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0103.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0103.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0103.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0103.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0103.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0103.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0103.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0103.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0103.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0103.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0103.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0103.803] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0103.804] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0103.804] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0103.804] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0103.804] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0103.804] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0103.804] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0103.804] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0103.804] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0103.804] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0103.804] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0103.804] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0103.804] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0103.804] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0103.804] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Favorites", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0103.804] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Favorites", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\") returned="C:\\Users\\FD1HVy\\Favorites\\" [0103.804] GetProcessHeap () returned 0xd20000 [0103.804] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cd58 [0103.804] lstrlenW (lpString="C:\\Users\\FD1HVy\\Favorites\\") returned 26 [0103.804] GetProcessHeap () returned 0xd20000 [0103.804] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x36) returned 0xd48e20 [0103.804] lstrcpyW (in: lpString1=0xd48e20, lpString2="C:\\Users\\FD1HVy\\Favorites\\" | out: lpString1="C:\\Users\\FD1HVy\\Favorites\\") returned="C:\\Users\\FD1HVy\\Favorites\\" [0103.805] GetProcessHeap () returned 0xd20000 [0103.805] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44540 | out: hHeap=0xd20000) returned 1 [0103.805] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0103.805] lstrcmpiW (lpString1="Links", lpString2=".") returned 1 [0103.805] lstrcmpiW (lpString1="Links", lpString2="..") returned 1 [0103.805] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Links" | out: lpString1="C:\\Users\\FD1HVy\\Links") returned="C:\\Users\\FD1HVy\\Links" [0103.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Links", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0103.805] GetProcessHeap () returned 0xd20000 [0103.805] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x6) returned 0xd3cd88 [0103.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Links", cchWideChar=-1, lpMultiByteStr=0xd3cd88, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Links", lpUsedDefaultChar=0x0) returned 6 [0103.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0103.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0103.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0103.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0103.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0103.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0103.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0103.805] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0103.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0103.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0103.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0103.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0103.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0103.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0103.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0103.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0103.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0103.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0103.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0103.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0103.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0103.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0103.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0103.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0103.806] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0103.987] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0103.987] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0103.987] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0103.987] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0103.987] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0103.988] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0103.988] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0103.988] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0103.988] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0103.988] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0103.988] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0103.988] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0103.988] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0103.988] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0103.988] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0103.988] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0103.988] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0103.988] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Links", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0103.988] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Links", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Links\\") returned="C:\\Users\\FD1HVy\\Links\\" [0103.988] GetProcessHeap () returned 0xd20000 [0103.988] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cbd8 [0103.988] lstrlenW (lpString="C:\\Users\\FD1HVy\\Links\\") returned 22 [0103.988] GetProcessHeap () returned 0xd20000 [0103.988] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x2e) returned 0xd401f8 [0103.988] lstrcpyW (in: lpString1=0xd401f8, lpString2="C:\\Users\\FD1HVy\\Links\\" | out: lpString1="C:\\Users\\FD1HVy\\Links\\") returned="C:\\Users\\FD1HVy\\Links\\" [0103.988] GetProcessHeap () returned 0xd20000 [0103.988] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0103.988] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0103.989] lstrcmpiW (lpString1="Local Settings", lpString2=".") returned 1 [0103.989] lstrcmpiW (lpString1="Local Settings", lpString2="..") returned 1 [0103.989] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Local Settings" | out: lpString1="C:\\Users\\FD1HVy\\Local Settings") returned="C:\\Users\\FD1HVy\\Local Settings" [0103.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Local Settings", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0103.989] GetProcessHeap () returned 0xd20000 [0103.989] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd44678 [0103.989] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Local Settings", cchWideChar=-1, lpMultiByteStr=0xd44678, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Local Settings", lpUsedDefaultChar=0x0) returned 15 [0103.989] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0103.989] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0103.989] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0103.989] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0103.989] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0103.989] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0103.989] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0103.989] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0103.989] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0103.989] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0103.989] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0103.989] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0103.989] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0103.989] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0103.989] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0103.989] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0103.990] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0103.990] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0103.990] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0103.990] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0103.990] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0103.990] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0103.990] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0103.990] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0103.990] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0103.990] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0103.990] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0103.990] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0103.990] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0103.990] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0103.990] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0103.990] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0103.990] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0103.990] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0103.990] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0103.990] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0103.990] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0103.991] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0103.991] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0103.991] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0103.991] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0103.991] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0103.991] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Local Settings", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0103.991] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Local Settings", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Local Settings\\") returned="C:\\Users\\FD1HVy\\Local Settings\\" [0103.991] GetProcessHeap () returned 0xd20000 [0103.991] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cd28 [0103.991] lstrlenW (lpString="C:\\Users\\FD1HVy\\Local Settings\\") returned 31 [0103.991] GetProcessHeap () returned 0xd20000 [0103.991] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x40) returned 0xd32770 [0103.991] lstrcpyW (in: lpString1=0xd32770, lpString2="C:\\Users\\FD1HVy\\Local Settings\\" | out: lpString1="C:\\Users\\FD1HVy\\Local Settings\\") returned="C:\\Users\\FD1HVy\\Local Settings\\" [0103.991] GetProcessHeap () returned 0xd20000 [0103.991] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44678 | out: hHeap=0xd20000) returned 1 [0103.991] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x52a77c31, ftLastAccessTime.dwHighDateTime=0x1d5c395, ftLastWriteTime.dwLowDateTime=0x52a77c31, ftLastWriteTime.dwHighDateTime=0x1d5c395, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0103.991] lstrcmpiW (lpString1="Music", lpString2=".") returned 1 [0103.991] lstrcmpiW (lpString1="Music", lpString2="..") returned 1 [0103.991] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Music" | out: lpString1="C:\\Users\\FD1HVy\\Music") returned="C:\\Users\\FD1HVy\\Music" [0103.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Music", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0103.991] GetProcessHeap () returned 0xd20000 [0103.992] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x6) returned 0xd3cd88 [0103.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Music", cchWideChar=-1, lpMultiByteStr=0xd3cd88, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Music", lpUsedDefaultChar=0x0) returned 6 [0103.992] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0103.992] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0103.992] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0103.992] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0103.992] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0103.992] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0103.992] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0103.992] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0103.992] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0103.992] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0103.992] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0103.992] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0103.992] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0103.992] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0103.992] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0103.992] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0103.992] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0103.992] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0103.992] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0103.992] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0103.993] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0103.993] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0103.993] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0103.993] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0103.993] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0103.993] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0103.993] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0103.993] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0103.993] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0103.993] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0103.993] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0103.993] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0103.993] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0103.993] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0103.993] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0103.993] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0103.993] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0103.993] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0103.993] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0103.993] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0103.993] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0103.994] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0103.994] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Music", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0103.994] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Music", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0103.994] GetProcessHeap () returned 0xd20000 [0103.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cbc8 [0103.994] lstrlenW (lpString="C:\\Users\\FD1HVy\\Music\\") returned 22 [0103.994] GetProcessHeap () returned 0xd20000 [0103.994] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x2e) returned 0xd3fcf0 [0103.994] lstrcpyW (in: lpString1=0xd3fcf0, lpString2="C:\\Users\\FD1HVy\\Music\\" | out: lpString1="C:\\Users\\FD1HVy\\Music\\") returned="C:\\Users\\FD1HVy\\Music\\" [0103.994] GetProcessHeap () returned 0xd20000 [0103.995] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd88 | out: hHeap=0xd20000) returned 1 [0103.995] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0103.995] lstrcmpiW (lpString1="My Documents", lpString2=".") returned 1 [0103.995] lstrcmpiW (lpString1="My Documents", lpString2="..") returned 1 [0103.995] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="My Documents" | out: lpString1="C:\\Users\\FD1HVy\\My Documents") returned="C:\\Users\\FD1HVy\\My Documents" [0103.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Documents", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0103.995] GetProcessHeap () returned 0xd20000 [0103.995] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xd) returned 0xd44408 [0103.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="My Documents", cchWideChar=-1, lpMultiByteStr=0xd44408, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="My Documents", lpUsedDefaultChar=0x0) returned 13 [0103.995] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0103.995] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0103.995] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0103.995] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0103.995] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0103.995] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0103.995] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0103.995] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0103.995] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0103.995] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0103.995] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0103.995] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0103.996] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0103.996] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0103.996] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0103.996] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0103.996] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0103.996] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0103.996] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0103.996] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0103.996] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0103.996] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0103.996] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0103.996] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0103.996] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0103.996] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0103.996] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0103.996] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0103.996] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0103.996] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0103.996] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0103.996] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0103.997] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0103.997] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0103.997] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0103.997] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0103.997] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0103.997] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0103.997] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0103.997] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0103.997] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0103.997] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0103.997] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="My Documents", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0103.997] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\My Documents", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\My Documents\\") returned="C:\\Users\\FD1HVy\\My Documents\\" [0103.997] GetProcessHeap () returned 0xd20000 [0103.997] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cd88 [0103.997] lstrlenW (lpString="C:\\Users\\FD1HVy\\My Documents\\") returned 29 [0103.997] GetProcessHeap () returned 0xd20000 [0103.997] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x3c) returned 0xd32338 [0103.997] lstrcpyW (in: lpString1=0xd32338, lpString2="C:\\Users\\FD1HVy\\My Documents\\" | out: lpString1="C:\\Users\\FD1HVy\\My Documents\\") returned="C:\\Users\\FD1HVy\\My Documents\\" [0103.997] GetProcessHeap () returned 0xd20000 [0103.997] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44408 | out: hHeap=0xd20000) returned 1 [0103.997] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0103.998] lstrcmpiW (lpString1="NetHood", lpString2=".") returned 1 [0103.998] lstrcmpiW (lpString1="NetHood", lpString2="..") returned 1 [0103.998] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="NetHood" | out: lpString1="C:\\Users\\FD1HVy\\NetHood") returned="C:\\Users\\FD1HVy\\NetHood" [0103.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetHood", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0103.998] GetProcessHeap () returned 0xd20000 [0103.998] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cc48 [0103.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NetHood", cchWideChar=-1, lpMultiByteStr=0xd3cc48, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NetHood", lpUsedDefaultChar=0x0) returned 8 [0103.998] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0103.998] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0103.998] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0103.998] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0103.998] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0103.998] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0103.998] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0103.998] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0103.998] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0103.998] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0103.998] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0103.998] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0103.998] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0103.999] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0103.999] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0103.999] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0103.999] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0103.999] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0103.999] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0103.999] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0103.999] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0103.999] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0103.999] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0103.999] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0103.999] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0103.999] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0103.999] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0103.999] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0103.999] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0103.999] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0103.999] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0103.999] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0104.000] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0104.000] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0104.000] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0104.000] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0104.000] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0104.000] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0104.000] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0104.000] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0104.000] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0104.000] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0104.000] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="NetHood", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0104.000] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\NetHood", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\NetHood\\") returned="C:\\Users\\FD1HVy\\NetHood\\" [0104.000] GetProcessHeap () returned 0xd20000 [0104.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cbe8 [0104.000] lstrlenW (lpString="C:\\Users\\FD1HVy\\NetHood\\") returned 24 [0104.000] GetProcessHeap () returned 0xd20000 [0104.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x32) returned 0xd49420 [0104.000] lstrcpyW (in: lpString1=0xd49420, lpString2="C:\\Users\\FD1HVy\\NetHood\\" | out: lpString1="C:\\Users\\FD1HVy\\NetHood\\") returned="C:\\Users\\FD1HVy\\NetHood\\" [0104.000] GetProcessHeap () returned 0xd20000 [0104.000] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0104.001] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa9c141bf, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xa9c141bf, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x2c0000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0104.001] lstrcmpiW (lpString1="NTUSER.DAT", lpString2=".") returned 1 [0104.001] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="..") returned 1 [0104.001] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="NTUSER.DAT" | out: lpString1="C:\\Users\\FD1HVy\\NTUSER.DAT") returned="C:\\Users\\FD1HVy\\NTUSER.DAT" [0104.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NTUSER.DAT", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0104.001] GetProcessHeap () returned 0xd20000 [0104.001] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xb) returned 0xd444e0 [0104.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NTUSER.DAT", cchWideChar=-1, lpMultiByteStr=0xd444e0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NTUSER.DAT", lpUsedDefaultChar=0x0) returned 11 [0104.001] lstrlenA (lpString="NTUSER.DAT") returned 10 [0104.001] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0104.001] lstrlenA (lpString="NTUSER.DAT") returned 10 [0104.001] lstrlenA (lpString=".dll") returned 4 [0104.001] lstrlenA (lpString=".dll") returned 4 [0104.001] lstrlenA (lpString="NTUSER.DAT") returned 10 [0104.001] lstrcmpiA (lpString1=".DAT", lpString2=".dll") returned -1 [0104.001] lstrlenA (lpString="NTUSER.DAT") returned 10 [0104.001] lstrlenA (lpString=".ini") returned 4 [0104.001] lstrlenA (lpString=".ini") returned 4 [0104.001] lstrlenA (lpString="NTUSER.DAT") returned 10 [0104.002] lstrcmpiA (lpString1=".DAT", lpString2=".ini") returned -1 [0104.002] lstrlenA (lpString="NTUSER.DAT") returned 10 [0104.002] lstrlenA (lpString=".inc") returned 4 [0104.002] lstrlenA (lpString=".inc") returned 4 [0104.002] lstrlenA (lpString="NTUSER.DAT") returned 10 [0104.002] lstrcmpiA (lpString1=".DAT", lpString2=".inc") returned -1 [0104.002] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="HOW_RECOVER.html") returned 1 [0104.002] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0104.002] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0104.002] lstrcmpiW (lpString1="NTUSER.DAT", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0104.002] GetProcessHeap () returned 0xd20000 [0104.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd428a0 [0104.002] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT" (normalized: "c:\\users\\fd1hvy\\ntuser.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0104.003] CloseHandle (hObject=0xffffffff) returned 1 [0104.003] GetProcessHeap () returned 0xd20000 [0104.003] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd428a0 | out: hHeap=0xd20000) returned 1 [0104.003] GetProcessHeap () returned 0xd20000 [0104.003] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444e0 | out: hHeap=0xd20000) returned 1 [0104.003] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0104.003] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2=".") returned 1 [0104.003] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="..") returned 1 [0104.003] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="ntuser.dat.LOG1" | out: lpString1="C:\\Users\\FD1HVy\\ntuser.dat.LOG1") returned="C:\\Users\\FD1HVy\\ntuser.dat.LOG1" [0104.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntuser.dat.LOG1", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0104.003] GetProcessHeap () returned 0xd20000 [0104.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd44510 [0104.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntuser.dat.LOG1", cchWideChar=-1, lpMultiByteStr=0xd44510, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ntuser.dat.LOG1", lpUsedDefaultChar=0x0) returned 16 [0104.003] lstrlenA (lpString="ntuser.dat.LOG1") returned 15 [0104.003] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0104.003] lstrlenA (lpString="ntuser.dat.LOG1") returned 15 [0104.004] lstrlenA (lpString=".dll") returned 4 [0104.004] lstrlenA (lpString=".dll") returned 4 [0104.004] lstrlenA (lpString="ntuser.dat.LOG1") returned 15 [0104.004] lstrcmpiA (lpString1="LOG1", lpString2=".dll") returned 1 [0104.004] lstrlenA (lpString="ntuser.dat.LOG1") returned 15 [0104.004] lstrlenA (lpString=".ini") returned 4 [0104.004] lstrlenA (lpString=".ini") returned 4 [0104.004] lstrlenA (lpString="ntuser.dat.LOG1") returned 15 [0104.004] lstrcmpiA (lpString1="LOG1", lpString2=".ini") returned 1 [0104.004] lstrlenA (lpString="ntuser.dat.LOG1") returned 15 [0104.004] lstrlenA (lpString=".inc") returned 4 [0104.004] lstrlenA (lpString=".inc") returned 4 [0104.004] lstrlenA (lpString="ntuser.dat.LOG1") returned 15 [0104.004] lstrcmpiA (lpString1="LOG1", lpString2=".inc") returned 1 [0104.004] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="HOW_RECOVER.html") returned 1 [0104.004] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0104.004] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0104.004] lstrcmpiW (lpString1="ntuser.dat.LOG1", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0104.004] GetProcessHeap () returned 0xd20000 [0104.004] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd426c0 [0104.005] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG1" (normalized: "c:\\users\\fd1hvy\\ntuser.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0104.005] CloseHandle (hObject=0xffffffff) returned 1 [0104.005] GetProcessHeap () returned 0xd20000 [0104.005] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd426c0 | out: hHeap=0xd20000) returned 1 [0104.005] GetProcessHeap () returned 0xd20000 [0104.005] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44510 | out: hHeap=0xd20000) returned 1 [0104.005] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0104.005] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2=".") returned 1 [0104.005] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="..") returned 1 [0104.005] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="ntuser.dat.LOG2" | out: lpString1="C:\\Users\\FD1HVy\\ntuser.dat.LOG2") returned="C:\\Users\\FD1HVy\\ntuser.dat.LOG2" [0104.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntuser.dat.LOG2", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0104.005] GetProcessHeap () returned 0xd20000 [0104.005] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd44588 [0104.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntuser.dat.LOG2", cchWideChar=-1, lpMultiByteStr=0xd44588, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ntuser.dat.LOG2", lpUsedDefaultChar=0x0) returned 16 [0104.005] lstrlenA (lpString="ntuser.dat.LOG2") returned 15 [0104.006] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0104.006] lstrlenA (lpString="ntuser.dat.LOG2") returned 15 [0104.006] lstrlenA (lpString=".dll") returned 4 [0104.006] lstrlenA (lpString=".dll") returned 4 [0104.006] lstrlenA (lpString="ntuser.dat.LOG2") returned 15 [0104.006] lstrcmpiA (lpString1="LOG2", lpString2=".dll") returned 1 [0104.006] lstrlenA (lpString="ntuser.dat.LOG2") returned 15 [0104.006] lstrlenA (lpString=".ini") returned 4 [0104.006] lstrlenA (lpString=".ini") returned 4 [0104.006] lstrlenA (lpString="ntuser.dat.LOG2") returned 15 [0104.006] lstrcmpiA (lpString1="LOG2", lpString2=".ini") returned 1 [0104.006] lstrlenA (lpString="ntuser.dat.LOG2") returned 15 [0104.006] lstrlenA (lpString=".inc") returned 4 [0104.006] lstrlenA (lpString=".inc") returned 4 [0104.006] lstrlenA (lpString="ntuser.dat.LOG2") returned 15 [0104.006] lstrcmpiA (lpString1="LOG2", lpString2=".inc") returned 1 [0104.006] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="HOW_RECOVER.html") returned 1 [0104.006] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0104.006] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0104.006] lstrcmpiW (lpString1="ntuser.dat.LOG2", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0104.006] GetProcessHeap () returned 0xd20000 [0104.006] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd428c8 [0104.007] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\ntuser.dat.LOG2" (normalized: "c:\\users\\fd1hvy\\ntuser.dat.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0104.007] CloseHandle (hObject=0xffffffff) returned 1 [0104.007] GetProcessHeap () returned 0xd20000 [0104.007] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd428c8 | out: hHeap=0xd20000) returned 1 [0104.007] GetProcessHeap () returned 0xd20000 [0104.007] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44588 | out: hHeap=0xd20000) returned 1 [0104.007] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0104.007] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", lpString2=".") returned 1 [0104.007] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", lpString2="..") returned 1 [0104.007] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" | out: lpString1="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" [0104.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 56 [0104.007] GetProcessHeap () returned 0xd20000 [0104.007] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x38) returned 0xd48ca0 [0104.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", cchWideChar=-1, lpMultiByteStr=0xd48ca0, cbMultiByte=56, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", lpUsedDefaultChar=0x0) returned 56 [0104.007] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned 55 [0104.008] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0104.008] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0104.008] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned 55 [0104.008] lstrcmpiA (lpString1="1d-b808901d6c9b}.TM.blf", lpString2=".[ponce.lorena@aol.com]") returned 1 [0104.008] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned 55 [0104.008] lstrlenA (lpString=".dll") returned 4 [0104.008] lstrlenA (lpString=".dll") returned 4 [0104.008] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned 55 [0104.008] lstrcmpiA (lpString1=".blf", lpString2=".dll") returned -1 [0104.008] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned 55 [0104.008] lstrlenA (lpString=".ini") returned 4 [0104.008] lstrlenA (lpString=".ini") returned 4 [0104.008] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned 55 [0104.008] lstrcmpiA (lpString1=".blf", lpString2=".ini") returned -1 [0104.008] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned 55 [0104.008] lstrlenA (lpString=".inc") returned 4 [0104.008] lstrlenA (lpString=".inc") returned 4 [0104.008] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf") returned 55 [0104.008] lstrcmpiA (lpString1=".blf", lpString2=".inc") returned -1 [0104.008] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", lpString2="HOW_RECOVER.html") returned 1 [0104.008] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0104.009] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0104.009] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0104.009] GetProcessHeap () returned 0xd20000 [0104.009] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd426c0 [0104.009] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tm.blf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0104.009] CloseHandle (hObject=0xffffffff) returned 1 [0104.009] GetProcessHeap () returned 0xd20000 [0104.009] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd426c0 | out: hHeap=0xd20000) returned 1 [0104.009] GetProcessHeap () returned 0xd20000 [0104.009] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd48ca0 | out: hHeap=0xd20000) returned 1 [0104.009] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0104.009] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", lpString2=".") returned 1 [0104.009] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", lpString2="..") returned 1 [0104.010] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" | out: lpString1="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" [0104.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 93 [0104.010] GetProcessHeap () returned 0xd20000 [0104.010] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x5d) returned 0xd2e898 [0104.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", cchWideChar=-1, lpMultiByteStr=0xd2e898, cbMultiByte=93, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", lpUsedDefaultChar=0x0) returned 93 [0104.010] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned 92 [0104.010] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0104.010] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0104.010] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned 92 [0104.011] lstrcmpiA (lpString1="00000000001.regtrans-ms", lpString2=".[ponce.lorena@aol.com]") returned 1 [0104.011] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned 92 [0104.011] lstrlenA (lpString=".dll") returned 4 [0104.011] lstrlenA (lpString=".dll") returned 4 [0104.011] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned 92 [0104.011] lstrcmpiA (lpString1="s-ms", lpString2=".dll") returned 1 [0104.011] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned 92 [0104.011] lstrlenA (lpString=".ini") returned 4 [0104.011] lstrlenA (lpString=".ini") returned 4 [0104.011] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned 92 [0104.011] lstrcmpiA (lpString1="s-ms", lpString2=".ini") returned 1 [0104.011] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned 92 [0104.011] lstrlenA (lpString=".inc") returned 4 [0104.011] lstrlenA (lpString=".inc") returned 4 [0104.011] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms") returned 92 [0104.011] lstrcmpiA (lpString1="s-ms", lpString2=".inc") returned 1 [0104.011] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", lpString2="HOW_RECOVER.html") returned 1 [0104.011] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0104.011] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0104.011] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0104.011] GetProcessHeap () returned 0xd20000 [0104.012] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42490 [0104.012] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0104.012] CloseHandle (hObject=0xffffffff) returned 1 [0104.012] GetProcessHeap () returned 0xd20000 [0104.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42490 | out: hHeap=0xd20000) returned 1 [0104.012] GetProcessHeap () returned 0xd20000 [0104.012] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2e898 | out: hHeap=0xd20000) returned 1 [0104.012] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0104.012] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", lpString2=".") returned 1 [0104.012] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", lpString2="..") returned 1 [0104.012] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" | out: lpString1="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" [0104.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 93 [0104.012] GetProcessHeap () returned 0xd20000 [0104.012] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x5d) returned 0xd2e898 [0104.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cchWideChar=-1, lpMultiByteStr=0xd2e898, cbMultiByte=93, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", lpUsedDefaultChar=0x0) returned 93 [0104.013] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned 92 [0104.013] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0104.013] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0104.013] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned 92 [0104.013] lstrcmpiA (lpString1="00000000002.regtrans-ms", lpString2=".[ponce.lorena@aol.com]") returned 1 [0104.013] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned 92 [0104.013] lstrlenA (lpString=".dll") returned 4 [0104.013] lstrlenA (lpString=".dll") returned 4 [0104.013] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned 92 [0104.013] lstrcmpiA (lpString1="s-ms", lpString2=".dll") returned 1 [0104.013] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned 92 [0104.013] lstrlenA (lpString=".ini") returned 4 [0104.013] lstrlenA (lpString=".ini") returned 4 [0104.013] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned 92 [0104.013] lstrcmpiA (lpString1="s-ms", lpString2=".ini") returned 1 [0104.013] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned 92 [0104.013] lstrlenA (lpString=".inc") returned 4 [0104.013] lstrlenA (lpString=".inc") returned 4 [0104.013] lstrlenA (lpString="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms") returned 92 [0104.013] lstrcmpiA (lpString1="s-ms", lpString2=".inc") returned 1 [0104.013] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", lpString2="HOW_RECOVER.html") returned 1 [0104.014] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0104.014] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0104.014] lstrcmpiW (lpString1="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0104.014] GetProcessHeap () returned 0xd20000 [0104.014] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd426c0 [0104.014] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\fd1hvy\\ntuser.dat{fae9930d-933c-11e7-a51d-b808901d6c9b}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0104.014] CloseHandle (hObject=0xffffffff) returned 1 [0104.014] GetProcessHeap () returned 0xd20000 [0104.014] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd426c0 | out: hHeap=0xd20000) returned 1 [0104.014] GetProcessHeap () returned 0xd20000 [0104.014] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2e898 | out: hHeap=0xd20000) returned 1 [0104.014] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xc1adea7d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc1adea7d, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc1adea7d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0104.014] lstrcmpiW (lpString1="ntuser.ini", lpString2=".") returned 1 [0104.014] lstrcmpiW (lpString1="ntuser.ini", lpString2="..") returned 1 [0104.014] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="ntuser.ini" | out: lpString1="C:\\Users\\FD1HVy\\ntuser.ini") returned="C:\\Users\\FD1HVy\\ntuser.ini" [0104.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntuser.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0104.015] GetProcessHeap () returned 0xd20000 [0104.015] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xb) returned 0xd44630 [0104.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntuser.ini", cchWideChar=-1, lpMultiByteStr=0xd44630, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ntuser.ini", lpUsedDefaultChar=0x0) returned 11 [0104.015] lstrlenA (lpString="ntuser.ini") returned 10 [0104.015] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0104.015] lstrlenA (lpString="ntuser.ini") returned 10 [0104.015] lstrlenA (lpString=".dll") returned 4 [0104.015] lstrlenA (lpString=".dll") returned 4 [0104.015] lstrlenA (lpString="ntuser.ini") returned 10 [0104.015] lstrcmpiA (lpString1=".ini", lpString2=".dll") returned 1 [0104.015] lstrlenA (lpString="ntuser.ini") returned 10 [0104.015] lstrlenA (lpString=".ini") returned 4 [0104.015] lstrlenA (lpString=".ini") returned 4 [0104.015] lstrlenA (lpString="ntuser.ini") returned 10 [0104.015] lstrcmpiA (lpString1=".ini", lpString2=".ini") returned 0 [0104.015] GetProcessHeap () returned 0xd20000 [0104.015] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44630 | out: hHeap=0xd20000) returned 1 [0104.015] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OneDrive", cAlternateFileName="")) returned 1 [0104.015] lstrcmpiW (lpString1="OneDrive", lpString2=".") returned 1 [0104.015] lstrcmpiW (lpString1="OneDrive", lpString2="..") returned 1 [0104.015] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="OneDrive" | out: lpString1="C:\\Users\\FD1HVy\\OneDrive") returned="C:\\Users\\FD1HVy\\OneDrive" [0104.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OneDrive", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0104.016] GetProcessHeap () returned 0xd20000 [0104.016] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x9) returned 0xd444f8 [0104.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="OneDrive", cchWideChar=-1, lpMultiByteStr=0xd444f8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OneDrive", lpUsedDefaultChar=0x0) returned 9 [0104.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0104.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0104.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0104.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0104.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0104.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0104.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0104.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0104.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0104.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0104.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0104.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0104.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0104.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0104.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0104.016] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0104.017] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0104.017] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0104.017] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0104.017] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0104.017] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0104.017] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0104.017] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0104.017] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0104.017] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0104.017] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0104.017] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0104.017] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0104.017] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0104.017] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0104.017] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0104.017] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0104.017] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0104.018] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0104.018] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0104.018] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0104.018] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0104.018] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0104.018] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0104.018] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0104.018] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0104.018] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0104.018] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="OneDrive", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0104.018] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\OneDrive", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\OneDrive\\") returned="C:\\Users\\FD1HVy\\OneDrive\\" [0104.018] GetProcessHeap () returned 0xd20000 [0104.018] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cc08 [0104.018] lstrlenW (lpString="C:\\Users\\FD1HVy\\OneDrive\\") returned 25 [0104.018] GetProcessHeap () returned 0xd20000 [0104.018] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x34) returned 0xd49060 [0104.018] lstrcpyW (in: lpString1=0xd49060, lpString2="C:\\Users\\FD1HVy\\OneDrive\\" | out: lpString1="C:\\Users\\FD1HVy\\OneDrive\\") returned="C:\\Users\\FD1HVy\\OneDrive\\" [0104.018] GetProcessHeap () returned 0xd20000 [0104.019] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444f8 | out: hHeap=0xd20000) returned 1 [0104.019] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x52d4c825, ftLastAccessTime.dwHighDateTime=0x1d5c395, ftLastWriteTime.dwLowDateTime=0x52d4c825, ftLastWriteTime.dwHighDateTime=0x1d5c395, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0104.019] lstrcmpiW (lpString1="Pictures", lpString2=".") returned 1 [0104.019] lstrcmpiW (lpString1="Pictures", lpString2="..") returned 1 [0104.019] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Pictures" | out: lpString1="C:\\Users\\FD1HVy\\Pictures") returned="C:\\Users\\FD1HVy\\Pictures" [0104.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Pictures", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0104.019] GetProcessHeap () returned 0xd20000 [0104.019] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x9) returned 0xd444c8 [0104.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Pictures", cchWideChar=-1, lpMultiByteStr=0xd444c8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Pictures", lpUsedDefaultChar=0x0) returned 9 [0104.019] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0104.019] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0104.019] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0104.019] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0104.019] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0104.019] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0104.019] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0104.019] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0104.019] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0104.019] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0104.020] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0104.020] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0104.020] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0104.020] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0104.020] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0104.020] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0104.020] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0104.020] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0104.020] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0104.020] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0104.020] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0104.020] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0104.020] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0104.020] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0104.020] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0104.020] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0104.020] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0104.020] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0104.020] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0104.020] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0104.021] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0104.021] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0104.021] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0104.021] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0104.021] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0104.021] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0104.021] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0104.021] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0104.021] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0104.021] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0104.021] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0104.021] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0104.021] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Pictures", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0104.021] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0104.021] GetProcessHeap () returned 0xd20000 [0104.021] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cc48 [0104.021] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\") returned 25 [0104.021] GetProcessHeap () returned 0xd20000 [0104.021] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x34) returned 0xd49320 [0104.021] lstrcpyW (in: lpString1=0xd49320, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0104.022] GetProcessHeap () returned 0xd20000 [0104.022] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444c8 | out: hHeap=0xd20000) returned 1 [0104.022] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0104.022] lstrcmpiW (lpString1="PrintHood", lpString2=".") returned 1 [0104.022] lstrcmpiW (lpString1="PrintHood", lpString2="..") returned 1 [0104.022] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="PrintHood" | out: lpString1="C:\\Users\\FD1HVy\\PrintHood") returned="C:\\Users\\FD1HVy\\PrintHood" [0104.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PrintHood", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0104.022] GetProcessHeap () returned 0xd20000 [0104.022] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xa) returned 0xd44678 [0104.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PrintHood", cchWideChar=-1, lpMultiByteStr=0xd44678, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PrintHood", lpUsedDefaultChar=0x0) returned 10 [0104.022] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0104.022] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0104.022] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0104.022] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0104.022] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0104.022] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0104.022] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0104.022] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0104.022] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0104.022] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0104.022] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0104.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0104.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0104.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0104.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0104.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0104.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0104.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0104.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0104.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0104.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0104.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0104.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0104.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0104.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0104.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0104.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0104.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0104.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0104.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0104.023] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0104.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0104.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0104.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0104.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0104.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0104.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0104.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0104.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0104.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0104.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0104.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0104.024] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="PrintHood", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0104.024] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\PrintHood", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\PrintHood\\") returned="C:\\Users\\FD1HVy\\PrintHood\\" [0104.024] GetProcessHeap () returned 0xd20000 [0104.024] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cc18 [0104.024] lstrlenW (lpString="C:\\Users\\FD1HVy\\PrintHood\\") returned 26 [0104.024] GetProcessHeap () returned 0xd20000 [0104.024] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x36) returned 0xd490a0 [0104.024] lstrcpyW (in: lpString1=0xd490a0, lpString2="C:\\Users\\FD1HVy\\PrintHood\\" | out: lpString1="C:\\Users\\FD1HVy\\PrintHood\\") returned="C:\\Users\\FD1HVy\\PrintHood\\" [0104.024] GetProcessHeap () returned 0xd20000 [0104.025] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44678 | out: hHeap=0xd20000) returned 1 [0104.025] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0104.025] lstrcmpiW (lpString1="Recent", lpString2=".") returned 1 [0104.025] lstrcmpiW (lpString1="Recent", lpString2="..") returned 1 [0104.025] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Recent" | out: lpString1="C:\\Users\\FD1HVy\\Recent") returned="C:\\Users\\FD1HVy\\Recent" [0104.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Recent", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0104.025] GetProcessHeap () returned 0xd20000 [0104.025] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x7) returned 0xd3cd98 [0104.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Recent", cchWideChar=-1, lpMultiByteStr=0xd3cd98, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Recent", lpUsedDefaultChar=0x0) returned 7 [0104.025] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0104.025] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0104.025] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0104.217] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0104.217] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0104.217] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0104.217] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0104.217] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0104.217] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0104.217] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0104.217] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0104.217] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0104.217] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0104.217] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0104.217] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0104.217] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0104.217] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0104.217] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0104.218] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0104.218] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0104.218] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0104.218] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0104.218] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0104.218] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0104.218] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0104.218] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0104.218] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0104.218] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0104.218] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0104.218] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0104.218] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0104.218] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0104.218] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0104.218] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0104.218] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0104.218] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0104.219] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0104.219] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0104.219] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0104.219] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0104.219] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0104.219] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0104.219] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Recent", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0104.219] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Recent", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Recent\\") returned="C:\\Users\\FD1HVy\\Recent\\" [0104.219] GetProcessHeap () returned 0xd20000 [0104.219] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cc58 [0104.219] lstrlenW (lpString="C:\\Users\\FD1HVy\\Recent\\") returned 23 [0104.219] GetProcessHeap () returned 0xd20000 [0104.219] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x30) returned 0xd3fdd0 [0104.219] lstrcpyW (in: lpString1=0xd3fdd0, lpString2="C:\\Users\\FD1HVy\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\Recent\\") returned="C:\\Users\\FD1HVy\\Recent\\" [0104.219] GetProcessHeap () returned 0xd20000 [0104.219] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0104.219] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0104.220] lstrcmpiW (lpString1="Saved Games", lpString2=".") returned 1 [0104.220] lstrcmpiW (lpString1="Saved Games", lpString2="..") returned 1 [0104.220] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Saved Games" | out: lpString1="C:\\Users\\FD1HVy\\Saved Games") returned="C:\\Users\\FD1HVy\\Saved Games" [0104.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Saved Games", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0104.220] GetProcessHeap () returned 0xd20000 [0104.220] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd44588 [0104.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Saved Games", cchWideChar=-1, lpMultiByteStr=0xd44588, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Saved Games", lpUsedDefaultChar=0x0) returned 12 [0104.220] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0104.220] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0104.220] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0104.220] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0104.220] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0104.220] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0104.220] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0104.220] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0104.220] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0104.220] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0104.220] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0104.221] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0104.221] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0104.221] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0104.221] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0104.221] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0104.221] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0104.221] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0104.221] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0104.221] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0104.221] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0104.221] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0104.221] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0104.221] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0104.221] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0104.221] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0104.221] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0104.221] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0104.222] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0104.222] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0104.222] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0104.222] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0104.222] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0104.222] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0104.222] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0104.222] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0104.222] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0104.222] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0104.222] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0104.222] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0104.222] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0104.222] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0104.222] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Saved Games", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0104.222] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Saved Games", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Saved Games\\") returned="C:\\Users\\FD1HVy\\Saved Games\\" [0104.222] GetProcessHeap () returned 0xd20000 [0104.222] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cd98 [0104.223] lstrlenW (lpString="C:\\Users\\FD1HVy\\Saved Games\\") returned 28 [0104.223] GetProcessHeap () returned 0xd20000 [0104.223] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x3a) returned 0xd32218 [0104.223] lstrcpyW (in: lpString1=0xd32218, lpString2="C:\\Users\\FD1HVy\\Saved Games\\" | out: lpString1="C:\\Users\\FD1HVy\\Saved Games\\") returned="C:\\Users\\FD1HVy\\Saved Games\\" [0104.223] GetProcessHeap () returned 0xd20000 [0104.223] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44588 | out: hHeap=0xd20000) returned 1 [0104.223] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0104.223] lstrcmpiW (lpString1="Searches", lpString2=".") returned 1 [0104.223] lstrcmpiW (lpString1="Searches", lpString2="..") returned 1 [0104.223] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Searches" | out: lpString1="C:\\Users\\FD1HVy\\Searches") returned="C:\\Users\\FD1HVy\\Searches" [0104.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Searches", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0104.223] GetProcessHeap () returned 0xd20000 [0104.223] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x9) returned 0xd44600 [0104.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Searches", cchWideChar=-1, lpMultiByteStr=0xd44600, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Searches", lpUsedDefaultChar=0x0) returned 9 [0104.223] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0104.223] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0104.223] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0104.224] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0104.224] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0104.224] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0104.224] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0104.224] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0104.224] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0104.224] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0104.224] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0104.224] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0104.224] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0104.224] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0104.224] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0104.224] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0104.224] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0104.224] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0104.224] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0104.224] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0104.225] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0104.225] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0104.225] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0104.225] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0104.225] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0104.225] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0104.225] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0104.225] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0104.225] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0104.225] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0104.225] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0104.225] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0104.225] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0104.225] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0104.225] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0104.225] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0104.225] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0104.225] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0104.226] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0104.226] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0104.226] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0104.226] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0104.226] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Searches", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0104.226] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\") returned="C:\\Users\\FD1HVy\\Searches\\" [0104.226] GetProcessHeap () returned 0xd20000 [0104.226] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3ce68 [0104.226] lstrlenW (lpString="C:\\Users\\FD1HVy\\Searches\\") returned 25 [0104.226] GetProcessHeap () returned 0xd20000 [0104.226] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x34) returned 0xd49160 [0104.226] lstrcpyW (in: lpString1=0xd49160, lpString2="C:\\Users\\FD1HVy\\Searches\\" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\") returned="C:\\Users\\FD1HVy\\Searches\\" [0104.226] GetProcessHeap () returned 0xd20000 [0104.226] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44600 | out: hHeap=0xd20000) returned 1 [0104.226] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0104.226] lstrcmpiW (lpString1="SendTo", lpString2=".") returned 1 [0104.226] lstrcmpiW (lpString1="SendTo", lpString2="..") returned 1 [0104.226] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="SendTo" | out: lpString1="C:\\Users\\FD1HVy\\SendTo") returned="C:\\Users\\FD1HVy\\SendTo" [0104.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SendTo", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0104.227] GetProcessHeap () returned 0xd20000 [0104.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x7) returned 0xd3cdf8 [0104.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SendTo", cchWideChar=-1, lpMultiByteStr=0xd3cdf8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SendTo", lpUsedDefaultChar=0x0) returned 7 [0104.227] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0104.227] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0104.227] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0104.227] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0104.227] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0104.227] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0104.227] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0104.227] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0104.227] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0104.227] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0104.227] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0104.227] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0104.227] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0104.228] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0104.228] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0104.228] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0104.228] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0104.228] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0104.228] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0104.228] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0104.228] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0104.228] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0104.228] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0104.228] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0104.228] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0104.228] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0104.229] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0104.229] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0104.229] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0104.229] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0104.229] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0104.229] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0104.229] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0104.229] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0104.229] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0104.229] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0104.229] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0104.229] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0104.229] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0104.229] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0104.229] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0104.230] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0104.230] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="SendTo", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0104.230] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\SendTo", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\SendTo\\") returned="C:\\Users\\FD1HVy\\SendTo\\" [0104.230] GetProcessHeap () returned 0xd20000 [0104.230] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3ce38 [0104.230] lstrlenW (lpString="C:\\Users\\FD1HVy\\SendTo\\") returned 23 [0104.230] GetProcessHeap () returned 0xd20000 [0104.230] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x30) returned 0xd3fd60 [0104.230] lstrcpyW (in: lpString1=0xd3fd60, lpString2="C:\\Users\\FD1HVy\\SendTo\\" | out: lpString1="C:\\Users\\FD1HVy\\SendTo\\") returned="C:\\Users\\FD1HVy\\SendTo\\" [0104.230] GetProcessHeap () returned 0xd20000 [0104.230] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0104.230] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0104.230] lstrcmpiW (lpString1="Start Menu", lpString2=".") returned 1 [0104.230] lstrcmpiW (lpString1="Start Menu", lpString2="..") returned 1 [0104.230] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Start Menu" | out: lpString1="C:\\Users\\FD1HVy\\Start Menu") returned="C:\\Users\\FD1HVy\\Start Menu" [0104.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Start Menu", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0104.230] GetProcessHeap () returned 0xd20000 [0104.230] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xb) returned 0xd44648 [0104.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Start Menu", cchWideChar=-1, lpMultiByteStr=0xd44648, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Start Menu", lpUsedDefaultChar=0x0) returned 11 [0104.231] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0104.231] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0104.231] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0104.231] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0104.231] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0104.231] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0104.231] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0104.231] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0104.231] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0104.231] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0104.231] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0104.231] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0104.231] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0104.231] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0104.231] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0104.231] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0104.231] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0104.232] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0104.232] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0104.232] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0104.232] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0104.232] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0104.232] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0104.232] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0104.232] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0104.232] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0104.232] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0104.232] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0104.232] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0104.232] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0104.232] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0104.232] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0104.232] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0104.232] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0104.232] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0104.233] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0104.233] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0104.233] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0104.233] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0104.233] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0104.233] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0104.233] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0104.233] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Start Menu", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0104.233] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Start Menu", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Start Menu\\") returned="C:\\Users\\FD1HVy\\Start Menu\\" [0104.233] GetProcessHeap () returned 0xd20000 [0104.233] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cf28 [0104.233] lstrlenW (lpString="C:\\Users\\FD1HVy\\Start Menu\\") returned 27 [0104.233] GetProcessHeap () returned 0xd20000 [0104.233] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x38) returned 0xd48ce0 [0104.233] lstrcpyW (in: lpString1=0xd48ce0, lpString2="C:\\Users\\FD1HVy\\Start Menu\\" | out: lpString1="C:\\Users\\FD1HVy\\Start Menu\\") returned="C:\\Users\\FD1HVy\\Start Menu\\" [0104.233] GetProcessHeap () returned 0xd20000 [0104.233] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44648 | out: hHeap=0xd20000) returned 1 [0104.233] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0104.234] lstrcmpiW (lpString1="Templates", lpString2=".") returned 1 [0104.234] lstrcmpiW (lpString1="Templates", lpString2="..") returned 1 [0104.234] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Templates" | out: lpString1="C:\\Users\\FD1HVy\\Templates") returned="C:\\Users\\FD1HVy\\Templates" [0104.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Templates", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0104.234] GetProcessHeap () returned 0xd20000 [0104.234] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xa) returned 0xd44660 [0104.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Templates", cchWideChar=-1, lpMultiByteStr=0xd44660, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Templates", lpUsedDefaultChar=0x0) returned 10 [0104.234] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0104.234] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0104.234] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0104.234] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0104.234] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0104.234] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0104.234] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0104.234] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0104.234] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0104.234] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0104.235] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0104.235] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0104.235] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0104.235] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0104.235] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0104.235] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0104.235] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0104.235] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0104.235] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0104.235] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0104.235] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0104.235] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0104.235] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0104.235] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0104.235] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0104.235] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0104.235] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0104.235] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0104.235] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0104.236] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0104.236] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0104.236] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0104.236] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0104.236] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0104.236] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0104.236] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0104.236] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0104.236] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0104.236] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0104.236] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0104.236] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0104.236] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0104.236] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Templates", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0104.236] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Templates", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Templates\\") returned="C:\\Users\\FD1HVy\\Templates\\" [0104.236] GetProcessHeap () returned 0xd20000 [0104.236] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cf78 [0104.236] lstrlenW (lpString="C:\\Users\\FD1HVy\\Templates\\") returned 26 [0104.237] GetProcessHeap () returned 0xd20000 [0104.237] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x36) returned 0xd48e60 [0104.237] lstrcpyW (in: lpString1=0xd48e60, lpString2="C:\\Users\\FD1HVy\\Templates\\" | out: lpString1="C:\\Users\\FD1HVy\\Templates\\") returned="C:\\Users\\FD1HVy\\Templates\\" [0104.237] GetProcessHeap () returned 0xd20000 [0104.237] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44660 | out: hHeap=0xd20000) returned 1 [0104.237] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x52d00454, ftLastAccessTime.dwHighDateTime=0x1d5c395, ftLastWriteTime.dwLowDateTime=0x52d00454, ftLastWriteTime.dwHighDateTime=0x1d5c395, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0104.237] lstrcmpiW (lpString1="Videos", lpString2=".") returned 1 [0104.237] lstrcmpiW (lpString1="Videos", lpString2="..") returned 1 [0104.237] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\", lpString2="Videos" | out: lpString1="C:\\Users\\FD1HVy\\Videos") returned="C:\\Users\\FD1HVy\\Videos" [0104.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Videos", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0104.237] GetProcessHeap () returned 0xd20000 [0104.237] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x7) returned 0xd3cef8 [0104.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Videos", cchWideChar=-1, lpMultiByteStr=0xd3cef8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Videos", lpUsedDefaultChar=0x0) returned 7 [0104.237] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0104.237] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0104.237] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0104.237] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0104.238] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0104.238] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0104.238] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0104.238] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0104.238] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0104.238] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0104.238] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0104.238] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0104.238] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0104.238] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0104.238] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0104.238] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0104.238] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0104.238] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0104.238] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0104.238] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0104.239] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0104.239] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0104.239] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0104.239] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0104.239] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0104.239] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0104.239] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0104.239] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0104.239] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0104.239] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0104.239] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0104.239] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0104.239] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0104.239] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0104.239] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0104.239] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0104.239] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0104.239] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0104.240] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0104.240] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0104.240] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0104.240] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0104.240] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Videos", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0104.240] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0104.240] GetProcessHeap () returned 0xd20000 [0104.240] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cdf8 [0104.240] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\") returned 23 [0104.240] GetProcessHeap () returned 0xd20000 [0104.240] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x30) returned 0xd40000 [0104.240] lstrcpyW (in: lpString1=0xd40000, lpString2="C:\\Users\\FD1HVy\\Videos\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0104.240] GetProcessHeap () returned 0xd20000 [0104.240] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0104.240] FindNextFileW (in: hFindFile=0xd36948, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x52d00454, ftLastAccessTime.dwHighDateTime=0x1d5c395, ftLastWriteTime.dwLowDateTime=0x52d00454, ftLastWriteTime.dwHighDateTime=0x1d5c395, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0104.240] FindClose (in: hFindFile=0xd36948 | out: hFindFile=0xd36948) returned 1 [0104.241] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Users\\FD1HVy\\Videos\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\") returned="C:\\Users\\FD1HVy\\Videos\\" [0104.241] GetProcessHeap () returned 0xd20000 [0104.241] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd40000 | out: hHeap=0xd20000) returned 1 [0104.241] GetProcessHeap () returned 0xd20000 [0104.241] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0104.241] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\") returned 23 [0104.241] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\*") returned="C:\\Users\\FD1HVy\\Videos\\*" [0104.241] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x52d00454, ftLastAccessTime.dwHighDateTime=0x1d5c395, ftLastWriteTime.dwLowDateTime=0x52d00454, ftLastWriteTime.dwHighDateTime=0x1d5c395, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd491a0 [0104.241] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0104.242] FindNextFileW (in: hFindFile=0xd491a0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x52d00454, ftLastAccessTime.dwHighDateTime=0x1d5c395, ftLastWriteTime.dwLowDateTime=0x52d00454, ftLastWriteTime.dwHighDateTime=0x1d5c395, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.242] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0104.242] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0104.242] FindNextFileW (in: hFindFile=0xd491a0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43d9c9d0, ftCreationTime.dwHighDateTime=0x1d4d29a, ftLastAccessTime.dwLowDateTime=0x7d1c0c80, ftLastAccessTime.dwHighDateTime=0x1d4cc05, ftLastWriteTime.dwLowDateTime=0x7d1c0c80, ftLastWriteTime.dwHighDateTime=0x1d4cc05, nFileSizeHigh=0x0, nFileSizeLow=0x10ea, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0d81OSxvhci1.avi", cAlternateFileName="0D81OS~1.AVI")) returned 1 [0104.242] lstrcmpiW (lpString1="0d81OSxvhci1.avi", lpString2=".") returned 1 [0104.242] lstrcmpiW (lpString1="0d81OSxvhci1.avi", lpString2="..") returned 1 [0104.242] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="0d81OSxvhci1.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\0d81OSxvhci1.avi") returned="C:\\Users\\FD1HVy\\Videos\\0d81OSxvhci1.avi" [0104.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0d81OSxvhci1.avi", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0104.242] GetProcessHeap () returned 0xd20000 [0104.242] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x11) returned 0xd36648 [0104.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0d81OSxvhci1.avi", cchWideChar=-1, lpMultiByteStr=0xd36648, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0d81OSxvhci1.avi", lpUsedDefaultChar=0x0) returned 17 [0104.242] lstrlenA (lpString="0d81OSxvhci1.avi") returned 16 [0104.242] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0104.242] lstrlenA (lpString="0d81OSxvhci1.avi") returned 16 [0104.242] lstrlenA (lpString=".dll") returned 4 [0104.242] lstrlenA (lpString=".dll") returned 4 [0104.242] lstrlenA (lpString="0d81OSxvhci1.avi") returned 16 [0104.243] lstrcmpiA (lpString1=".avi", lpString2=".dll") returned -1 [0104.243] lstrlenA (lpString="0d81OSxvhci1.avi") returned 16 [0104.243] lstrlenA (lpString=".ini") returned 4 [0104.243] lstrlenA (lpString=".ini") returned 4 [0104.243] lstrlenA (lpString="0d81OSxvhci1.avi") returned 16 [0104.243] lstrcmpiA (lpString1=".avi", lpString2=".ini") returned -1 [0104.243] lstrlenA (lpString="0d81OSxvhci1.avi") returned 16 [0104.243] lstrlenA (lpString=".inc") returned 4 [0104.243] lstrlenA (lpString=".inc") returned 4 [0104.243] lstrlenA (lpString="0d81OSxvhci1.avi") returned 16 [0104.243] lstrcmpiA (lpString1=".avi", lpString2=".inc") returned -1 [0104.243] lstrcmpiW (lpString1="0d81OSxvhci1.avi", lpString2="HOW_RECOVER.html") returned -1 [0104.243] lstrcmpiW (lpString1="0d81OSxvhci1.avi", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0104.243] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0104.243] lstrcmpiW (lpString1="0d81OSxvhci1.avi", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0104.243] GetProcessHeap () returned 0xd20000 [0104.243] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42828 [0104.243] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\0d81OSxvhci1.avi" (normalized: "c:\\users\\fd1hvy\\videos\\0d81osxvhci1.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0104.244] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=4330) returned 1 [0104.245] GetProcessHeap () returned 0xd20000 [0104.245] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c0e8 [0104.245] GetProcessHeap () returned 0xd20000 [0104.245] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0104.245] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\0d81OSxvhci1.avi") returned 39 [0104.245] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0104.245] GetProcessHeap () returned 0xd20000 [0104.245] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0104.245] GetProcessHeap () returned 0xd20000 [0104.245] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x386) returned 0xd4e408 [0104.245] lstrlenA (lpString="rsa_encrypt") returned 11 [0104.245] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0104.248] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0104.248] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0104.248] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0104.248] GetProcessHeap () returned 0xd20000 [0104.248] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0104.248] lstrlenA (lpString="010001") returned 6 [0104.248] GetProcessHeap () returned 0xd20000 [0104.248] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cf68 [0104.248] GetProcessHeap () returned 0xd20000 [0104.248] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0104.248] GetProcessHeap () returned 0xd20000 [0104.248] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b758 [0104.248] GetProcessHeap () returned 0xd20000 [0104.248] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0104.249] GetProcessHeap () returned 0xd20000 [0104.249] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ae58 [0104.249] GetProcessHeap () returned 0xd20000 [0104.249] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44808 [0104.249] GetProcessHeap () returned 0xd20000 [0104.249] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ce48 [0104.249] GetProcessHeap () returned 0xd20000 [0104.249] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0104.249] GetProcessHeap () returned 0xd20000 [0104.249] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.249] GetProcessHeap () returned 0xd20000 [0104.249] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0104.249] GetProcessHeap () returned 0xd20000 [0104.249] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0104.249] GetProcessHeap () returned 0xd20000 [0104.249] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd45528 [0104.249] GetProcessHeap () returned 0xd20000 [0104.249] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0104.249] GetProcessHeap () returned 0xd20000 [0104.249] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44498 [0104.249] GetProcessHeap () returned 0xd20000 [0104.250] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b008 [0104.250] GetProcessHeap () returned 0xd20000 [0104.250] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0104.250] GetProcessHeap () returned 0xd20000 [0104.250] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0104.250] GetProcessHeap () returned 0xd20000 [0104.250] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b008 | out: hHeap=0xd20000) returned 1 [0104.250] GetProcessHeap () returned 0xd20000 [0104.250] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.250] GetProcessHeap () returned 0xd20000 [0104.250] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44558 [0104.250] GetProcessHeap () returned 0xd20000 [0104.250] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0104.250] GetProcessHeap () returned 0xd20000 [0104.250] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.250] GetProcessHeap () returned 0xd20000 [0104.250] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0104.250] GetProcessHeap () returned 0xd20000 [0104.250] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0104.250] GetProcessHeap () returned 0xd20000 [0104.251] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0104.251] GetProcessHeap () returned 0xd20000 [0104.251] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0104.251] GetProcessHeap () returned 0xd20000 [0104.251] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b098 [0104.251] GetProcessHeap () returned 0xd20000 [0104.251] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44558 | out: hHeap=0xd20000) returned 1 [0104.251] GetProcessHeap () returned 0xd20000 [0104.251] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0104.251] GetProcessHeap () returned 0xd20000 [0104.251] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b098 | out: hHeap=0xd20000) returned 1 [0104.251] GetProcessHeap () returned 0xd20000 [0104.251] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.251] GetProcessHeap () returned 0xd20000 [0104.251] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.251] GetProcessHeap () returned 0xd20000 [0104.251] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0104.251] GetProcessHeap () returned 0xd20000 [0104.251] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0104.252] GetProcessHeap () returned 0xd20000 [0104.252] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.252] GetProcessHeap () returned 0xd20000 [0104.252] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.252] GetProcessHeap () returned 0xd20000 [0104.252] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0104.252] GetProcessHeap () returned 0xd20000 [0104.252] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0104.252] GetProcessHeap () returned 0xd20000 [0104.252] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0104.252] GetProcessHeap () returned 0xd20000 [0104.252] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0104.252] GetProcessHeap () returned 0xd20000 [0104.252] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0104.252] GetProcessHeap () returned 0xd20000 [0104.252] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0104.252] GetProcessHeap () returned 0xd20000 [0104.252] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.252] GetProcessHeap () returned 0xd20000 [0104.253] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.253] GetProcessHeap () returned 0xd20000 [0104.253] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.253] GetProcessHeap () returned 0xd20000 [0104.253] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.253] GetProcessHeap () returned 0xd20000 [0104.253] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0104.253] GetProcessHeap () returned 0xd20000 [0104.253] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0104.253] GetProcessHeap () returned 0xd20000 [0104.253] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0104.253] GetProcessHeap () returned 0xd20000 [0104.253] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0104.253] GetProcessHeap () returned 0xd20000 [0104.253] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0104.253] GetProcessHeap () returned 0xd20000 [0104.253] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0104.253] GetProcessHeap () returned 0xd20000 [0104.254] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.254] GetProcessHeap () returned 0xd20000 [0104.254] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.254] GetProcessHeap () returned 0xd20000 [0104.254] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.254] GetProcessHeap () returned 0xd20000 [0104.254] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.254] GetProcessHeap () returned 0xd20000 [0104.254] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0104.254] GetProcessHeap () returned 0xd20000 [0104.254] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0104.254] GetProcessHeap () returned 0xd20000 [0104.254] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.254] GetProcessHeap () returned 0xd20000 [0104.254] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.254] GetProcessHeap () returned 0xd20000 [0104.254] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0104.254] GetProcessHeap () returned 0xd20000 [0104.254] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0104.254] GetProcessHeap () returned 0xd20000 [0104.255] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0104.255] GetProcessHeap () returned 0xd20000 [0104.255] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0104.255] GetProcessHeap () returned 0xd20000 [0104.255] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0104.255] GetProcessHeap () returned 0xd20000 [0104.255] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0104.255] GetProcessHeap () returned 0xd20000 [0104.255] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0104.255] GetProcessHeap () returned 0xd20000 [0104.255] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0104.255] GetProcessHeap () returned 0xd20000 [0104.255] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.255] GetProcessHeap () returned 0xd20000 [0104.255] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.255] GetProcessHeap () returned 0xd20000 [0104.255] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.255] GetProcessHeap () returned 0xd20000 [0104.255] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.256] GetProcessHeap () returned 0xd20000 [0104.256] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.256] GetProcessHeap () returned 0xd20000 [0104.256] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.256] GetProcessHeap () returned 0xd20000 [0104.256] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0104.256] GetProcessHeap () returned 0xd20000 [0104.256] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0104.256] GetProcessHeap () returned 0xd20000 [0104.256] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0104.256] GetProcessHeap () returned 0xd20000 [0104.256] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0104.256] GetProcessHeap () returned 0xd20000 [0104.256] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0104.256] GetProcessHeap () returned 0xd20000 [0104.256] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0104.256] GetProcessHeap () returned 0xd20000 [0104.256] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0104.256] GetProcessHeap () returned 0xd20000 [0104.256] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0104.257] GetProcessHeap () returned 0xd20000 [0104.257] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.257] GetProcessHeap () returned 0xd20000 [0104.257] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.257] GetProcessHeap () returned 0xd20000 [0104.257] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0104.257] GetProcessHeap () returned 0xd20000 [0104.257] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0104.257] GetProcessHeap () returned 0xd20000 [0104.257] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0104.257] GetProcessHeap () returned 0xd20000 [0104.257] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0104.257] GetProcessHeap () returned 0xd20000 [0104.257] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0104.257] GetProcessHeap () returned 0xd20000 [0104.257] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0104.257] GetProcessHeap () returned 0xd20000 [0104.257] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0104.257] GetProcessHeap () returned 0xd20000 [0104.257] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0104.258] GetProcessHeap () returned 0xd20000 [0104.258] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0104.258] GetProcessHeap () returned 0xd20000 [0104.258] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0104.258] GetProcessHeap () returned 0xd20000 [0104.258] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0104.258] GetProcessHeap () returned 0xd20000 [0104.258] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0104.258] GetProcessHeap () returned 0xd20000 [0104.258] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0104.258] GetProcessHeap () returned 0xd20000 [0104.258] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0104.258] GetProcessHeap () returned 0xd20000 [0104.258] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0104.258] GetProcessHeap () returned 0xd20000 [0104.258] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0104.258] GetProcessHeap () returned 0xd20000 [0104.258] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0104.258] GetProcessHeap () returned 0xd20000 [0104.258] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0104.259] GetProcessHeap () returned 0xd20000 [0104.259] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.259] GetProcessHeap () returned 0xd20000 [0104.259] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.259] GetProcessHeap () returned 0xd20000 [0104.259] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0104.259] GetProcessHeap () returned 0xd20000 [0104.259] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0104.259] GetProcessHeap () returned 0xd20000 [0104.259] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0104.259] GetProcessHeap () returned 0xd20000 [0104.259] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0104.259] GetProcessHeap () returned 0xd20000 [0104.259] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0104.259] GetProcessHeap () returned 0xd20000 [0104.259] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0104.259] GetProcessHeap () returned 0xd20000 [0104.259] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0104.374] GetProcessHeap () returned 0xd20000 [0104.374] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0104.374] GetProcessHeap () returned 0xd20000 [0104.374] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0104.374] GetProcessHeap () returned 0xd20000 [0104.374] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0104.374] GetProcessHeap () returned 0xd20000 [0104.374] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0104.374] GetProcessHeap () returned 0xd20000 [0104.374] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0104.375] GetProcessHeap () returned 0xd20000 [0104.375] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0104.375] GetProcessHeap () returned 0xd20000 [0104.375] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0104.375] GetProcessHeap () returned 0xd20000 [0104.375] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0104.375] GetProcessHeap () returned 0xd20000 [0104.375] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0104.375] GetProcessHeap () returned 0xd20000 [0104.375] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.375] GetProcessHeap () returned 0xd20000 [0104.375] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.375] GetProcessHeap () returned 0xd20000 [0104.375] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.375] GetProcessHeap () returned 0xd20000 [0104.375] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.375] GetProcessHeap () returned 0xd20000 [0104.375] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.375] GetProcessHeap () returned 0xd20000 [0104.375] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.376] GetProcessHeap () returned 0xd20000 [0104.376] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0104.376] GetProcessHeap () returned 0xd20000 [0104.376] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0104.376] GetProcessHeap () returned 0xd20000 [0104.376] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.376] GetProcessHeap () returned 0xd20000 [0104.376] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.376] GetProcessHeap () returned 0xd20000 [0104.376] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0104.376] GetProcessHeap () returned 0xd20000 [0104.376] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0104.376] GetProcessHeap () returned 0xd20000 [0104.376] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.376] GetProcessHeap () returned 0xd20000 [0104.376] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.376] GetProcessHeap () returned 0xd20000 [0104.376] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0104.376] GetProcessHeap () returned 0xd20000 [0104.376] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0104.376] GetProcessHeap () returned 0xd20000 [0104.377] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0104.377] GetProcessHeap () returned 0xd20000 [0104.377] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0104.377] GetProcessHeap () returned 0xd20000 [0104.377] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0104.377] GetProcessHeap () returned 0xd20000 [0104.377] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0104.377] GetProcessHeap () returned 0xd20000 [0104.377] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0104.377] GetProcessHeap () returned 0xd20000 [0104.377] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0104.377] GetProcessHeap () returned 0xd20000 [0104.377] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0104.377] GetProcessHeap () returned 0xd20000 [0104.377] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0104.377] GetProcessHeap () returned 0xd20000 [0104.377] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0104.377] GetProcessHeap () returned 0xd20000 [0104.377] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0104.377] GetProcessHeap () returned 0xd20000 [0104.378] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0104.378] GetProcessHeap () returned 0xd20000 [0104.378] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0104.378] GetProcessHeap () returned 0xd20000 [0104.378] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0104.378] GetProcessHeap () returned 0xd20000 [0104.378] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0104.378] GetProcessHeap () returned 0xd20000 [0104.378] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0104.378] GetProcessHeap () returned 0xd20000 [0104.378] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0104.378] GetProcessHeap () returned 0xd20000 [0104.378] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0104.378] GetProcessHeap () returned 0xd20000 [0104.378] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0104.378] GetProcessHeap () returned 0xd20000 [0104.378] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.378] GetProcessHeap () returned 0xd20000 [0104.378] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.378] GetProcessHeap () returned 0xd20000 [0104.379] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0104.379] GetProcessHeap () returned 0xd20000 [0104.379] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0104.379] GetProcessHeap () returned 0xd20000 [0104.379] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0104.379] GetProcessHeap () returned 0xd20000 [0104.379] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0104.379] GetProcessHeap () returned 0xd20000 [0104.379] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0104.379] GetProcessHeap () returned 0xd20000 [0104.379] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0104.379] GetProcessHeap () returned 0xd20000 [0104.379] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.379] GetProcessHeap () returned 0xd20000 [0104.379] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.379] GetProcessHeap () returned 0xd20000 [0104.379] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.379] GetProcessHeap () returned 0xd20000 [0104.379] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.379] GetProcessHeap () returned 0xd20000 [0104.380] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0104.380] GetProcessHeap () returned 0xd20000 [0104.380] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0104.380] GetProcessHeap () returned 0xd20000 [0104.380] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0104.380] GetProcessHeap () returned 0xd20000 [0104.380] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0104.380] GetProcessHeap () returned 0xd20000 [0104.380] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0104.380] GetProcessHeap () returned 0xd20000 [0104.380] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0104.380] GetProcessHeap () returned 0xd20000 [0104.380] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0104.380] GetProcessHeap () returned 0xd20000 [0104.380] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0104.380] GetProcessHeap () returned 0xd20000 [0104.380] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0104.380] GetProcessHeap () returned 0xd20000 [0104.380] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0104.381] GetProcessHeap () returned 0xd20000 [0104.381] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0104.381] GetProcessHeap () returned 0xd20000 [0104.381] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0104.381] GetProcessHeap () returned 0xd20000 [0104.381] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0104.381] GetProcessHeap () returned 0xd20000 [0104.381] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0104.381] GetProcessHeap () returned 0xd20000 [0104.381] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0104.381] GetProcessHeap () returned 0xd20000 [0104.381] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0104.381] GetProcessHeap () returned 0xd20000 [0104.381] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.381] GetProcessHeap () returned 0xd20000 [0104.381] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.381] GetProcessHeap () returned 0xd20000 [0104.381] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.381] GetProcessHeap () returned 0xd20000 [0104.381] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.381] GetProcessHeap () returned 0xd20000 [0104.382] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.382] GetProcessHeap () returned 0xd20000 [0104.382] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.382] GetProcessHeap () returned 0xd20000 [0104.382] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.382] GetProcessHeap () returned 0xd20000 [0104.382] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.382] GetProcessHeap () returned 0xd20000 [0104.382] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0104.382] GetProcessHeap () returned 0xd20000 [0104.382] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0104.382] GetProcessHeap () returned 0xd20000 [0104.382] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0104.382] GetProcessHeap () returned 0xd20000 [0104.382] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0104.382] GetProcessHeap () returned 0xd20000 [0104.382] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0104.382] GetProcessHeap () returned 0xd20000 [0104.382] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0104.382] GetProcessHeap () returned 0xd20000 [0104.383] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0104.383] GetProcessHeap () returned 0xd20000 [0104.383] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0104.383] GetProcessHeap () returned 0xd20000 [0104.383] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0104.383] GetProcessHeap () returned 0xd20000 [0104.383] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0104.383] GetProcessHeap () returned 0xd20000 [0104.383] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0104.383] GetProcessHeap () returned 0xd20000 [0104.383] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0104.383] GetProcessHeap () returned 0xd20000 [0104.383] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0104.383] GetProcessHeap () returned 0xd20000 [0104.383] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0104.383] GetProcessHeap () returned 0xd20000 [0104.383] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44498 | out: hHeap=0xd20000) returned 1 [0104.383] GetProcessHeap () returned 0xd20000 [0104.383] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ae58 | out: hHeap=0xd20000) returned 1 [0104.384] GetProcessHeap () returned 0xd20000 [0104.384] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0104.384] GetProcessHeap () returned 0xd20000 [0104.384] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b758 | out: hHeap=0xd20000) returned 1 [0104.384] GetProcessHeap () returned 0xd20000 [0104.384] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0104.384] GetProcessHeap () returned 0xd20000 [0104.384] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0104.384] GetProcessHeap () returned 0xd20000 [0104.384] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0104.384] WriteFile (in: hFile=0x230, lpBuffer=0xd4e408*, nNumberOfBytesToWrite=0x386, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e408*, lpNumberOfBytesWritten=0x299d864*=0x386, lpOverlapped=0x0) returned 1 [0104.387] GetProcessHeap () returned 0xd20000 [0104.387] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4e408, Size=0x30) returned 0xd4e408 [0104.387] GetProcessHeap () returned 0xd20000 [0104.387] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0104.387] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0104.387] GetProcessHeap () returned 0xd20000 [0104.388] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10f0) returned 0xd4e440 [0104.388] ReadFile (in: hFile=0x230, lpBuffer=0xd4e440, nNumberOfBytesToRead=0x10f0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4e440*, lpNumberOfBytesRead=0x299d7e8*=0x10f0, lpOverlapped=0x0) returned 1 [0104.388] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0104.388] WriteFile (in: hFile=0x230, lpBuffer=0xd4e440*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4e440*, lpNumberOfBytesWritten=0x299d7e4*=0x10f0, lpOverlapped=0x0) returned 1 [0104.390] GetProcessHeap () returned 0xd20000 [0104.390] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4e440 | out: hHeap=0xd20000) returned 1 [0104.390] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0104.390] WriteFile (in: hFile=0x230, lpBuffer=0xd4e408*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e408*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0104.392] CloseHandle (hObject=0x230) returned 1 [0104.397] GetProcessHeap () returned 0xd20000 [0104.397] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42828 | out: hHeap=0xd20000) returned 1 [0104.397] GetProcessHeap () returned 0xd20000 [0104.397] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c0e8 | out: hHeap=0xd20000) returned 1 [0104.397] GetProcessHeap () returned 0xd20000 [0104.397] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0104.397] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\0d81OSxvhci1.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\0d81OSxvhci1.avi") returned="C:\\Users\\FD1HVy\\Videos\\0d81OSxvhci1.avi" [0104.397] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\0d81OSxvhci1.avi", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\0d81OSxvhci1.avi.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Videos\\0d81OSxvhci1.avi.[ponce.lorena@aol.com]" [0104.397] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\0d81OSxvhci1.avi" (normalized: "c:\\users\\fd1hvy\\videos\\0d81osxvhci1.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\0d81OSxvhci1.avi.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\videos\\0d81osxvhci1.avi.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0104.398] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\0d81OSxvhci1.avi" | out: pszPath="C:\\Users\\FD1HVy\\Videos") returned 1 [0104.398] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\") returned="" [0104.398] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Videos\\HOW_RECOVER.html" [0104.399] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\how_recover.html")) returned 0xffffffff [0104.399] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\how_recover.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0104.399] GetProcessHeap () returned 0xd20000 [0104.399] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bda0 [0104.399] GetProcessHeap () returned 0xd20000 [0104.399] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0104.410] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.412] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.412] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.412] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.413] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.413] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.413] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.413] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.413] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.413] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.413] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.414] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.414] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.414] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.414] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.414] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.414] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.414] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.414] GetProcessHeap () returned 0xd20000 [0104.414] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bda0 | out: hHeap=0xd20000) returned 1 [0104.415] GetProcessHeap () returned 0xd20000 [0104.415] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0104.415] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x299d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x299d9d0*=0x300, lpOverlapped=0x0) returned 1 [0104.416] GetProcessHeap () returned 0xd20000 [0104.416] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bf08 [0104.416] GetProcessHeap () returned 0xd20000 [0104.416] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0104.426] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.426] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.426] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.427] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.427] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.427] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.427] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.427] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.427] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.428] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.428] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.428] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.428] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.428] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.428] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.428] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.428] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.429] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.429] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.429] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.429] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.429] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.429] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.429] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.429] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.430] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.430] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.430] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.430] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.430] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.430] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.430] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.430] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.431] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.431] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.431] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.431] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.431] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.431] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.533] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.534] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.534] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.534] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.534] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.534] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.534] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.534] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.534] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.535] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.535] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.535] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.535] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.535] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.535] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.535] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.535] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.536] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.536] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.536] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.536] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.536] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.536] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.536] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.536] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.537] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.538] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.538] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.538] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.538] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.538] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.538] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.539] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.539] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.539] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.539] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.539] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.539] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.539] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.539] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.539] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.540] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.540] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.540] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.540] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.540] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.540] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.540] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.540] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.541] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.541] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.541] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.541] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.541] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.542] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.542] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.542] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.542] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.542] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.542] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.542] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.542] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.543] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.543] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.543] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.543] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.543] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.543] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.544] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.544] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.544] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0104.544] GetProcessHeap () returned 0xd20000 [0104.544] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bf08 | out: hHeap=0xd20000) returned 1 [0104.544] GetProcessHeap () returned 0xd20000 [0104.544] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0104.544] CloseHandle (hObject=0x230) returned 1 [0104.545] GetProcessHeap () returned 0xd20000 [0104.545] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36648 | out: hHeap=0xd20000) returned 1 [0104.545] FindNextFileW (in: hFindFile=0xd491a0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43f94523, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0104.545] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0104.545] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0104.545] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\desktop.ini") returned="C:\\Users\\FD1HVy\\Videos\\desktop.ini" [0104.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0104.545] GetProcessHeap () returned 0xd20000 [0104.545] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd445d0 [0104.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0xd445d0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0104.545] lstrlenA (lpString="desktop.ini") returned 11 [0104.545] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0104.545] lstrlenA (lpString="desktop.ini") returned 11 [0104.545] lstrlenA (lpString=".dll") returned 4 [0104.545] lstrlenA (lpString=".dll") returned 4 [0104.546] lstrlenA (lpString="desktop.ini") returned 11 [0104.546] lstrcmpiA (lpString1=".ini", lpString2=".dll") returned 1 [0104.546] lstrlenA (lpString="desktop.ini") returned 11 [0104.546] lstrlenA (lpString=".ini") returned 4 [0104.546] lstrlenA (lpString=".ini") returned 4 [0104.546] lstrlenA (lpString="desktop.ini") returned 11 [0104.546] lstrcmpiA (lpString1=".ini", lpString2=".ini") returned 0 [0104.546] GetProcessHeap () returned 0xd20000 [0104.546] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445d0 | out: hHeap=0xd20000) returned 1 [0104.546] FindNextFileW (in: hFindFile=0xd491a0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11848110, ftCreationTime.dwHighDateTime=0x1d4d447, ftLastAccessTime.dwLowDateTime=0x6b773200, ftLastAccessTime.dwHighDateTime=0x1d4d003, ftLastWriteTime.dwLowDateTime=0x6b773200, ftLastWriteTime.dwHighDateTime=0x1d4d003, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fj8TJD", cAlternateFileName="")) returned 1 [0104.546] lstrcmpiW (lpString1="fj8TJD", lpString2=".") returned 1 [0104.546] lstrcmpiW (lpString1="fj8TJD", lpString2="..") returned 1 [0104.546] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="fj8TJD" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD") returned="C:\\Users\\FD1HVy\\Videos\\fj8TJD" [0104.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fj8TJD", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0104.546] GetProcessHeap () returned 0xd20000 [0104.546] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x7) returned 0xd3ce58 [0104.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fj8TJD", cchWideChar=-1, lpMultiByteStr=0xd3ce58, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fj8TJD", lpUsedDefaultChar=0x0) returned 7 [0104.546] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0104.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0104.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0104.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0104.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0104.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0104.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0104.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0104.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0104.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0104.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0104.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0104.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0104.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0104.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0104.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0104.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0104.547] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0104.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0104.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0104.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0104.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0104.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0104.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0104.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0104.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0104.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0104.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0104.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0104.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0104.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0104.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0104.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0104.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0104.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0104.548] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0104.549] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0104.549] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0104.549] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0104.549] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0104.549] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0104.549] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0104.549] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fj8TJD", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0104.549] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\") returned="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\" [0104.549] GetProcessHeap () returned 0xd20000 [0104.549] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3ceb8 [0104.549] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\") returned 30 [0104.549] GetProcessHeap () returned 0xd20000 [0104.549] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x3e) returned 0xd32260 [0104.549] lstrcpyW (in: lpString1=0xd32260, lpString2="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\") returned="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\" [0104.549] GetProcessHeap () returned 0xd20000 [0104.549] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0104.549] FindNextFileW (in: hFindFile=0xd491a0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf868da0, ftCreationTime.dwHighDateTime=0x1d4d585, ftLastAccessTime.dwLowDateTime=0xa804f8b0, ftLastAccessTime.dwHighDateTime=0x1d4ca8b, ftLastWriteTime.dwLowDateTime=0xa804f8b0, ftLastWriteTime.dwHighDateTime=0x1d4ca8b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fs-XkNXFe2_OG", cAlternateFileName="FS-XKN~1")) returned 1 [0104.549] lstrcmpiW (lpString1="fs-XkNXFe2_OG", lpString2=".") returned 1 [0104.550] lstrcmpiW (lpString1="fs-XkNXFe2_OG", lpString2="..") returned 1 [0104.550] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="fs-XkNXFe2_OG" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG" [0104.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs-XkNXFe2_OG", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0104.550] GetProcessHeap () returned 0xd20000 [0104.550] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xe) returned 0xd44408 [0104.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="fs-XkNXFe2_OG", cchWideChar=-1, lpMultiByteStr=0xd44408, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fs-XkNXFe2_OG", lpUsedDefaultChar=0x0) returned 14 [0104.550] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0104.550] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0104.550] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0104.550] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0104.550] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0104.550] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0104.550] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0104.550] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0104.550] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0104.550] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0104.550] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0104.550] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0104.551] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0104.551] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0104.551] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0104.551] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0104.551] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0104.551] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0104.551] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0104.551] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0104.551] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0104.551] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0104.551] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0104.551] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0104.551] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0104.551] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0104.551] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0104.551] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0104.551] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0104.551] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0104.551] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0104.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0104.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0104.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0104.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0104.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0104.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0104.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0104.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0104.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0104.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0104.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0104.552] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="fs-XkNXFe2_OG", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0104.552] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\" [0104.552] GetProcessHeap () returned 0xd20000 [0104.552] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cf38 [0104.552] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\") returned 37 [0104.552] GetProcessHeap () returned 0xd20000 [0104.552] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4c) returned 0xd2e898 [0104.553] lstrcpyW (in: lpString1=0xd2e898, lpString2="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\" [0104.553] GetProcessHeap () returned 0xd20000 [0104.553] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44408 | out: hHeap=0xd20000) returned 1 [0104.553] FindNextFileW (in: hFindFile=0xd491a0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efd4f20, ftCreationTime.dwHighDateTime=0x1d4ca5d, ftLastAccessTime.dwLowDateTime=0xafc3f990, ftLastAccessTime.dwHighDateTime=0x1d4d1e1, ftLastWriteTime.dwLowDateTime=0xafc3f990, ftLastWriteTime.dwHighDateTime=0x1d4d1e1, nFileSizeHigh=0x0, nFileSizeLow=0x6cf4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jDypM.mkv", cAlternateFileName="")) returned 1 [0104.553] lstrcmpiW (lpString1="jDypM.mkv", lpString2=".") returned 1 [0104.553] lstrcmpiW (lpString1="jDypM.mkv", lpString2="..") returned 1 [0104.553] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="jDypM.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\jDypM.mkv") returned="C:\\Users\\FD1HVy\\Videos\\jDypM.mkv" [0104.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="jDypM.mkv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0104.553] GetProcessHeap () returned 0xd20000 [0104.553] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xa) returned 0xd44690 [0104.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="jDypM.mkv", cchWideChar=-1, lpMultiByteStr=0xd44690, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="jDypM.mkv", lpUsedDefaultChar=0x0) returned 10 [0104.553] lstrlenA (lpString="jDypM.mkv") returned 9 [0104.553] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0104.553] lstrlenA (lpString="jDypM.mkv") returned 9 [0104.553] lstrlenA (lpString=".dll") returned 4 [0104.553] lstrlenA (lpString=".dll") returned 4 [0104.553] lstrlenA (lpString="jDypM.mkv") returned 9 [0104.553] lstrcmpiA (lpString1=".mkv", lpString2=".dll") returned 1 [0104.553] lstrlenA (lpString="jDypM.mkv") returned 9 [0104.554] lstrlenA (lpString=".ini") returned 4 [0104.554] lstrlenA (lpString=".ini") returned 4 [0104.554] lstrlenA (lpString="jDypM.mkv") returned 9 [0104.554] lstrcmpiA (lpString1=".mkv", lpString2=".ini") returned 1 [0104.554] lstrlenA (lpString="jDypM.mkv") returned 9 [0104.554] lstrlenA (lpString=".inc") returned 4 [0104.554] lstrlenA (lpString=".inc") returned 4 [0104.554] lstrlenA (lpString="jDypM.mkv") returned 9 [0104.554] lstrcmpiA (lpString1=".mkv", lpString2=".inc") returned 1 [0104.554] lstrcmpiW (lpString1="jDypM.mkv", lpString2="HOW_RECOVER.html") returned 1 [0104.554] lstrcmpiW (lpString1="jDypM.mkv", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0104.554] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0104.554] lstrcmpiW (lpString1="jDypM.mkv", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0104.554] GetProcessHeap () returned 0xd20000 [0104.555] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42828 [0104.555] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\jDypM.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\jdypm.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0104.555] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=27892) returned 1 [0104.555] GetProcessHeap () returned 0xd20000 [0104.555] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bb48 [0104.555] GetProcessHeap () returned 0xd20000 [0104.555] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0104.555] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\jDypM.mkv") returned 32 [0104.555] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0104.555] GetProcessHeap () returned 0xd20000 [0104.556] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0104.556] GetProcessHeap () returned 0xd20000 [0104.556] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4e440 [0104.556] lstrlenA (lpString="rsa_encrypt") returned 11 [0104.556] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0104.622] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0104.622] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0104.622] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0104.622] GetProcessHeap () returned 0xd20000 [0104.622] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0104.622] lstrlenA (lpString="010001") returned 6 [0104.622] GetProcessHeap () returned 0xd20000 [0104.622] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cf68 [0104.622] GetProcessHeap () returned 0xd20000 [0104.622] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0104.622] GetProcessHeap () returned 0xd20000 [0104.622] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b638 [0104.622] GetProcessHeap () returned 0xd20000 [0104.622] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0104.622] GetProcessHeap () returned 0xd20000 [0104.623] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b2d8 [0104.623] GetProcessHeap () returned 0xd20000 [0104.623] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45528 [0104.623] GetProcessHeap () returned 0xd20000 [0104.623] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ce18 [0104.623] GetProcessHeap () returned 0xd20000 [0104.623] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0104.623] GetProcessHeap () returned 0xd20000 [0104.623] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0104.623] GetProcessHeap () returned 0xd20000 [0104.623] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44c68 [0104.623] GetProcessHeap () returned 0xd20000 [0104.623] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0104.623] GetProcessHeap () returned 0xd20000 [0104.623] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44d80 [0104.623] GetProcessHeap () returned 0xd20000 [0104.623] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.623] GetProcessHeap () returned 0xd20000 [0104.623] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445a0 [0104.623] GetProcessHeap () returned 0xd20000 [0104.624] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b248 [0104.624] GetProcessHeap () returned 0xd20000 [0104.624] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0104.624] GetProcessHeap () returned 0xd20000 [0104.624] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0104.624] GetProcessHeap () returned 0xd20000 [0104.624] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b248 | out: hHeap=0xd20000) returned 1 [0104.624] GetProcessHeap () returned 0xd20000 [0104.624] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0104.624] GetProcessHeap () returned 0xd20000 [0104.624] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44510 [0104.624] GetProcessHeap () returned 0xd20000 [0104.624] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.624] GetProcessHeap () returned 0xd20000 [0104.624] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0104.624] GetProcessHeap () returned 0xd20000 [0104.624] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0104.624] GetProcessHeap () returned 0xd20000 [0104.624] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0104.624] GetProcessHeap () returned 0xd20000 [0104.624] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0104.624] GetProcessHeap () returned 0xd20000 [0104.625] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0104.625] GetProcessHeap () returned 0xd20000 [0104.625] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4ac18 [0104.625] GetProcessHeap () returned 0xd20000 [0104.625] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44510 | out: hHeap=0xd20000) returned 1 [0104.625] GetProcessHeap () returned 0xd20000 [0104.625] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0104.625] GetProcessHeap () returned 0xd20000 [0104.625] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ac18 | out: hHeap=0xd20000) returned 1 [0104.625] GetProcessHeap () returned 0xd20000 [0104.625] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0104.625] GetProcessHeap () returned 0xd20000 [0104.625] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0104.625] GetProcessHeap () returned 0xd20000 [0104.625] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0104.625] GetProcessHeap () returned 0xd20000 [0104.625] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0104.625] GetProcessHeap () returned 0xd20000 [0104.625] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0104.625] GetProcessHeap () returned 0xd20000 [0104.625] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0104.626] GetProcessHeap () returned 0xd20000 [0104.626] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.626] GetProcessHeap () returned 0xd20000 [0104.626] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.626] GetProcessHeap () returned 0xd20000 [0104.626] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0104.626] GetProcessHeap () returned 0xd20000 [0104.626] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0104.626] GetProcessHeap () returned 0xd20000 [0104.626] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.626] GetProcessHeap () returned 0xd20000 [0104.626] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.626] GetProcessHeap () returned 0xd20000 [0104.626] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.626] GetProcessHeap () returned 0xd20000 [0104.626] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.626] GetProcessHeap () returned 0xd20000 [0104.626] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0104.626] GetProcessHeap () returned 0xd20000 [0104.626] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0104.626] GetProcessHeap () returned 0xd20000 [0104.627] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0104.627] GetProcessHeap () returned 0xd20000 [0104.627] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0104.627] GetProcessHeap () returned 0xd20000 [0104.627] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0104.627] GetProcessHeap () returned 0xd20000 [0104.627] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0104.627] GetProcessHeap () returned 0xd20000 [0104.627] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.627] GetProcessHeap () returned 0xd20000 [0104.627] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.627] GetProcessHeap () returned 0xd20000 [0104.627] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0104.627] GetProcessHeap () returned 0xd20000 [0104.627] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0104.627] GetProcessHeap () returned 0xd20000 [0104.627] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0104.627] GetProcessHeap () returned 0xd20000 [0104.627] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0104.628] GetProcessHeap () returned 0xd20000 [0104.628] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0104.628] GetProcessHeap () returned 0xd20000 [0104.628] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0104.628] GetProcessHeap () returned 0xd20000 [0104.628] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0104.628] GetProcessHeap () returned 0xd20000 [0104.628] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0104.628] GetProcessHeap () returned 0xd20000 [0104.628] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0104.628] GetProcessHeap () returned 0xd20000 [0104.628] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0104.628] GetProcessHeap () returned 0xd20000 [0104.628] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.628] GetProcessHeap () returned 0xd20000 [0104.628] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.628] GetProcessHeap () returned 0xd20000 [0104.628] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.628] GetProcessHeap () returned 0xd20000 [0104.628] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.628] GetProcessHeap () returned 0xd20000 [0104.629] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.629] GetProcessHeap () returned 0xd20000 [0104.629] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.629] GetProcessHeap () returned 0xd20000 [0104.629] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.629] GetProcessHeap () returned 0xd20000 [0104.629] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.629] GetProcessHeap () returned 0xd20000 [0104.629] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0104.629] GetProcessHeap () returned 0xd20000 [0104.629] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0104.629] GetProcessHeap () returned 0xd20000 [0104.629] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0104.629] GetProcessHeap () returned 0xd20000 [0104.629] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0104.629] GetProcessHeap () returned 0xd20000 [0104.629] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0104.629] GetProcessHeap () returned 0xd20000 [0104.629] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0104.629] GetProcessHeap () returned 0xd20000 [0104.629] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0104.629] GetProcessHeap () returned 0xd20000 [0104.630] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0104.630] GetProcessHeap () returned 0xd20000 [0104.630] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0104.630] GetProcessHeap () returned 0xd20000 [0104.630] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0104.630] GetProcessHeap () returned 0xd20000 [0104.630] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.630] GetProcessHeap () returned 0xd20000 [0104.630] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.630] GetProcessHeap () returned 0xd20000 [0104.630] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0104.630] GetProcessHeap () returned 0xd20000 [0104.630] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0104.630] GetProcessHeap () returned 0xd20000 [0104.630] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.630] GetProcessHeap () returned 0xd20000 [0104.630] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.630] GetProcessHeap () returned 0xd20000 [0104.630] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0104.630] GetProcessHeap () returned 0xd20000 [0104.630] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0104.631] GetProcessHeap () returned 0xd20000 [0104.631] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0104.631] GetProcessHeap () returned 0xd20000 [0104.631] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0104.631] GetProcessHeap () returned 0xd20000 [0104.631] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0104.631] GetProcessHeap () returned 0xd20000 [0104.631] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0104.631] GetProcessHeap () returned 0xd20000 [0104.631] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0104.631] GetProcessHeap () returned 0xd20000 [0104.631] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0104.631] GetProcessHeap () returned 0xd20000 [0104.631] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0104.631] GetProcessHeap () returned 0xd20000 [0104.631] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0104.631] GetProcessHeap () returned 0xd20000 [0104.631] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.631] GetProcessHeap () returned 0xd20000 [0104.631] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.631] GetProcessHeap () returned 0xd20000 [0104.631] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0104.632] GetProcessHeap () returned 0xd20000 [0104.632] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0104.632] GetProcessHeap () returned 0xd20000 [0104.632] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.632] GetProcessHeap () returned 0xd20000 [0104.632] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.632] GetProcessHeap () returned 0xd20000 [0104.632] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.632] GetProcessHeap () returned 0xd20000 [0104.632] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.632] GetProcessHeap () returned 0xd20000 [0104.632] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.632] GetProcessHeap () returned 0xd20000 [0104.632] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.632] GetProcessHeap () returned 0xd20000 [0104.632] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.632] GetProcessHeap () returned 0xd20000 [0104.632] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.632] GetProcessHeap () returned 0xd20000 [0104.632] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.633] GetProcessHeap () returned 0xd20000 [0104.633] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.633] GetProcessHeap () returned 0xd20000 [0104.633] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0104.633] GetProcessHeap () returned 0xd20000 [0104.633] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0104.633] GetProcessHeap () returned 0xd20000 [0104.633] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0104.633] GetProcessHeap () returned 0xd20000 [0104.633] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0104.633] GetProcessHeap () returned 0xd20000 [0104.633] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0104.633] GetProcessHeap () returned 0xd20000 [0104.633] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0104.633] GetProcessHeap () returned 0xd20000 [0104.633] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.633] GetProcessHeap () returned 0xd20000 [0104.633] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.633] GetProcessHeap () returned 0xd20000 [0104.633] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0104.633] GetProcessHeap () returned 0xd20000 [0104.634] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0104.634] GetProcessHeap () returned 0xd20000 [0104.634] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.634] GetProcessHeap () returned 0xd20000 [0104.634] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.634] GetProcessHeap () returned 0xd20000 [0104.634] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0104.634] GetProcessHeap () returned 0xd20000 [0104.634] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0104.634] GetProcessHeap () returned 0xd20000 [0104.634] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0104.634] GetProcessHeap () returned 0xd20000 [0104.634] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0104.634] GetProcessHeap () returned 0xd20000 [0104.634] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0104.634] GetProcessHeap () returned 0xd20000 [0104.634] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0104.634] GetProcessHeap () returned 0xd20000 [0104.634] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0104.634] GetProcessHeap () returned 0xd20000 [0104.746] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0104.746] GetProcessHeap () returned 0xd20000 [0104.746] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0104.746] GetProcessHeap () returned 0xd20000 [0104.746] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0104.746] GetProcessHeap () returned 0xd20000 [0104.746] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.746] GetProcessHeap () returned 0xd20000 [0104.746] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.747] GetProcessHeap () returned 0xd20000 [0104.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0104.747] GetProcessHeap () returned 0xd20000 [0104.747] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0104.747] GetProcessHeap () returned 0xd20000 [0104.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0104.747] GetProcessHeap () returned 0xd20000 [0104.747] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0104.747] GetProcessHeap () returned 0xd20000 [0104.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.747] GetProcessHeap () returned 0xd20000 [0104.747] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.747] GetProcessHeap () returned 0xd20000 [0104.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0104.747] GetProcessHeap () returned 0xd20000 [0104.747] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0104.747] GetProcessHeap () returned 0xd20000 [0104.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.747] GetProcessHeap () returned 0xd20000 [0104.747] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.747] GetProcessHeap () returned 0xd20000 [0104.748] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.748] GetProcessHeap () returned 0xd20000 [0104.748] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.748] GetProcessHeap () returned 0xd20000 [0104.748] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.748] GetProcessHeap () returned 0xd20000 [0104.748] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.748] GetProcessHeap () returned 0xd20000 [0104.748] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0104.748] GetProcessHeap () returned 0xd20000 [0104.748] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0104.748] GetProcessHeap () returned 0xd20000 [0104.748] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0104.748] GetProcessHeap () returned 0xd20000 [0104.748] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0104.748] GetProcessHeap () returned 0xd20000 [0104.748] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0104.748] GetProcessHeap () returned 0xd20000 [0104.748] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0104.748] GetProcessHeap () returned 0xd20000 [0104.748] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0104.748] GetProcessHeap () returned 0xd20000 [0104.749] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0104.749] GetProcessHeap () returned 0xd20000 [0104.749] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0104.749] GetProcessHeap () returned 0xd20000 [0104.749] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0104.749] GetProcessHeap () returned 0xd20000 [0104.749] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0104.749] GetProcessHeap () returned 0xd20000 [0104.749] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0104.749] GetProcessHeap () returned 0xd20000 [0104.749] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0104.749] GetProcessHeap () returned 0xd20000 [0104.749] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0104.749] GetProcessHeap () returned 0xd20000 [0104.749] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0104.749] GetProcessHeap () returned 0xd20000 [0104.749] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0104.749] GetProcessHeap () returned 0xd20000 [0104.749] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.749] GetProcessHeap () returned 0xd20000 [0104.749] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.750] GetProcessHeap () returned 0xd20000 [0104.750] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0104.750] GetProcessHeap () returned 0xd20000 [0104.750] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0104.750] GetProcessHeap () returned 0xd20000 [0104.750] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0104.750] GetProcessHeap () returned 0xd20000 [0104.750] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0104.750] GetProcessHeap () returned 0xd20000 [0104.750] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0104.750] GetProcessHeap () returned 0xd20000 [0104.750] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0104.750] GetProcessHeap () returned 0xd20000 [0104.750] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0104.750] GetProcessHeap () returned 0xd20000 [0104.750] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0104.750] GetProcessHeap () returned 0xd20000 [0104.750] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.750] GetProcessHeap () returned 0xd20000 [0104.750] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.750] GetProcessHeap () returned 0xd20000 [0104.751] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0104.751] GetProcessHeap () returned 0xd20000 [0104.751] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0104.751] GetProcessHeap () returned 0xd20000 [0104.751] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0104.751] GetProcessHeap () returned 0xd20000 [0104.751] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0104.751] GetProcessHeap () returned 0xd20000 [0104.751] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0104.751] GetProcessHeap () returned 0xd20000 [0104.751] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0104.751] GetProcessHeap () returned 0xd20000 [0104.751] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0104.751] GetProcessHeap () returned 0xd20000 [0104.751] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0104.751] GetProcessHeap () returned 0xd20000 [0104.751] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0104.751] GetProcessHeap () returned 0xd20000 [0104.751] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0104.751] GetProcessHeap () returned 0xd20000 [0104.751] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0104.752] GetProcessHeap () returned 0xd20000 [0104.752] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0104.752] GetProcessHeap () returned 0xd20000 [0104.752] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0104.752] GetProcessHeap () returned 0xd20000 [0104.752] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0104.752] GetProcessHeap () returned 0xd20000 [0104.752] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0104.752] GetProcessHeap () returned 0xd20000 [0104.752] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0104.752] GetProcessHeap () returned 0xd20000 [0104.752] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.752] GetProcessHeap () returned 0xd20000 [0104.752] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.752] GetProcessHeap () returned 0xd20000 [0104.752] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.752] GetProcessHeap () returned 0xd20000 [0104.752] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.752] GetProcessHeap () returned 0xd20000 [0104.752] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.752] GetProcessHeap () returned 0xd20000 [0104.752] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.753] GetProcessHeap () returned 0xd20000 [0104.753] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.753] GetProcessHeap () returned 0xd20000 [0104.753] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.753] GetProcessHeap () returned 0xd20000 [0104.753] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0104.753] GetProcessHeap () returned 0xd20000 [0104.753] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0104.753] GetProcessHeap () returned 0xd20000 [0104.753] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0104.753] GetProcessHeap () returned 0xd20000 [0104.753] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0104.753] GetProcessHeap () returned 0xd20000 [0104.753] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445a0 | out: hHeap=0xd20000) returned 1 [0104.753] GetProcessHeap () returned 0xd20000 [0104.753] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b2d8 | out: hHeap=0xd20000) returned 1 [0104.753] GetProcessHeap () returned 0xd20000 [0104.753] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0104.753] GetProcessHeap () returned 0xd20000 [0104.753] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b638 | out: hHeap=0xd20000) returned 1 [0104.753] GetProcessHeap () returned 0xd20000 [0104.754] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0104.754] GetProcessHeap () returned 0xd20000 [0104.754] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0104.754] GetProcessHeap () returned 0xd20000 [0104.754] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0104.754] WriteFile (in: hFile=0x230, lpBuffer=0xd4e440*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e440*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0104.765] GetProcessHeap () returned 0xd20000 [0104.765] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4e440, Size=0x30) returned 0xd4e440 [0104.765] GetProcessHeap () returned 0xd20000 [0104.765] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0104.765] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0104.766] GetProcessHeap () returned 0xd20000 [0104.766] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x6cf4) returned 0xd4e478 [0104.766] ReadFile (in: hFile=0x230, lpBuffer=0xd4e478, nNumberOfBytesToRead=0x6cf4, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4e478*, lpNumberOfBytesRead=0x299d7e8*=0x6cf4, lpOverlapped=0x0) returned 1 [0104.767] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0104.767] WriteFile (in: hFile=0x230, lpBuffer=0xd4e478*, nNumberOfBytesToWrite=0x6cf4, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4e478*, lpNumberOfBytesWritten=0x299d7e4*=0x6cf4, lpOverlapped=0x0) returned 1 [0104.768] GetProcessHeap () returned 0xd20000 [0104.768] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4e478 | out: hHeap=0xd20000) returned 1 [0104.769] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0104.769] WriteFile (in: hFile=0x230, lpBuffer=0xd4e440*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4e440*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0104.770] CloseHandle (hObject=0x230) returned 1 [0104.773] GetProcessHeap () returned 0xd20000 [0104.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42828 | out: hHeap=0xd20000) returned 1 [0104.773] GetProcessHeap () returned 0xd20000 [0104.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bb48 | out: hHeap=0xd20000) returned 1 [0104.773] GetProcessHeap () returned 0xd20000 [0104.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0104.773] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\jDypM.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\jDypM.mkv") returned="C:\\Users\\FD1HVy\\Videos\\jDypM.mkv" [0104.773] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\jDypM.mkv", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\jDypM.mkv.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Videos\\jDypM.mkv.[ponce.lorena@aol.com]" [0104.773] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\jDypM.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\jdypm.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\jDypM.mkv.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\videos\\jdypm.mkv.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0104.774] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\jDypM.mkv" | out: pszPath="C:\\Users\\FD1HVy\\Videos") returned 1 [0104.774] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\") returned="" [0104.774] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Videos\\HOW_RECOVER.html" [0104.774] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\how_recover.html")) returned 0x20 [0104.774] GetProcessHeap () returned 0xd20000 [0104.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44690 | out: hHeap=0xd20000) returned 1 [0104.774] FindNextFileW (in: hFindFile=0xd491a0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262a36d0, ftCreationTime.dwHighDateTime=0x1d4d1ba, ftLastAccessTime.dwLowDateTime=0x5ba38820, ftLastAccessTime.dwHighDateTime=0x1d4c797, ftLastWriteTime.dwLowDateTime=0x5ba38820, ftLastWriteTime.dwHighDateTime=0x1d4c797, nFileSizeHigh=0x0, nFileSizeLow=0x1650e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="liW Cl2VLbSoSiMzeR7.avi", cAlternateFileName="LIWCL2~1.AVI")) returned 1 [0104.775] lstrcmpiW (lpString1="liW Cl2VLbSoSiMzeR7.avi", lpString2=".") returned 1 [0104.775] lstrcmpiW (lpString1="liW Cl2VLbSoSiMzeR7.avi", lpString2="..") returned 1 [0104.775] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="liW Cl2VLbSoSiMzeR7.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\liW Cl2VLbSoSiMzeR7.avi") returned="C:\\Users\\FD1HVy\\Videos\\liW Cl2VLbSoSiMzeR7.avi" [0104.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="liW Cl2VLbSoSiMzeR7.avi", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0104.775] GetProcessHeap () returned 0xd20000 [0104.775] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x18) returned 0xd366c8 [0104.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="liW Cl2VLbSoSiMzeR7.avi", cchWideChar=-1, lpMultiByteStr=0xd366c8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="liW Cl2VLbSoSiMzeR7.avi", lpUsedDefaultChar=0x0) returned 24 [0104.775] lstrlenA (lpString="liW Cl2VLbSoSiMzeR7.avi") returned 23 [0104.775] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0104.775] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0104.777] lstrlenA (lpString="liW Cl2VLbSoSiMzeR7.avi") returned 23 [0104.777] lstrcmpiA (lpString1="liW Cl2VLbSoSiMzeR7.avi", lpString2=".[ponce.lorena@aol.com]") returned 1 [0104.777] lstrlenA (lpString="liW Cl2VLbSoSiMzeR7.avi") returned 23 [0104.777] lstrlenA (lpString=".dll") returned 4 [0104.777] lstrlenA (lpString=".dll") returned 4 [0104.777] lstrlenA (lpString="liW Cl2VLbSoSiMzeR7.avi") returned 23 [0104.778] lstrcmpiA (lpString1=".avi", lpString2=".dll") returned -1 [0104.778] lstrlenA (lpString="liW Cl2VLbSoSiMzeR7.avi") returned 23 [0104.778] lstrlenA (lpString=".ini") returned 4 [0104.778] lstrlenA (lpString=".ini") returned 4 [0104.778] lstrlenA (lpString="liW Cl2VLbSoSiMzeR7.avi") returned 23 [0104.778] lstrcmpiA (lpString1=".avi", lpString2=".ini") returned -1 [0104.778] lstrlenA (lpString="liW Cl2VLbSoSiMzeR7.avi") returned 23 [0104.778] lstrlenA (lpString=".inc") returned 4 [0104.778] lstrlenA (lpString=".inc") returned 4 [0104.778] lstrlenA (lpString="liW Cl2VLbSoSiMzeR7.avi") returned 23 [0104.778] lstrcmpiA (lpString1=".avi", lpString2=".inc") returned -1 [0104.778] lstrcmpiW (lpString1="liW Cl2VLbSoSiMzeR7.avi", lpString2="HOW_RECOVER.html") returned 1 [0104.778] lstrcmpiW (lpString1="liW Cl2VLbSoSiMzeR7.avi", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0104.778] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0104.778] lstrcmpiW (lpString1="liW Cl2VLbSoSiMzeR7.avi", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0104.778] GetProcessHeap () returned 0xd20000 [0104.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42530 [0104.778] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\liW Cl2VLbSoSiMzeR7.avi" (normalized: "c:\\users\\fd1hvy\\videos\\liw cl2vlbsosimzer7.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0104.779] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=91406) returned 1 [0104.779] GetProcessHeap () returned 0xd20000 [0104.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bc38 [0104.779] GetProcessHeap () returned 0xd20000 [0104.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0104.779] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\liW Cl2VLbSoSiMzeR7.avi") returned 46 [0104.779] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0104.779] GetProcessHeap () returned 0xd20000 [0104.780] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0104.780] GetProcessHeap () returned 0xd20000 [0104.780] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4ec80 [0104.780] lstrlenA (lpString="rsa_encrypt") returned 11 [0104.780] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0104.782] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0104.782] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0104.782] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0104.782] GetProcessHeap () returned 0xd20000 [0104.782] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0104.782] lstrlenA (lpString="010001") returned 6 [0104.782] GetProcessHeap () returned 0xd20000 [0104.782] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cdc8 [0104.783] GetProcessHeap () returned 0xd20000 [0104.783] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0104.783] GetProcessHeap () returned 0xd20000 [0104.783] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b488 [0104.783] GetProcessHeap () returned 0xd20000 [0104.783] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0104.783] GetProcessHeap () returned 0xd20000 [0104.783] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b008 [0104.783] GetProcessHeap () returned 0xd20000 [0104.783] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44c68 [0104.783] GetProcessHeap () returned 0xd20000 [0104.783] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ce58 [0104.783] GetProcessHeap () returned 0xd20000 [0104.783] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0104.783] GetProcessHeap () returned 0xd20000 [0104.783] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0104.783] GetProcessHeap () returned 0xd20000 [0104.783] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0104.783] GetProcessHeap () returned 0xd20000 [0104.783] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0104.784] GetProcessHeap () returned 0xd20000 [0104.784] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44920 [0104.784] GetProcessHeap () returned 0xd20000 [0104.784] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0104.784] GetProcessHeap () returned 0xd20000 [0104.784] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44558 [0104.784] GetProcessHeap () returned 0xd20000 [0104.784] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aca8 [0104.784] GetProcessHeap () returned 0xd20000 [0104.784] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0104.784] GetProcessHeap () returned 0xd20000 [0104.784] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0104.784] GetProcessHeap () returned 0xd20000 [0104.784] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aca8 | out: hHeap=0xd20000) returned 1 [0104.784] GetProcessHeap () returned 0xd20000 [0104.784] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0104.784] GetProcessHeap () returned 0xd20000 [0104.784] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446d8 [0104.784] GetProcessHeap () returned 0xd20000 [0104.784] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0104.785] GetProcessHeap () returned 0xd20000 [0104.785] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0104.785] GetProcessHeap () returned 0xd20000 [0104.785] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.785] GetProcessHeap () returned 0xd20000 [0104.785] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.785] GetProcessHeap () returned 0xd20000 [0104.785] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.785] GetProcessHeap () returned 0xd20000 [0104.785] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.785] GetProcessHeap () returned 0xd20000 [0104.785] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b518 [0104.785] GetProcessHeap () returned 0xd20000 [0104.785] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446d8 | out: hHeap=0xd20000) returned 1 [0104.785] GetProcessHeap () returned 0xd20000 [0104.785] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0104.785] GetProcessHeap () returned 0xd20000 [0104.785] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0104.785] GetProcessHeap () returned 0xd20000 [0104.785] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0104.785] GetProcessHeap () returned 0xd20000 [0104.785] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0104.786] GetProcessHeap () returned 0xd20000 [0104.786] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0104.786] GetProcessHeap () returned 0xd20000 [0104.786] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0104.786] GetProcessHeap () returned 0xd20000 [0104.786] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0104.786] GetProcessHeap () returned 0xd20000 [0104.786] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0104.786] GetProcessHeap () returned 0xd20000 [0104.786] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0104.786] GetProcessHeap () returned 0xd20000 [0104.786] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0104.786] GetProcessHeap () returned 0xd20000 [0104.786] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0104.786] GetProcessHeap () returned 0xd20000 [0104.786] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0104.786] GetProcessHeap () returned 0xd20000 [0104.786] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0104.786] GetProcessHeap () returned 0xd20000 [0104.786] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0104.786] GetProcessHeap () returned 0xd20000 [0104.786] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0104.787] GetProcessHeap () returned 0xd20000 [0104.787] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0104.787] GetProcessHeap () returned 0xd20000 [0104.787] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0104.787] GetProcessHeap () returned 0xd20000 [0104.787] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0104.787] GetProcessHeap () returned 0xd20000 [0104.787] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.787] GetProcessHeap () returned 0xd20000 [0104.787] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.787] GetProcessHeap () returned 0xd20000 [0104.787] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0104.787] GetProcessHeap () returned 0xd20000 [0104.787] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0104.787] GetProcessHeap () returned 0xd20000 [0104.787] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.787] GetProcessHeap () returned 0xd20000 [0104.787] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.787] GetProcessHeap () returned 0xd20000 [0104.787] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0104.788] GetProcessHeap () returned 0xd20000 [0104.788] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0104.788] GetProcessHeap () returned 0xd20000 [0104.788] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0104.788] GetProcessHeap () returned 0xd20000 [0104.788] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0104.788] GetProcessHeap () returned 0xd20000 [0104.788] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.788] GetProcessHeap () returned 0xd20000 [0104.788] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.788] GetProcessHeap () returned 0xd20000 [0104.788] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0104.788] GetProcessHeap () returned 0xd20000 [0104.788] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0104.788] GetProcessHeap () returned 0xd20000 [0104.788] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.788] GetProcessHeap () returned 0xd20000 [0104.788] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.788] GetProcessHeap () returned 0xd20000 [0104.788] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0104.788] GetProcessHeap () returned 0xd20000 [0104.788] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0104.788] GetProcessHeap () returned 0xd20000 [0104.789] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0104.789] GetProcessHeap () returned 0xd20000 [0104.789] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0104.789] GetProcessHeap () returned 0xd20000 [0104.789] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.789] GetProcessHeap () returned 0xd20000 [0104.789] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.789] GetProcessHeap () returned 0xd20000 [0104.789] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.789] GetProcessHeap () returned 0xd20000 [0104.789] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.789] GetProcessHeap () returned 0xd20000 [0104.789] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0104.789] GetProcessHeap () returned 0xd20000 [0104.789] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0104.789] GetProcessHeap () returned 0xd20000 [0104.789] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0104.789] GetProcessHeap () returned 0xd20000 [0104.789] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0104.789] GetProcessHeap () returned 0xd20000 [0104.789] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0104.789] GetProcessHeap () returned 0xd20000 [0104.790] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0104.790] GetProcessHeap () returned 0xd20000 [0104.790] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.790] GetProcessHeap () returned 0xd20000 [0104.790] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.790] GetProcessHeap () returned 0xd20000 [0104.790] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0104.790] GetProcessHeap () returned 0xd20000 [0104.790] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0104.790] GetProcessHeap () returned 0xd20000 [0104.790] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.790] GetProcessHeap () returned 0xd20000 [0104.790] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.790] GetProcessHeap () returned 0xd20000 [0104.790] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0104.790] GetProcessHeap () returned 0xd20000 [0104.790] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0104.790] GetProcessHeap () returned 0xd20000 [0104.790] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0104.790] GetProcessHeap () returned 0xd20000 [0104.790] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0104.791] GetProcessHeap () returned 0xd20000 [0104.791] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0104.791] GetProcessHeap () returned 0xd20000 [0104.791] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0104.791] GetProcessHeap () returned 0xd20000 [0104.791] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0104.791] GetProcessHeap () returned 0xd20000 [0104.791] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0104.791] GetProcessHeap () returned 0xd20000 [0104.791] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0104.791] GetProcessHeap () returned 0xd20000 [0104.791] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0104.792] GetProcessHeap () returned 0xd20000 [0104.792] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0104.792] GetProcessHeap () returned 0xd20000 [0104.792] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0104.792] GetProcessHeap () returned 0xd20000 [0104.792] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0104.792] GetProcessHeap () returned 0xd20000 [0104.792] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0104.792] GetProcessHeap () returned 0xd20000 [0104.792] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.792] GetProcessHeap () returned 0xd20000 [0104.792] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.792] GetProcessHeap () returned 0xd20000 [0104.792] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0104.792] GetProcessHeap () returned 0xd20000 [0104.792] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0104.792] GetProcessHeap () returned 0xd20000 [0104.792] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0104.792] GetProcessHeap () returned 0xd20000 [0104.792] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0104.793] GetProcessHeap () returned 0xd20000 [0104.793] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0104.793] GetProcessHeap () returned 0xd20000 [0104.793] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0104.793] GetProcessHeap () returned 0xd20000 [0104.793] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.793] GetProcessHeap () returned 0xd20000 [0104.793] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.793] GetProcessHeap () returned 0xd20000 [0104.793] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.793] GetProcessHeap () returned 0xd20000 [0104.793] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.793] GetProcessHeap () returned 0xd20000 [0104.793] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0104.793] GetProcessHeap () returned 0xd20000 [0104.793] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0104.793] GetProcessHeap () returned 0xd20000 [0104.793] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.793] GetProcessHeap () returned 0xd20000 [0104.793] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.793] GetProcessHeap () returned 0xd20000 [0104.794] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0104.794] GetProcessHeap () returned 0xd20000 [0104.794] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0104.794] GetProcessHeap () returned 0xd20000 [0104.794] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0104.794] GetProcessHeap () returned 0xd20000 [0104.794] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0104.794] GetProcessHeap () returned 0xd20000 [0104.794] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0104.794] GetProcessHeap () returned 0xd20000 [0104.794] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0104.794] GetProcessHeap () returned 0xd20000 [0104.794] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0104.794] GetProcessHeap () returned 0xd20000 [0104.794] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0104.794] GetProcessHeap () returned 0xd20000 [0104.794] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0104.794] GetProcessHeap () returned 0xd20000 [0104.794] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0104.794] GetProcessHeap () returned 0xd20000 [0104.794] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0104.795] GetProcessHeap () returned 0xd20000 [0104.795] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0104.795] GetProcessHeap () returned 0xd20000 [0104.795] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0104.795] GetProcessHeap () returned 0xd20000 [0104.795] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0104.795] GetProcessHeap () returned 0xd20000 [0104.795] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0104.795] GetProcessHeap () returned 0xd20000 [0104.795] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0104.795] GetProcessHeap () returned 0xd20000 [0104.795] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0104.795] GetProcessHeap () returned 0xd20000 [0104.795] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0104.795] GetProcessHeap () returned 0xd20000 [0104.795] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.795] GetProcessHeap () returned 0xd20000 [0104.795] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.795] GetProcessHeap () returned 0xd20000 [0104.796] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0104.796] GetProcessHeap () returned 0xd20000 [0104.796] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0104.796] GetProcessHeap () returned 0xd20000 [0104.796] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0104.796] GetProcessHeap () returned 0xd20000 [0104.796] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0104.796] GetProcessHeap () returned 0xd20000 [0104.796] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0104.796] GetProcessHeap () returned 0xd20000 [0104.796] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0104.796] GetProcessHeap () returned 0xd20000 [0104.796] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0104.796] GetProcessHeap () returned 0xd20000 [0104.796] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0104.796] GetProcessHeap () returned 0xd20000 [0104.796] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0104.796] GetProcessHeap () returned 0xd20000 [0104.796] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0104.796] GetProcessHeap () returned 0xd20000 [0104.797] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0104.797] GetProcessHeap () returned 0xd20000 [0104.797] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0104.797] GetProcessHeap () returned 0xd20000 [0104.797] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0104.797] GetProcessHeap () returned 0xd20000 [0104.797] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0104.797] GetProcessHeap () returned 0xd20000 [0104.797] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0104.797] GetProcessHeap () returned 0xd20000 [0104.797] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0104.797] GetProcessHeap () returned 0xd20000 [0104.797] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0104.797] GetProcessHeap () returned 0xd20000 [0104.797] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0104.797] GetProcessHeap () returned 0xd20000 [0104.797] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.797] GetProcessHeap () returned 0xd20000 [0104.797] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.797] GetProcessHeap () returned 0xd20000 [0104.797] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0104.797] GetProcessHeap () returned 0xd20000 [0104.798] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0104.798] GetProcessHeap () returned 0xd20000 [0104.798] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0104.798] GetProcessHeap () returned 0xd20000 [0104.798] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0104.798] GetProcessHeap () returned 0xd20000 [0104.798] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0104.798] GetProcessHeap () returned 0xd20000 [0104.798] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0104.798] GetProcessHeap () returned 0xd20000 [0104.798] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0104.798] GetProcessHeap () returned 0xd20000 [0104.798] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0104.798] GetProcessHeap () returned 0xd20000 [0104.798] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0104.798] GetProcessHeap () returned 0xd20000 [0104.798] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0104.798] GetProcessHeap () returned 0xd20000 [0104.798] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0104.799] GetProcessHeap () returned 0xd20000 [0104.799] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0104.799] GetProcessHeap () returned 0xd20000 [0104.799] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0104.799] GetProcessHeap () returned 0xd20000 [0104.799] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0104.799] GetProcessHeap () returned 0xd20000 [0104.799] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0104.799] GetProcessHeap () returned 0xd20000 [0104.799] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0104.799] GetProcessHeap () returned 0xd20000 [0104.799] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0104.799] GetProcessHeap () returned 0xd20000 [0104.799] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0104.799] GetProcessHeap () returned 0xd20000 [0104.799] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.799] GetProcessHeap () returned 0xd20000 [0104.799] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.799] GetProcessHeap () returned 0xd20000 [0104.799] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0104.799] GetProcessHeap () returned 0xd20000 [0104.800] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0104.800] GetProcessHeap () returned 0xd20000 [0104.800] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.800] GetProcessHeap () returned 0xd20000 [0104.800] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.800] GetProcessHeap () returned 0xd20000 [0104.800] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0104.800] GetProcessHeap () returned 0xd20000 [0104.800] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0104.800] GetProcessHeap () returned 0xd20000 [0104.800] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.800] GetProcessHeap () returned 0xd20000 [0104.800] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.800] GetProcessHeap () returned 0xd20000 [0104.800] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0104.800] GetProcessHeap () returned 0xd20000 [0104.800] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0104.800] GetProcessHeap () returned 0xd20000 [0104.800] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0104.800] GetProcessHeap () returned 0xd20000 [0104.800] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0104.801] GetProcessHeap () returned 0xd20000 [0104.801] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.801] GetProcessHeap () returned 0xd20000 [0104.801] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.801] GetProcessHeap () returned 0xd20000 [0104.801] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0104.801] GetProcessHeap () returned 0xd20000 [0104.801] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0104.801] GetProcessHeap () returned 0xd20000 [0104.801] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0104.801] GetProcessHeap () returned 0xd20000 [0104.801] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0104.801] GetProcessHeap () returned 0xd20000 [0104.801] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.801] GetProcessHeap () returned 0xd20000 [0104.801] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.801] GetProcessHeap () returned 0xd20000 [0104.801] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.801] GetProcessHeap () returned 0xd20000 [0104.801] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.801] GetProcessHeap () returned 0xd20000 [0104.801] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0104.802] GetProcessHeap () returned 0xd20000 [0104.802] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0104.802] GetProcessHeap () returned 0xd20000 [0104.802] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.802] GetProcessHeap () returned 0xd20000 [0104.802] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.802] GetProcessHeap () returned 0xd20000 [0104.802] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0104.802] GetProcessHeap () returned 0xd20000 [0104.802] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0104.802] GetProcessHeap () returned 0xd20000 [0104.802] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0104.802] GetProcessHeap () returned 0xd20000 [0104.802] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0104.802] GetProcessHeap () returned 0xd20000 [0104.802] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0104.802] GetProcessHeap () returned 0xd20000 [0104.802] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0104.802] GetProcessHeap () returned 0xd20000 [0104.802] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44558 | out: hHeap=0xd20000) returned 1 [0104.803] GetProcessHeap () returned 0xd20000 [0104.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b008 | out: hHeap=0xd20000) returned 1 [0104.803] GetProcessHeap () returned 0xd20000 [0104.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0104.803] GetProcessHeap () returned 0xd20000 [0104.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b488 | out: hHeap=0xd20000) returned 1 [0104.803] GetProcessHeap () returned 0xd20000 [0104.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0104.803] GetProcessHeap () returned 0xd20000 [0104.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0104.803] GetProcessHeap () returned 0xd20000 [0104.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0104.803] WriteFile (in: hFile=0x230, lpBuffer=0xd4ec80*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ec80*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0104.931] GetProcessHeap () returned 0xd20000 [0104.931] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4ec80, Size=0x30) returned 0xd4ec80 [0104.931] GetProcessHeap () returned 0xd20000 [0104.931] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0104.931] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0104.931] GetProcessHeap () returned 0xd20000 [0104.933] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1650e) returned 0xd4ecb8 [0104.935] ReadFile (in: hFile=0x230, lpBuffer=0xd4ecb8, nNumberOfBytesToRead=0x1650e, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4ecb8*, lpNumberOfBytesRead=0x299d7e8*=0x1650e, lpOverlapped=0x0) returned 1 [0104.937] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0104.938] WriteFile (in: hFile=0x230, lpBuffer=0xd4ecb8*, nNumberOfBytesToWrite=0x1650e, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4ecb8*, lpNumberOfBytesWritten=0x299d7e4*=0x1650e, lpOverlapped=0x0) returned 1 [0104.941] GetProcessHeap () returned 0xd20000 [0104.941] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ecb8 | out: hHeap=0xd20000) returned 1 [0104.941] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0104.941] WriteFile (in: hFile=0x230, lpBuffer=0xd4ec80*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ec80*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0104.942] CloseHandle (hObject=0x230) returned 1 [0104.947] GetProcessHeap () returned 0xd20000 [0104.947] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42530 | out: hHeap=0xd20000) returned 1 [0104.947] GetProcessHeap () returned 0xd20000 [0104.947] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bc38 | out: hHeap=0xd20000) returned 1 [0104.947] GetProcessHeap () returned 0xd20000 [0104.947] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0104.947] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\liW Cl2VLbSoSiMzeR7.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\liW Cl2VLbSoSiMzeR7.avi") returned="C:\\Users\\FD1HVy\\Videos\\liW Cl2VLbSoSiMzeR7.avi" [0104.947] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\liW Cl2VLbSoSiMzeR7.avi", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\liW Cl2VLbSoSiMzeR7.avi.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Videos\\liW Cl2VLbSoSiMzeR7.avi.[ponce.lorena@aol.com]" [0104.947] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\liW Cl2VLbSoSiMzeR7.avi" (normalized: "c:\\users\\fd1hvy\\videos\\liw cl2vlbsosimzer7.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\liW Cl2VLbSoSiMzeR7.avi.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\videos\\liw cl2vlbsosimzer7.avi.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0104.948] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\liW Cl2VLbSoSiMzeR7.avi" | out: pszPath="C:\\Users\\FD1HVy\\Videos") returned 1 [0104.948] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\") returned="" [0104.948] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Videos\\HOW_RECOVER.html" [0104.948] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\how_recover.html")) returned 0x20 [0104.948] GetProcessHeap () returned 0xd20000 [0104.948] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd366c8 | out: hHeap=0xd20000) returned 1 [0104.949] FindNextFileW (in: hFindFile=0xd491a0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd36c7a30, ftCreationTime.dwHighDateTime=0x1d4d0a5, ftLastAccessTime.dwLowDateTime=0xa3581c0, ftLastAccessTime.dwHighDateTime=0x1d4c6eb, ftLastWriteTime.dwLowDateTime=0xa3581c0, ftLastWriteTime.dwHighDateTime=0x1d4c6eb, nFileSizeHigh=0x0, nFileSizeLow=0x18ab, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="O-m9Vfd-YR8g.swf", cAlternateFileName="O-M9VF~1.SWF")) returned 1 [0104.949] lstrcmpiW (lpString1="O-m9Vfd-YR8g.swf", lpString2=".") returned 1 [0104.949] lstrcmpiW (lpString1="O-m9Vfd-YR8g.swf", lpString2="..") returned 1 [0104.949] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="O-m9Vfd-YR8g.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\O-m9Vfd-YR8g.swf") returned="C:\\Users\\FD1HVy\\Videos\\O-m9Vfd-YR8g.swf" [0104.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="O-m9Vfd-YR8g.swf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0104.949] GetProcessHeap () returned 0xd20000 [0104.949] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x11) returned 0xd36448 [0104.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="O-m9Vfd-YR8g.swf", cchWideChar=-1, lpMultiByteStr=0xd36448, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="O-m9Vfd-YR8g.swf", lpUsedDefaultChar=0x0) returned 17 [0104.949] lstrlenA (lpString="O-m9Vfd-YR8g.swf") returned 16 [0104.949] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0104.949] lstrlenA (lpString="O-m9Vfd-YR8g.swf") returned 16 [0104.949] lstrlenA (lpString=".dll") returned 4 [0104.949] lstrlenA (lpString=".dll") returned 4 [0104.949] lstrlenA (lpString="O-m9Vfd-YR8g.swf") returned 16 [0104.949] lstrcmpiA (lpString1=".swf", lpString2=".dll") returned 1 [0104.949] lstrlenA (lpString="O-m9Vfd-YR8g.swf") returned 16 [0104.949] lstrlenA (lpString=".ini") returned 4 [0104.949] lstrlenA (lpString=".ini") returned 4 [0104.950] lstrlenA (lpString="O-m9Vfd-YR8g.swf") returned 16 [0104.950] lstrcmpiA (lpString1=".swf", lpString2=".ini") returned 1 [0104.950] lstrlenA (lpString="O-m9Vfd-YR8g.swf") returned 16 [0104.950] lstrlenA (lpString=".inc") returned 4 [0104.950] lstrlenA (lpString=".inc") returned 4 [0104.950] lstrlenA (lpString="O-m9Vfd-YR8g.swf") returned 16 [0104.950] lstrcmpiA (lpString1=".swf", lpString2=".inc") returned 1 [0104.950] lstrcmpiW (lpString1="O-m9Vfd-YR8g.swf", lpString2="HOW_RECOVER.html") returned 1 [0104.950] lstrcmpiW (lpString1="O-m9Vfd-YR8g.swf", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0104.950] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0104.950] lstrcmpiW (lpString1="O-m9Vfd-YR8g.swf", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0104.950] GetProcessHeap () returned 0xd20000 [0104.950] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd428a0 [0104.950] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\O-m9Vfd-YR8g.swf" (normalized: "c:\\users\\fd1hvy\\videos\\o-m9vfd-yr8g.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0104.950] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=6315) returned 1 [0104.951] GetProcessHeap () returned 0xd20000 [0104.951] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4be90 [0104.951] GetProcessHeap () returned 0xd20000 [0104.951] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0104.951] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\O-m9Vfd-YR8g.swf") returned 39 [0104.951] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0104.951] GetProcessHeap () returned 0xd20000 [0104.951] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0104.951] GetProcessHeap () returned 0xd20000 [0104.951] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x385) returned 0xd4ecb8 [0104.951] lstrlenA (lpString="rsa_encrypt") returned 11 [0104.951] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0104.954] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0104.954] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0104.954] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0104.954] GetProcessHeap () returned 0xd20000 [0104.954] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0104.954] lstrlenA (lpString="010001") returned 6 [0104.954] GetProcessHeap () returned 0xd20000 [0104.954] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ce88 [0104.954] GetProcessHeap () returned 0xd20000 [0104.954] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0104.954] GetProcessHeap () returned 0xd20000 [0104.954] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b488 [0104.954] GetProcessHeap () returned 0xd20000 [0104.954] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0104.954] GetProcessHeap () returned 0xd20000 [0104.954] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ac18 [0104.955] GetProcessHeap () returned 0xd20000 [0104.955] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45410 [0104.955] GetProcessHeap () returned 0xd20000 [0104.955] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cdd8 [0104.955] GetProcessHeap () returned 0xd20000 [0104.955] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0104.955] GetProcessHeap () returned 0xd20000 [0104.955] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0104.955] GetProcessHeap () returned 0xd20000 [0104.955] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0104.955] GetProcessHeap () returned 0xd20000 [0104.955] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0104.955] GetProcessHeap () returned 0xd20000 [0104.955] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44fb0 [0104.955] GetProcessHeap () returned 0xd20000 [0104.955] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0104.955] GetProcessHeap () returned 0xd20000 [0104.955] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44570 [0104.955] GetProcessHeap () returned 0xd20000 [0104.955] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b7e8 [0104.956] GetProcessHeap () returned 0xd20000 [0104.956] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0104.956] GetProcessHeap () returned 0xd20000 [0104.956] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0104.956] GetProcessHeap () returned 0xd20000 [0104.956] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0104.956] GetProcessHeap () returned 0xd20000 [0104.956] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0104.956] GetProcessHeap () returned 0xd20000 [0104.956] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44510 [0104.956] GetProcessHeap () returned 0xd20000 [0104.956] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0104.956] GetProcessHeap () returned 0xd20000 [0104.956] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0104.956] GetProcessHeap () returned 0xd20000 [0104.956] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0104.956] GetProcessHeap () returned 0xd20000 [0104.956] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0104.956] GetProcessHeap () returned 0xd20000 [0104.956] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0104.957] GetProcessHeap () returned 0xd20000 [0104.957] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0104.957] GetProcessHeap () returned 0xd20000 [0104.957] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b878 [0104.957] GetProcessHeap () returned 0xd20000 [0104.957] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44510 | out: hHeap=0xd20000) returned 1 [0104.957] GetProcessHeap () returned 0xd20000 [0104.957] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0104.957] GetProcessHeap () returned 0xd20000 [0104.957] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b878 | out: hHeap=0xd20000) returned 1 [0104.957] GetProcessHeap () returned 0xd20000 [0104.957] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.957] GetProcessHeap () returned 0xd20000 [0104.957] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.957] GetProcessHeap () returned 0xd20000 [0104.957] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0104.957] GetProcessHeap () returned 0xd20000 [0104.957] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0104.957] GetProcessHeap () returned 0xd20000 [0104.957] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0104.958] GetProcessHeap () returned 0xd20000 [0104.958] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0104.958] GetProcessHeap () returned 0xd20000 [0104.958] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0104.958] GetProcessHeap () returned 0xd20000 [0104.958] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0104.958] GetProcessHeap () returned 0xd20000 [0104.958] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0104.958] GetProcessHeap () returned 0xd20000 [0104.958] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0104.958] GetProcessHeap () returned 0xd20000 [0104.958] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0104.958] GetProcessHeap () returned 0xd20000 [0104.958] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0104.958] GetProcessHeap () returned 0xd20000 [0104.958] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0104.958] GetProcessHeap () returned 0xd20000 [0104.958] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0104.958] GetProcessHeap () returned 0xd20000 [0104.959] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.959] GetProcessHeap () returned 0xd20000 [0104.959] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.959] GetProcessHeap () returned 0xd20000 [0104.959] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0104.959] GetProcessHeap () returned 0xd20000 [0104.959] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0104.959] GetProcessHeap () returned 0xd20000 [0104.959] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.959] GetProcessHeap () returned 0xd20000 [0104.959] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.959] GetProcessHeap () returned 0xd20000 [0104.959] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0104.959] GetProcessHeap () returned 0xd20000 [0104.959] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0104.959] GetProcessHeap () returned 0xd20000 [0104.959] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0104.959] GetProcessHeap () returned 0xd20000 [0104.959] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0104.960] GetProcessHeap () returned 0xd20000 [0104.960] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0104.960] GetProcessHeap () returned 0xd20000 [0104.960] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0104.960] GetProcessHeap () returned 0xd20000 [0104.960] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0104.960] GetProcessHeap () returned 0xd20000 [0104.960] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0104.960] GetProcessHeap () returned 0xd20000 [0104.960] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0104.960] GetProcessHeap () returned 0xd20000 [0104.960] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0104.960] GetProcessHeap () returned 0xd20000 [0104.960] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.960] GetProcessHeap () returned 0xd20000 [0104.960] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.960] GetProcessHeap () returned 0xd20000 [0104.960] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0104.960] GetProcessHeap () returned 0xd20000 [0104.960] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0104.961] GetProcessHeap () returned 0xd20000 [0104.961] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.961] GetProcessHeap () returned 0xd20000 [0104.961] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.961] GetProcessHeap () returned 0xd20000 [0104.961] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.961] GetProcessHeap () returned 0xd20000 [0104.961] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.961] GetProcessHeap () returned 0xd20000 [0104.961] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.961] GetProcessHeap () returned 0xd20000 [0104.961] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.961] GetProcessHeap () returned 0xd20000 [0104.961] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.961] GetProcessHeap () returned 0xd20000 [0104.961] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.961] GetProcessHeap () returned 0xd20000 [0104.961] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.961] GetProcessHeap () returned 0xd20000 [0104.962] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.962] GetProcessHeap () returned 0xd20000 [0104.962] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0104.962] GetProcessHeap () returned 0xd20000 [0104.962] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0104.962] GetProcessHeap () returned 0xd20000 [0104.962] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0104.962] GetProcessHeap () returned 0xd20000 [0104.962] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0104.962] GetProcessHeap () returned 0xd20000 [0104.962] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0104.962] GetProcessHeap () returned 0xd20000 [0104.962] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0104.962] GetProcessHeap () returned 0xd20000 [0104.962] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.962] GetProcessHeap () returned 0xd20000 [0104.962] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.962] GetProcessHeap () returned 0xd20000 [0104.962] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0104.962] GetProcessHeap () returned 0xd20000 [0104.963] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0104.963] GetProcessHeap () returned 0xd20000 [0104.963] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.963] GetProcessHeap () returned 0xd20000 [0104.964] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.964] GetProcessHeap () returned 0xd20000 [0104.964] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0104.964] GetProcessHeap () returned 0xd20000 [0104.964] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0104.964] GetProcessHeap () returned 0xd20000 [0104.964] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0104.964] GetProcessHeap () returned 0xd20000 [0104.964] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0104.964] GetProcessHeap () returned 0xd20000 [0104.964] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0104.964] GetProcessHeap () returned 0xd20000 [0104.964] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0104.964] GetProcessHeap () returned 0xd20000 [0104.964] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0104.964] GetProcessHeap () returned 0xd20000 [0104.964] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0104.964] GetProcessHeap () returned 0xd20000 [0104.964] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0104.965] GetProcessHeap () returned 0xd20000 [0104.965] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0104.965] GetProcessHeap () returned 0xd20000 [0104.965] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.965] GetProcessHeap () returned 0xd20000 [0104.965] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.965] GetProcessHeap () returned 0xd20000 [0104.965] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0104.965] GetProcessHeap () returned 0xd20000 [0104.965] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0104.965] GetProcessHeap () returned 0xd20000 [0104.965] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0104.965] GetProcessHeap () returned 0xd20000 [0104.965] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0104.965] GetProcessHeap () returned 0xd20000 [0104.965] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.965] GetProcessHeap () returned 0xd20000 [0104.965] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.965] GetProcessHeap () returned 0xd20000 [0104.966] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0104.966] GetProcessHeap () returned 0xd20000 [0104.966] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0104.966] GetProcessHeap () returned 0xd20000 [0104.966] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.966] GetProcessHeap () returned 0xd20000 [0104.966] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.966] GetProcessHeap () returned 0xd20000 [0104.966] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.966] GetProcessHeap () returned 0xd20000 [0104.966] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.966] GetProcessHeap () returned 0xd20000 [0104.966] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.966] GetProcessHeap () returned 0xd20000 [0104.966] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.966] GetProcessHeap () returned 0xd20000 [0104.966] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0104.966] GetProcessHeap () returned 0xd20000 [0104.967] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0104.967] GetProcessHeap () returned 0xd20000 [0104.967] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0104.967] GetProcessHeap () returned 0xd20000 [0104.967] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0104.967] GetProcessHeap () returned 0xd20000 [0104.967] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0104.967] GetProcessHeap () returned 0xd20000 [0104.967] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0104.967] GetProcessHeap () returned 0xd20000 [0104.967] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0104.967] GetProcessHeap () returned 0xd20000 [0104.967] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0104.967] GetProcessHeap () returned 0xd20000 [0104.967] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0104.967] GetProcessHeap () returned 0xd20000 [0104.967] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0104.967] GetProcessHeap () returned 0xd20000 [0104.968] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0104.968] GetProcessHeap () returned 0xd20000 [0104.968] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0104.968] GetProcessHeap () returned 0xd20000 [0104.968] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0104.968] GetProcessHeap () returned 0xd20000 [0104.968] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0104.968] GetProcessHeap () returned 0xd20000 [0104.968] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0104.968] GetProcessHeap () returned 0xd20000 [0104.968] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0104.968] GetProcessHeap () returned 0xd20000 [0104.968] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.968] GetProcessHeap () returned 0xd20000 [0104.968] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.968] GetProcessHeap () returned 0xd20000 [0104.968] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0104.968] GetProcessHeap () returned 0xd20000 [0104.968] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0104.969] GetProcessHeap () returned 0xd20000 [0104.969] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0104.969] GetProcessHeap () returned 0xd20000 [0104.969] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0104.969] GetProcessHeap () returned 0xd20000 [0104.969] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0104.969] GetProcessHeap () returned 0xd20000 [0104.969] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0104.969] GetProcessHeap () returned 0xd20000 [0104.969] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0104.969] GetProcessHeap () returned 0xd20000 [0104.969] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0104.969] GetProcessHeap () returned 0xd20000 [0104.969] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.969] GetProcessHeap () returned 0xd20000 [0104.969] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.969] GetProcessHeap () returned 0xd20000 [0104.969] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0104.970] GetProcessHeap () returned 0xd20000 [0104.970] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0104.970] GetProcessHeap () returned 0xd20000 [0104.970] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0104.970] GetProcessHeap () returned 0xd20000 [0104.970] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0104.970] GetProcessHeap () returned 0xd20000 [0104.970] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0104.970] GetProcessHeap () returned 0xd20000 [0104.970] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0104.970] GetProcessHeap () returned 0xd20000 [0104.970] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0104.970] GetProcessHeap () returned 0xd20000 [0104.970] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0104.970] GetProcessHeap () returned 0xd20000 [0104.970] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0104.970] GetProcessHeap () returned 0xd20000 [0104.971] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0104.971] GetProcessHeap () returned 0xd20000 [0104.971] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0104.971] GetProcessHeap () returned 0xd20000 [0104.971] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0104.971] GetProcessHeap () returned 0xd20000 [0104.971] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0104.971] GetProcessHeap () returned 0xd20000 [0104.971] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0104.971] GetProcessHeap () returned 0xd20000 [0104.971] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0104.971] GetProcessHeap () returned 0xd20000 [0104.971] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0104.971] GetProcessHeap () returned 0xd20000 [0104.971] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0104.971] GetProcessHeap () returned 0xd20000 [0104.971] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0104.971] GetProcessHeap () returned 0xd20000 [0104.971] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.972] GetProcessHeap () returned 0xd20000 [0104.972] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.972] GetProcessHeap () returned 0xd20000 [0104.972] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0104.972] GetProcessHeap () returned 0xd20000 [0104.972] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0104.972] GetProcessHeap () returned 0xd20000 [0104.972] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.972] GetProcessHeap () returned 0xd20000 [0104.972] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.972] GetProcessHeap () returned 0xd20000 [0104.972] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0104.972] GetProcessHeap () returned 0xd20000 [0104.972] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0104.972] GetProcessHeap () returned 0xd20000 [0104.972] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0104.972] GetProcessHeap () returned 0xd20000 [0104.972] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0104.972] GetProcessHeap () returned 0xd20000 [0104.973] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0104.973] GetProcessHeap () returned 0xd20000 [0104.973] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0104.973] GetProcessHeap () returned 0xd20000 [0104.973] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0104.973] GetProcessHeap () returned 0xd20000 [0104.973] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0104.973] GetProcessHeap () returned 0xd20000 [0104.973] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0104.973] GetProcessHeap () returned 0xd20000 [0104.973] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0104.973] GetProcessHeap () returned 0xd20000 [0104.973] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.973] GetProcessHeap () returned 0xd20000 [0104.973] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.973] GetProcessHeap () returned 0xd20000 [0104.973] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0104.973] GetProcessHeap () returned 0xd20000 [0104.973] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0104.973] GetProcessHeap () returned 0xd20000 [0104.974] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0104.974] GetProcessHeap () returned 0xd20000 [0104.974] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0104.974] GetProcessHeap () returned 0xd20000 [0104.974] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0104.974] GetProcessHeap () returned 0xd20000 [0104.974] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0104.974] GetProcessHeap () returned 0xd20000 [0104.974] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.974] GetProcessHeap () returned 0xd20000 [0104.974] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.974] GetProcessHeap () returned 0xd20000 [0104.974] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0104.974] GetProcessHeap () returned 0xd20000 [0104.974] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0104.974] GetProcessHeap () returned 0xd20000 [0104.974] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0104.974] GetProcessHeap () returned 0xd20000 [0104.974] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0104.975] GetProcessHeap () returned 0xd20000 [0104.975] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0104.975] GetProcessHeap () returned 0xd20000 [0104.975] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0104.975] GetProcessHeap () returned 0xd20000 [0104.975] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0104.975] GetProcessHeap () returned 0xd20000 [0104.975] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0104.975] GetProcessHeap () returned 0xd20000 [0104.975] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0104.975] GetProcessHeap () returned 0xd20000 [0104.975] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0104.975] GetProcessHeap () returned 0xd20000 [0104.975] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0104.975] GetProcessHeap () returned 0xd20000 [0104.975] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0104.975] GetProcessHeap () returned 0xd20000 [0104.975] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0104.975] GetProcessHeap () returned 0xd20000 [0104.976] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0104.976] GetProcessHeap () returned 0xd20000 [0104.976] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0104.976] GetProcessHeap () returned 0xd20000 [0104.976] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0104.976] GetProcessHeap () returned 0xd20000 [0104.976] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0104.976] GetProcessHeap () returned 0xd20000 [0104.976] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0104.976] GetProcessHeap () returned 0xd20000 [0104.976] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0104.976] GetProcessHeap () returned 0xd20000 [0104.976] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0104.976] GetProcessHeap () returned 0xd20000 [0104.976] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44570 | out: hHeap=0xd20000) returned 1 [0104.976] GetProcessHeap () returned 0xd20000 [0104.976] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ac18 | out: hHeap=0xd20000) returned 1 [0104.976] GetProcessHeap () returned 0xd20000 [0104.977] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0104.977] GetProcessHeap () returned 0xd20000 [0104.977] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b488 | out: hHeap=0xd20000) returned 1 [0104.977] GetProcessHeap () returned 0xd20000 [0104.977] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0104.977] GetProcessHeap () returned 0xd20000 [0104.977] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0104.977] GetProcessHeap () returned 0xd20000 [0104.977] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0104.977] WriteFile (in: hFile=0x230, lpBuffer=0xd4ecb8*, nNumberOfBytesToWrite=0x385, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ecb8*, lpNumberOfBytesWritten=0x299d864*=0x385, lpOverlapped=0x0) returned 1 [0104.980] GetProcessHeap () returned 0xd20000 [0104.980] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4ecb8, Size=0x30) returned 0xd4ecb8 [0104.980] GetProcessHeap () returned 0xd20000 [0104.980] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0104.980] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0104.980] GetProcessHeap () returned 0xd20000 [0104.980] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x18b0) returned 0xd4ecf0 [0104.980] ReadFile (in: hFile=0x230, lpBuffer=0xd4ecf0, nNumberOfBytesToRead=0x18b0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4ecf0*, lpNumberOfBytesRead=0x299d7e8*=0x18b0, lpOverlapped=0x0) returned 1 [0104.980] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0104.981] WriteFile (in: hFile=0x230, lpBuffer=0xd4ecf0*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4ecf0*, lpNumberOfBytesWritten=0x299d7e4*=0x18b0, lpOverlapped=0x0) returned 1 [0104.982] GetProcessHeap () returned 0xd20000 [0104.982] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ecf0 | out: hHeap=0xd20000) returned 1 [0104.982] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0104.982] WriteFile (in: hFile=0x230, lpBuffer=0xd4ecb8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ecb8*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0104.984] CloseHandle (hObject=0x230) returned 1 [0104.987] GetProcessHeap () returned 0xd20000 [0104.987] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd428a0 | out: hHeap=0xd20000) returned 1 [0104.987] GetProcessHeap () returned 0xd20000 [0104.987] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4be90 | out: hHeap=0xd20000) returned 1 [0104.987] GetProcessHeap () returned 0xd20000 [0104.987] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0104.987] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\O-m9Vfd-YR8g.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\O-m9Vfd-YR8g.swf") returned="C:\\Users\\FD1HVy\\Videos\\O-m9Vfd-YR8g.swf" [0104.987] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\O-m9Vfd-YR8g.swf", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\O-m9Vfd-YR8g.swf.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Videos\\O-m9Vfd-YR8g.swf.[ponce.lorena@aol.com]" [0104.988] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\O-m9Vfd-YR8g.swf" (normalized: "c:\\users\\fd1hvy\\videos\\o-m9vfd-yr8g.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\O-m9Vfd-YR8g.swf.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\videos\\o-m9vfd-yr8g.swf.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0104.988] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\O-m9Vfd-YR8g.swf" | out: pszPath="C:\\Users\\FD1HVy\\Videos") returned 1 [0104.989] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\") returned="" [0104.989] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Videos\\HOW_RECOVER.html" [0104.989] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\how_recover.html")) returned 0x20 [0104.989] GetProcessHeap () returned 0xd20000 [0104.989] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36448 | out: hHeap=0xd20000) returned 1 [0104.989] FindNextFileW (in: hFindFile=0xd491a0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7617b80, ftCreationTime.dwHighDateTime=0x1d4cc5a, ftLastAccessTime.dwLowDateTime=0xd284ae20, ftLastAccessTime.dwHighDateTime=0x1d4c624, ftLastWriteTime.dwLowDateTime=0xd284ae20, ftLastWriteTime.dwHighDateTime=0x1d4c624, nFileSizeHigh=0x0, nFileSizeLow=0xd47e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qAZu4X_.avi", cAlternateFileName="")) returned 1 [0104.991] lstrcmpiW (lpString1="qAZu4X_.avi", lpString2=".") returned 1 [0104.991] lstrcmpiW (lpString1="qAZu4X_.avi", lpString2="..") returned 1 [0104.991] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="qAZu4X_.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\qAZu4X_.avi") returned="C:\\Users\\FD1HVy\\Videos\\qAZu4X_.avi" [0104.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="qAZu4X_.avi", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0104.991] GetProcessHeap () returned 0xd20000 [0104.991] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd44690 [0104.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="qAZu4X_.avi", cchWideChar=-1, lpMultiByteStr=0xd44690, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="qAZu4X_.avi", lpUsedDefaultChar=0x0) returned 12 [0104.991] lstrlenA (lpString="qAZu4X_.avi") returned 11 [0104.991] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0104.991] lstrlenA (lpString="qAZu4X_.avi") returned 11 [0104.991] lstrlenA (lpString=".dll") returned 4 [0104.991] lstrlenA (lpString=".dll") returned 4 [0104.991] lstrlenA (lpString="qAZu4X_.avi") returned 11 [0104.991] lstrcmpiA (lpString1=".avi", lpString2=".dll") returned -1 [0104.992] lstrlenA (lpString="qAZu4X_.avi") returned 11 [0104.992] lstrlenA (lpString=".ini") returned 4 [0104.992] lstrlenA (lpString=".ini") returned 4 [0104.992] lstrlenA (lpString="qAZu4X_.avi") returned 11 [0104.992] lstrcmpiA (lpString1=".avi", lpString2=".ini") returned -1 [0104.993] lstrlenA (lpString="qAZu4X_.avi") returned 11 [0104.993] lstrlenA (lpString=".inc") returned 4 [0104.993] lstrlenA (lpString=".inc") returned 4 [0104.993] lstrlenA (lpString="qAZu4X_.avi") returned 11 [0104.993] lstrcmpiA (lpString1=".avi", lpString2=".inc") returned -1 [0104.993] lstrcmpiW (lpString1="qAZu4X_.avi", lpString2="HOW_RECOVER.html") returned 1 [0104.993] lstrcmpiW (lpString1="qAZu4X_.avi", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0104.993] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0104.993] lstrcmpiW (lpString1="qAZu4X_.avi", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0104.993] GetProcessHeap () returned 0xd20000 [0104.993] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42620 [0104.994] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\qAZu4X_.avi" (normalized: "c:\\users\\fd1hvy\\videos\\qazu4x_.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0104.994] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=54398) returned 1 [0104.995] GetProcessHeap () returned 0xd20000 [0104.995] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bbc0 [0104.995] GetProcessHeap () returned 0xd20000 [0104.995] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0104.995] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\qAZu4X_.avi") returned 34 [0104.995] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0104.995] GetProcessHeap () returned 0xd20000 [0104.995] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0104.995] GetProcessHeap () returned 0xd20000 [0104.995] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x382) returned 0xd4ecf0 [0104.995] lstrlenA (lpString="rsa_encrypt") returned 11 [0104.996] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0104.998] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0104.998] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0104.998] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0104.998] GetProcessHeap () returned 0xd20000 [0104.998] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0104.998] lstrlenA (lpString="010001") returned 6 [0104.998] GetProcessHeap () returned 0xd20000 [0104.998] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ce28 [0104.998] GetProcessHeap () returned 0xd20000 [0104.998] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0104.998] GetProcessHeap () returned 0xd20000 [0104.998] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0104.998] GetProcessHeap () returned 0xd20000 [0104.998] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0104.998] GetProcessHeap () returned 0xd20000 [0104.998] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aaf8 [0104.998] GetProcessHeap () returned 0xd20000 [0104.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44b50 [0104.999] GetProcessHeap () returned 0xd20000 [0104.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cec8 [0104.999] GetProcessHeap () returned 0xd20000 [0104.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0104.999] GetProcessHeap () returned 0xd20000 [0104.999] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0104.999] GetProcessHeap () returned 0xd20000 [0104.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0104.999] GetProcessHeap () returned 0xd20000 [0104.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0104.999] GetProcessHeap () returned 0xd20000 [0104.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44a38 [0104.999] GetProcessHeap () returned 0xd20000 [0104.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0104.999] GetProcessHeap () returned 0xd20000 [0104.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445a0 [0104.999] GetProcessHeap () returned 0xd20000 [0104.999] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b098 [0104.999] GetProcessHeap () returned 0xd20000 [0104.999] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0105.000] GetProcessHeap () returned 0xd20000 [0105.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0105.000] GetProcessHeap () returned 0xd20000 [0105.000] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b098 | out: hHeap=0xd20000) returned 1 [0105.000] GetProcessHeap () returned 0xd20000 [0105.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0105.000] GetProcessHeap () returned 0xd20000 [0105.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446a8 [0105.000] GetProcessHeap () returned 0xd20000 [0105.000] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0105.000] GetProcessHeap () returned 0xd20000 [0105.000] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0105.000] GetProcessHeap () returned 0xd20000 [0105.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0105.000] GetProcessHeap () returned 0xd20000 [0105.000] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0105.000] GetProcessHeap () returned 0xd20000 [0105.000] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0105.000] GetProcessHeap () returned 0xd20000 [0105.000] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0105.001] GetProcessHeap () returned 0xd20000 [0105.001] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b5a8 [0105.001] GetProcessHeap () returned 0xd20000 [0105.001] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446a8 | out: hHeap=0xd20000) returned 1 [0105.001] GetProcessHeap () returned 0xd20000 [0105.001] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0105.001] GetProcessHeap () returned 0xd20000 [0105.001] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b5a8 | out: hHeap=0xd20000) returned 1 [0105.001] GetProcessHeap () returned 0xd20000 [0105.001] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.001] GetProcessHeap () returned 0xd20000 [0105.001] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.001] GetProcessHeap () returned 0xd20000 [0105.001] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0105.001] GetProcessHeap () returned 0xd20000 [0105.001] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0105.001] GetProcessHeap () returned 0xd20000 [0105.001] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.001] GetProcessHeap () returned 0xd20000 [0105.001] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.001] GetProcessHeap () returned 0xd20000 [0105.001] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0105.002] GetProcessHeap () returned 0xd20000 [0105.002] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0105.002] GetProcessHeap () returned 0xd20000 [0105.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0105.002] GetProcessHeap () returned 0xd20000 [0105.002] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0105.002] GetProcessHeap () returned 0xd20000 [0105.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.002] GetProcessHeap () returned 0xd20000 [0105.002] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.002] GetProcessHeap () returned 0xd20000 [0105.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.002] GetProcessHeap () returned 0xd20000 [0105.002] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.002] GetProcessHeap () returned 0xd20000 [0105.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.002] GetProcessHeap () returned 0xd20000 [0105.002] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.002] GetProcessHeap () returned 0xd20000 [0105.002] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0105.002] GetProcessHeap () returned 0xd20000 [0105.003] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0105.003] GetProcessHeap () returned 0xd20000 [0105.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0105.003] GetProcessHeap () returned 0xd20000 [0105.003] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0105.003] GetProcessHeap () returned 0xd20000 [0105.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.003] GetProcessHeap () returned 0xd20000 [0105.003] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.003] GetProcessHeap () returned 0xd20000 [0105.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0105.003] GetProcessHeap () returned 0xd20000 [0105.003] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0105.003] GetProcessHeap () returned 0xd20000 [0105.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0105.003] GetProcessHeap () returned 0xd20000 [0105.003] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0105.003] GetProcessHeap () returned 0xd20000 [0105.003] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0105.003] GetProcessHeap () returned 0xd20000 [0105.004] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0105.004] GetProcessHeap () returned 0xd20000 [0105.004] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0105.004] GetProcessHeap () returned 0xd20000 [0105.004] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0105.004] GetProcessHeap () returned 0xd20000 [0105.004] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0105.004] GetProcessHeap () returned 0xd20000 [0105.004] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0105.004] GetProcessHeap () returned 0xd20000 [0105.004] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0105.004] GetProcessHeap () returned 0xd20000 [0105.004] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0105.004] GetProcessHeap () returned 0xd20000 [0105.004] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0105.004] GetProcessHeap () returned 0xd20000 [0105.004] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0105.004] GetProcessHeap () returned 0xd20000 [0105.004] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0105.004] GetProcessHeap () returned 0xd20000 [0105.004] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0105.004] GetProcessHeap () returned 0xd20000 [0105.082] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0105.082] GetProcessHeap () returned 0xd20000 [0105.082] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0105.082] GetProcessHeap () returned 0xd20000 [0105.082] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0105.082] GetProcessHeap () returned 0xd20000 [0105.082] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0105.082] GetProcessHeap () returned 0xd20000 [0105.082] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.082] GetProcessHeap () returned 0xd20000 [0105.082] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.082] GetProcessHeap () returned 0xd20000 [0105.082] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0105.082] GetProcessHeap () returned 0xd20000 [0105.082] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0105.082] GetProcessHeap () returned 0xd20000 [0105.082] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0105.082] GetProcessHeap () returned 0xd20000 [0105.082] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0105.083] GetProcessHeap () returned 0xd20000 [0105.083] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0105.083] GetProcessHeap () returned 0xd20000 [0105.083] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0105.083] GetProcessHeap () returned 0xd20000 [0105.083] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0105.083] GetProcessHeap () returned 0xd20000 [0105.083] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0105.083] GetProcessHeap () returned 0xd20000 [0105.083] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0105.083] GetProcessHeap () returned 0xd20000 [0105.083] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0105.083] GetProcessHeap () returned 0xd20000 [0105.083] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0105.083] GetProcessHeap () returned 0xd20000 [0105.083] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0105.083] GetProcessHeap () returned 0xd20000 [0105.084] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0105.084] GetProcessHeap () returned 0xd20000 [0105.084] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0105.084] GetProcessHeap () returned 0xd20000 [0105.084] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0105.084] GetProcessHeap () returned 0xd20000 [0105.084] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0105.084] GetProcessHeap () returned 0xd20000 [0105.084] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0105.084] GetProcessHeap () returned 0xd20000 [0105.084] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0105.084] GetProcessHeap () returned 0xd20000 [0105.084] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0105.084] GetProcessHeap () returned 0xd20000 [0105.084] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0105.084] GetProcessHeap () returned 0xd20000 [0105.084] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.084] GetProcessHeap () returned 0xd20000 [0105.084] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.085] GetProcessHeap () returned 0xd20000 [0105.085] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0105.085] GetProcessHeap () returned 0xd20000 [0105.085] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0105.085] GetProcessHeap () returned 0xd20000 [0105.085] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0105.085] GetProcessHeap () returned 0xd20000 [0105.085] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0105.085] GetProcessHeap () returned 0xd20000 [0105.085] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0105.085] GetProcessHeap () returned 0xd20000 [0105.085] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0105.085] GetProcessHeap () returned 0xd20000 [0105.085] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.085] GetProcessHeap () returned 0xd20000 [0105.085] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.085] GetProcessHeap () returned 0xd20000 [0105.085] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0105.085] GetProcessHeap () returned 0xd20000 [0105.086] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0105.086] GetProcessHeap () returned 0xd20000 [0105.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.086] GetProcessHeap () returned 0xd20000 [0105.086] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.086] GetProcessHeap () returned 0xd20000 [0105.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.086] GetProcessHeap () returned 0xd20000 [0105.086] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.086] GetProcessHeap () returned 0xd20000 [0105.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0105.086] GetProcessHeap () returned 0xd20000 [0105.086] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0105.086] GetProcessHeap () returned 0xd20000 [0105.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0105.086] GetProcessHeap () returned 0xd20000 [0105.086] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0105.086] GetProcessHeap () returned 0xd20000 [0105.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0105.087] GetProcessHeap () returned 0xd20000 [0105.087] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0105.087] GetProcessHeap () returned 0xd20000 [0105.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0105.087] GetProcessHeap () returned 0xd20000 [0105.087] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0105.087] GetProcessHeap () returned 0xd20000 [0105.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0105.087] GetProcessHeap () returned 0xd20000 [0105.087] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0105.087] GetProcessHeap () returned 0xd20000 [0105.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0105.087] GetProcessHeap () returned 0xd20000 [0105.087] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0105.087] GetProcessHeap () returned 0xd20000 [0105.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0105.087] GetProcessHeap () returned 0xd20000 [0105.087] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0105.088] GetProcessHeap () returned 0xd20000 [0105.088] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0105.088] GetProcessHeap () returned 0xd20000 [0105.088] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0105.088] GetProcessHeap () returned 0xd20000 [0105.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.089] GetProcessHeap () returned 0xd20000 [0105.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.089] GetProcessHeap () returned 0xd20000 [0105.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0105.089] GetProcessHeap () returned 0xd20000 [0105.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0105.089] GetProcessHeap () returned 0xd20000 [0105.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0105.089] GetProcessHeap () returned 0xd20000 [0105.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0105.089] GetProcessHeap () returned 0xd20000 [0105.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0105.089] GetProcessHeap () returned 0xd20000 [0105.089] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0105.089] GetProcessHeap () returned 0xd20000 [0105.089] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0105.089] GetProcessHeap () returned 0xd20000 [0105.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0105.090] GetProcessHeap () returned 0xd20000 [0105.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0105.090] GetProcessHeap () returned 0xd20000 [0105.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0105.090] GetProcessHeap () returned 0xd20000 [0105.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0105.090] GetProcessHeap () returned 0xd20000 [0105.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0105.090] GetProcessHeap () returned 0xd20000 [0105.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.090] GetProcessHeap () returned 0xd20000 [0105.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.090] GetProcessHeap () returned 0xd20000 [0105.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.090] GetProcessHeap () returned 0xd20000 [0105.090] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.090] GetProcessHeap () returned 0xd20000 [0105.090] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0105.090] GetProcessHeap () returned 0xd20000 [0105.091] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0105.091] GetProcessHeap () returned 0xd20000 [0105.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0105.091] GetProcessHeap () returned 0xd20000 [0105.091] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0105.091] GetProcessHeap () returned 0xd20000 [0105.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0105.091] GetProcessHeap () returned 0xd20000 [0105.091] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0105.091] GetProcessHeap () returned 0xd20000 [0105.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.091] GetProcessHeap () returned 0xd20000 [0105.091] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.091] GetProcessHeap () returned 0xd20000 [0105.091] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0105.091] GetProcessHeap () returned 0xd20000 [0105.091] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0105.091] GetProcessHeap () returned 0xd20000 [0105.092] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0105.092] GetProcessHeap () returned 0xd20000 [0105.092] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0105.092] GetProcessHeap () returned 0xd20000 [0105.092] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.092] GetProcessHeap () returned 0xd20000 [0105.092] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.092] GetProcessHeap () returned 0xd20000 [0105.092] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0105.092] GetProcessHeap () returned 0xd20000 [0105.092] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0105.092] GetProcessHeap () returned 0xd20000 [0105.092] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.092] GetProcessHeap () returned 0xd20000 [0105.092] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.092] GetProcessHeap () returned 0xd20000 [0105.092] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0105.092] GetProcessHeap () returned 0xd20000 [0105.093] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0105.093] GetProcessHeap () returned 0xd20000 [0105.093] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0105.093] GetProcessHeap () returned 0xd20000 [0105.093] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0105.093] GetProcessHeap () returned 0xd20000 [0105.093] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0105.093] GetProcessHeap () returned 0xd20000 [0105.093] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0105.093] GetProcessHeap () returned 0xd20000 [0105.093] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0105.093] GetProcessHeap () returned 0xd20000 [0105.093] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0105.093] GetProcessHeap () returned 0xd20000 [0105.093] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0105.093] GetProcessHeap () returned 0xd20000 [0105.093] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0105.093] GetProcessHeap () returned 0xd20000 [0105.093] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0105.094] GetProcessHeap () returned 0xd20000 [0105.094] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0105.094] GetProcessHeap () returned 0xd20000 [0105.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.094] GetProcessHeap () returned 0xd20000 [0105.094] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.094] GetProcessHeap () returned 0xd20000 [0105.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0105.094] GetProcessHeap () returned 0xd20000 [0105.094] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0105.094] GetProcessHeap () returned 0xd20000 [0105.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0105.094] GetProcessHeap () returned 0xd20000 [0105.094] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0105.094] GetProcessHeap () returned 0xd20000 [0105.094] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0105.094] GetProcessHeap () returned 0xd20000 [0105.094] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0105.095] GetProcessHeap () returned 0xd20000 [0105.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0105.095] GetProcessHeap () returned 0xd20000 [0105.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0105.095] GetProcessHeap () returned 0xd20000 [0105.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0105.095] GetProcessHeap () returned 0xd20000 [0105.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0105.095] GetProcessHeap () returned 0xd20000 [0105.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0105.095] GetProcessHeap () returned 0xd20000 [0105.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0105.095] GetProcessHeap () returned 0xd20000 [0105.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.095] GetProcessHeap () returned 0xd20000 [0105.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.095] GetProcessHeap () returned 0xd20000 [0105.095] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0105.095] GetProcessHeap () returned 0xd20000 [0105.095] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0105.096] GetProcessHeap () returned 0xd20000 [0105.096] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0105.096] GetProcessHeap () returned 0xd20000 [0105.096] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0105.096] GetProcessHeap () returned 0xd20000 [0105.096] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0105.096] GetProcessHeap () returned 0xd20000 [0105.096] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0105.096] GetProcessHeap () returned 0xd20000 [0105.096] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0105.096] GetProcessHeap () returned 0xd20000 [0105.096] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0105.096] GetProcessHeap () returned 0xd20000 [0105.096] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0105.096] GetProcessHeap () returned 0xd20000 [0105.096] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0105.096] GetProcessHeap () returned 0xd20000 [0105.096] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0105.097] GetProcessHeap () returned 0xd20000 [0105.097] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0105.097] GetProcessHeap () returned 0xd20000 [0105.097] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0105.097] GetProcessHeap () returned 0xd20000 [0105.097] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0105.097] GetProcessHeap () returned 0xd20000 [0105.097] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445a0 | out: hHeap=0xd20000) returned 1 [0105.097] GetProcessHeap () returned 0xd20000 [0105.097] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aaf8 | out: hHeap=0xd20000) returned 1 [0105.097] GetProcessHeap () returned 0xd20000 [0105.097] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0105.097] GetProcessHeap () returned 0xd20000 [0105.097] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0105.097] GetProcessHeap () returned 0xd20000 [0105.097] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0105.097] GetProcessHeap () returned 0xd20000 [0105.097] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0105.098] GetProcessHeap () returned 0xd20000 [0105.098] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0105.098] WriteFile (in: hFile=0x230, lpBuffer=0xd4ecf0*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ecf0*, lpNumberOfBytesWritten=0x299d864*=0x382, lpOverlapped=0x0) returned 1 [0105.101] GetProcessHeap () returned 0xd20000 [0105.101] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4ecf0, Size=0x30) returned 0xd4ecf0 [0105.101] GetProcessHeap () returned 0xd20000 [0105.101] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0105.101] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0105.101] GetProcessHeap () returned 0xd20000 [0105.101] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xd480) returned 0xd4ed28 [0105.101] ReadFile (in: hFile=0x230, lpBuffer=0xd4ed28, nNumberOfBytesToRead=0xd480, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4ed28*, lpNumberOfBytesRead=0x299d7e8*=0xd480, lpOverlapped=0x0) returned 1 [0105.103] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0105.103] WriteFile (in: hFile=0x230, lpBuffer=0xd4ed28*, nNumberOfBytesToWrite=0xd480, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4ed28*, lpNumberOfBytesWritten=0x299d7e4*=0xd480, lpOverlapped=0x0) returned 1 [0105.105] GetProcessHeap () returned 0xd20000 [0105.105] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ed28 | out: hHeap=0xd20000) returned 1 [0105.105] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0105.106] WriteFile (in: hFile=0x230, lpBuffer=0xd4ecf0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ecf0*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0105.107] CloseHandle (hObject=0x230) returned 1 [0105.112] GetProcessHeap () returned 0xd20000 [0105.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42620 | out: hHeap=0xd20000) returned 1 [0105.112] GetProcessHeap () returned 0xd20000 [0105.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bbc0 | out: hHeap=0xd20000) returned 1 [0105.112] GetProcessHeap () returned 0xd20000 [0105.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0105.112] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\qAZu4X_.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\qAZu4X_.avi") returned="C:\\Users\\FD1HVy\\Videos\\qAZu4X_.avi" [0105.112] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\qAZu4X_.avi", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\qAZu4X_.avi.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Videos\\qAZu4X_.avi.[ponce.lorena@aol.com]" [0105.112] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\qAZu4X_.avi" (normalized: "c:\\users\\fd1hvy\\videos\\qazu4x_.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\qAZu4X_.avi.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\videos\\qazu4x_.avi.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0105.113] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\qAZu4X_.avi" | out: pszPath="C:\\Users\\FD1HVy\\Videos") returned 1 [0105.113] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\") returned="" [0105.113] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Videos\\HOW_RECOVER.html" [0105.113] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\how_recover.html")) returned 0x20 [0105.113] GetProcessHeap () returned 0xd20000 [0105.113] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44690 | out: hHeap=0xd20000) returned 1 [0105.113] FindNextFileW (in: hFindFile=0xd491a0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d116600, ftCreationTime.dwHighDateTime=0x1d4c594, ftLastAccessTime.dwLowDateTime=0x994bc930, ftLastAccessTime.dwHighDateTime=0x1d4ccd8, ftLastWriteTime.dwLowDateTime=0x994bc930, ftLastWriteTime.dwHighDateTime=0x1d4ccd8, nFileSizeHigh=0x0, nFileSizeLow=0x156ff, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_OYDR1Tcr.swf", cAlternateFileName="_OYDR1~1.SWF")) returned 1 [0105.113] lstrcmpiW (lpString1="_OYDR1Tcr.swf", lpString2=".") returned 1 [0105.113] lstrcmpiW (lpString1="_OYDR1Tcr.swf", lpString2="..") returned 1 [0105.113] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="_OYDR1Tcr.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\_OYDR1Tcr.swf") returned="C:\\Users\\FD1HVy\\Videos\\_OYDR1Tcr.swf" [0105.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="_OYDR1Tcr.swf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0105.114] GetProcessHeap () returned 0xd20000 [0105.114] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xe) returned 0xd445d0 [0105.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="_OYDR1Tcr.swf", cchWideChar=-1, lpMultiByteStr=0xd445d0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_OYDR1Tcr.swf", lpUsedDefaultChar=0x0) returned 14 [0105.114] lstrlenA (lpString="_OYDR1Tcr.swf") returned 13 [0105.114] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0105.114] lstrlenA (lpString="_OYDR1Tcr.swf") returned 13 [0105.114] lstrlenA (lpString=".dll") returned 4 [0105.114] lstrlenA (lpString=".dll") returned 4 [0105.114] lstrlenA (lpString="_OYDR1Tcr.swf") returned 13 [0105.114] lstrcmpiA (lpString1=".swf", lpString2=".dll") returned 1 [0105.114] lstrlenA (lpString="_OYDR1Tcr.swf") returned 13 [0105.114] lstrlenA (lpString=".ini") returned 4 [0105.114] lstrlenA (lpString=".ini") returned 4 [0105.114] lstrlenA (lpString="_OYDR1Tcr.swf") returned 13 [0105.114] lstrcmpiA (lpString1=".swf", lpString2=".ini") returned 1 [0105.114] lstrlenA (lpString="_OYDR1Tcr.swf") returned 13 [0105.114] lstrlenA (lpString=".inc") returned 4 [0105.115] lstrlenA (lpString=".inc") returned 4 [0105.115] lstrlenA (lpString="_OYDR1Tcr.swf") returned 13 [0105.115] lstrcmpiA (lpString1=".swf", lpString2=".inc") returned 1 [0105.115] lstrcmpiW (lpString1="_OYDR1Tcr.swf", lpString2="HOW_RECOVER.html") returned -1 [0105.115] lstrcmpiW (lpString1="_OYDR1Tcr.swf", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0105.115] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0105.115] lstrcmpiW (lpString1="_OYDR1Tcr.swf", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0105.115] GetProcessHeap () returned 0xd20000 [0105.115] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd428a0 [0105.115] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\_OYDR1Tcr.swf" (normalized: "c:\\users\\fd1hvy\\videos\\_oydr1tcr.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0105.115] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=87807) returned 1 [0105.115] GetProcessHeap () returned 0xd20000 [0105.115] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c1d8 [0105.116] GetProcessHeap () returned 0xd20000 [0105.116] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0105.116] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\_OYDR1Tcr.swf") returned 36 [0105.116] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0105.116] GetProcessHeap () returned 0xd20000 [0105.116] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0105.116] GetProcessHeap () returned 0xd20000 [0105.116] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x381) returned 0xd4ed28 [0105.116] lstrlenA (lpString="rsa_encrypt") returned 11 [0105.116] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0105.119] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0105.119] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0105.119] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0105.119] GetProcessHeap () returned 0xd20000 [0105.120] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0105.120] lstrlenA (lpString="010001") returned 6 [0105.120] GetProcessHeap () returned 0xd20000 [0105.120] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ce08 [0105.120] GetProcessHeap () returned 0xd20000 [0105.120] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0105.120] GetProcessHeap () returned 0xd20000 [0105.120] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aca8 [0105.120] GetProcessHeap () returned 0xd20000 [0105.120] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0105.120] GetProcessHeap () returned 0xd20000 [0105.120] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b878 [0105.120] GetProcessHeap () returned 0xd20000 [0105.120] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45640 [0105.120] GetProcessHeap () returned 0xd20000 [0105.120] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ce48 [0105.120] GetProcessHeap () returned 0xd20000 [0105.121] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0105.121] GetProcessHeap () returned 0xd20000 [0105.121] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0105.121] GetProcessHeap () returned 0xd20000 [0105.121] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0105.121] GetProcessHeap () returned 0xd20000 [0105.121] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0105.121] GetProcessHeap () returned 0xd20000 [0105.121] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44d80 [0105.121] GetProcessHeap () returned 0xd20000 [0105.121] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0105.121] GetProcessHeap () returned 0xd20000 [0105.121] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444f8 [0105.121] GetProcessHeap () returned 0xd20000 [0105.121] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b128 [0105.121] GetProcessHeap () returned 0xd20000 [0105.121] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0105.121] GetProcessHeap () returned 0xd20000 [0105.121] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0105.121] GetProcessHeap () returned 0xd20000 [0105.122] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b128 | out: hHeap=0xd20000) returned 1 [0105.122] GetProcessHeap () returned 0xd20000 [0105.122] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0105.122] GetProcessHeap () returned 0xd20000 [0105.122] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446d8 [0105.122] GetProcessHeap () returned 0xd20000 [0105.122] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0105.122] GetProcessHeap () returned 0xd20000 [0105.122] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0105.122] GetProcessHeap () returned 0xd20000 [0105.122] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0105.122] GetProcessHeap () returned 0xd20000 [0105.122] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0105.122] GetProcessHeap () returned 0xd20000 [0105.122] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0105.122] GetProcessHeap () returned 0xd20000 [0105.122] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0105.122] GetProcessHeap () returned 0xd20000 [0105.122] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b248 [0105.123] GetProcessHeap () returned 0xd20000 [0105.123] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446d8 | out: hHeap=0xd20000) returned 1 [0105.123] GetProcessHeap () returned 0xd20000 [0105.123] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0105.123] GetProcessHeap () returned 0xd20000 [0105.123] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b248 | out: hHeap=0xd20000) returned 1 [0105.123] GetProcessHeap () returned 0xd20000 [0105.123] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0105.123] GetProcessHeap () returned 0xd20000 [0105.123] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0105.123] GetProcessHeap () returned 0xd20000 [0105.123] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.123] GetProcessHeap () returned 0xd20000 [0105.123] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.123] GetProcessHeap () returned 0xd20000 [0105.123] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0105.123] GetProcessHeap () returned 0xd20000 [0105.123] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0105.123] GetProcessHeap () returned 0xd20000 [0105.124] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0105.124] GetProcessHeap () returned 0xd20000 [0105.124] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0105.124] GetProcessHeap () returned 0xd20000 [0105.124] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0105.124] GetProcessHeap () returned 0xd20000 [0105.124] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0105.124] GetProcessHeap () returned 0xd20000 [0105.124] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.124] GetProcessHeap () returned 0xd20000 [0105.124] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.124] GetProcessHeap () returned 0xd20000 [0105.124] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.124] GetProcessHeap () returned 0xd20000 [0105.124] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.124] GetProcessHeap () returned 0xd20000 [0105.124] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.124] GetProcessHeap () returned 0xd20000 [0105.124] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.125] GetProcessHeap () returned 0xd20000 [0105.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0105.125] GetProcessHeap () returned 0xd20000 [0105.125] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0105.125] GetProcessHeap () returned 0xd20000 [0105.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0105.125] GetProcessHeap () returned 0xd20000 [0105.125] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0105.125] GetProcessHeap () returned 0xd20000 [0105.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0105.125] GetProcessHeap () returned 0xd20000 [0105.125] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0105.125] GetProcessHeap () returned 0xd20000 [0105.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0105.125] GetProcessHeap () returned 0xd20000 [0105.125] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0105.125] GetProcessHeap () returned 0xd20000 [0105.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0105.126] GetProcessHeap () returned 0xd20000 [0105.126] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0105.126] GetProcessHeap () returned 0xd20000 [0105.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0105.126] GetProcessHeap () returned 0xd20000 [0105.126] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0105.126] GetProcessHeap () returned 0xd20000 [0105.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0105.126] GetProcessHeap () returned 0xd20000 [0105.126] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0105.126] GetProcessHeap () returned 0xd20000 [0105.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0105.126] GetProcessHeap () returned 0xd20000 [0105.126] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0105.126] GetProcessHeap () returned 0xd20000 [0105.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.126] GetProcessHeap () returned 0xd20000 [0105.126] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.126] GetProcessHeap () returned 0xd20000 [0105.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0105.127] GetProcessHeap () returned 0xd20000 [0105.127] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0105.127] GetProcessHeap () returned 0xd20000 [0105.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0105.127] GetProcessHeap () returned 0xd20000 [0105.127] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0105.127] GetProcessHeap () returned 0xd20000 [0105.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0105.127] GetProcessHeap () returned 0xd20000 [0105.127] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0105.127] GetProcessHeap () returned 0xd20000 [0105.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0105.127] GetProcessHeap () returned 0xd20000 [0105.127] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0105.127] GetProcessHeap () returned 0xd20000 [0105.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0105.127] GetProcessHeap () returned 0xd20000 [0105.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0105.128] GetProcessHeap () returned 0xd20000 [0105.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.128] GetProcessHeap () returned 0xd20000 [0105.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.128] GetProcessHeap () returned 0xd20000 [0105.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0105.128] GetProcessHeap () returned 0xd20000 [0105.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0105.128] GetProcessHeap () returned 0xd20000 [0105.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.128] GetProcessHeap () returned 0xd20000 [0105.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.128] GetProcessHeap () returned 0xd20000 [0105.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.128] GetProcessHeap () returned 0xd20000 [0105.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.128] GetProcessHeap () returned 0xd20000 [0105.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0105.128] GetProcessHeap () returned 0xd20000 [0105.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0105.129] GetProcessHeap () returned 0xd20000 [0105.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0105.129] GetProcessHeap () returned 0xd20000 [0105.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0105.129] GetProcessHeap () returned 0xd20000 [0105.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0105.129] GetProcessHeap () returned 0xd20000 [0105.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0105.129] GetProcessHeap () returned 0xd20000 [0105.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0105.129] GetProcessHeap () returned 0xd20000 [0105.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0105.129] GetProcessHeap () returned 0xd20000 [0105.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.129] GetProcessHeap () returned 0xd20000 [0105.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.129] GetProcessHeap () returned 0xd20000 [0105.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0105.130] GetProcessHeap () returned 0xd20000 [0105.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0105.130] GetProcessHeap () returned 0xd20000 [0105.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0105.130] GetProcessHeap () returned 0xd20000 [0105.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0105.130] GetProcessHeap () returned 0xd20000 [0105.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0105.130] GetProcessHeap () returned 0xd20000 [0105.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0105.130] GetProcessHeap () returned 0xd20000 [0105.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0105.130] GetProcessHeap () returned 0xd20000 [0105.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0105.130] GetProcessHeap () returned 0xd20000 [0105.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.130] GetProcessHeap () returned 0xd20000 [0105.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.131] GetProcessHeap () returned 0xd20000 [0105.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0105.131] GetProcessHeap () returned 0xd20000 [0105.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0105.131] GetProcessHeap () returned 0xd20000 [0105.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0105.131] GetProcessHeap () returned 0xd20000 [0105.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0105.131] GetProcessHeap () returned 0xd20000 [0105.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0105.131] GetProcessHeap () returned 0xd20000 [0105.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0105.131] GetProcessHeap () returned 0xd20000 [0105.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0105.131] GetProcessHeap () returned 0xd20000 [0105.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0105.131] GetProcessHeap () returned 0xd20000 [0105.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.132] GetProcessHeap () returned 0xd20000 [0105.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.132] GetProcessHeap () returned 0xd20000 [0105.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0105.132] GetProcessHeap () returned 0xd20000 [0105.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0105.132] GetProcessHeap () returned 0xd20000 [0105.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.132] GetProcessHeap () returned 0xd20000 [0105.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.132] GetProcessHeap () returned 0xd20000 [0105.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0105.132] GetProcessHeap () returned 0xd20000 [0105.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0105.132] GetProcessHeap () returned 0xd20000 [0105.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0105.132] GetProcessHeap () returned 0xd20000 [0105.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0105.132] GetProcessHeap () returned 0xd20000 [0105.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.133] GetProcessHeap () returned 0xd20000 [0105.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.133] GetProcessHeap () returned 0xd20000 [0105.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0105.133] GetProcessHeap () returned 0xd20000 [0105.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0105.133] GetProcessHeap () returned 0xd20000 [0105.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0105.133] GetProcessHeap () returned 0xd20000 [0105.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0105.133] GetProcessHeap () returned 0xd20000 [0105.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0105.133] GetProcessHeap () returned 0xd20000 [0105.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0105.133] GetProcessHeap () returned 0xd20000 [0105.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0105.133] GetProcessHeap () returned 0xd20000 [0105.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0105.134] GetProcessHeap () returned 0xd20000 [0105.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.134] GetProcessHeap () returned 0xd20000 [0105.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.134] GetProcessHeap () returned 0xd20000 [0105.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0105.134] GetProcessHeap () returned 0xd20000 [0105.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0105.134] GetProcessHeap () returned 0xd20000 [0105.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.134] GetProcessHeap () returned 0xd20000 [0105.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.134] GetProcessHeap () returned 0xd20000 [0105.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0105.134] GetProcessHeap () returned 0xd20000 [0105.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0105.135] GetProcessHeap () returned 0xd20000 [0105.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0105.135] GetProcessHeap () returned 0xd20000 [0105.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0105.135] GetProcessHeap () returned 0xd20000 [0105.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0105.135] GetProcessHeap () returned 0xd20000 [0105.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0105.135] GetProcessHeap () returned 0xd20000 [0105.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0105.135] GetProcessHeap () returned 0xd20000 [0105.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0105.135] GetProcessHeap () returned 0xd20000 [0105.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0105.135] GetProcessHeap () returned 0xd20000 [0105.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0105.136] GetProcessHeap () returned 0xd20000 [0105.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.136] GetProcessHeap () returned 0xd20000 [0105.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.136] GetProcessHeap () returned 0xd20000 [0105.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0105.136] GetProcessHeap () returned 0xd20000 [0105.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0105.136] GetProcessHeap () returned 0xd20000 [0105.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.136] GetProcessHeap () returned 0xd20000 [0105.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.136] GetProcessHeap () returned 0xd20000 [0105.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0105.136] GetProcessHeap () returned 0xd20000 [0105.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0105.136] GetProcessHeap () returned 0xd20000 [0105.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.137] GetProcessHeap () returned 0xd20000 [0105.137] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.138] GetProcessHeap () returned 0xd20000 [0105.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0105.138] GetProcessHeap () returned 0xd20000 [0105.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0105.138] GetProcessHeap () returned 0xd20000 [0105.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0105.138] GetProcessHeap () returned 0xd20000 [0105.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0105.138] GetProcessHeap () returned 0xd20000 [0105.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0105.138] GetProcessHeap () returned 0xd20000 [0105.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0105.138] GetProcessHeap () returned 0xd20000 [0105.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0105.138] GetProcessHeap () returned 0xd20000 [0105.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0105.138] GetProcessHeap () returned 0xd20000 [0105.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.138] GetProcessHeap () returned 0xd20000 [0105.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.139] GetProcessHeap () returned 0xd20000 [0105.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0105.139] GetProcessHeap () returned 0xd20000 [0105.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0105.139] GetProcessHeap () returned 0xd20000 [0105.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0105.139] GetProcessHeap () returned 0xd20000 [0105.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0105.139] GetProcessHeap () returned 0xd20000 [0105.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0105.139] GetProcessHeap () returned 0xd20000 [0105.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0105.139] GetProcessHeap () returned 0xd20000 [0105.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0105.139] GetProcessHeap () returned 0xd20000 [0105.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0105.139] GetProcessHeap () returned 0xd20000 [0105.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0105.140] GetProcessHeap () returned 0xd20000 [0105.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0105.140] GetProcessHeap () returned 0xd20000 [0105.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0105.140] GetProcessHeap () returned 0xd20000 [0105.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0105.140] GetProcessHeap () returned 0xd20000 [0105.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.140] GetProcessHeap () returned 0xd20000 [0105.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.140] GetProcessHeap () returned 0xd20000 [0105.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0105.140] GetProcessHeap () returned 0xd20000 [0105.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0105.140] GetProcessHeap () returned 0xd20000 [0105.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0105.140] GetProcessHeap () returned 0xd20000 [0105.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0105.140] GetProcessHeap () returned 0xd20000 [0105.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0105.141] GetProcessHeap () returned 0xd20000 [0105.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0105.141] GetProcessHeap () returned 0xd20000 [0105.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0105.141] GetProcessHeap () returned 0xd20000 [0105.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0105.141] GetProcessHeap () returned 0xd20000 [0105.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0105.141] GetProcessHeap () returned 0xd20000 [0105.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0105.141] GetProcessHeap () returned 0xd20000 [0105.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.141] GetProcessHeap () returned 0xd20000 [0105.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.141] GetProcessHeap () returned 0xd20000 [0105.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.141] GetProcessHeap () returned 0xd20000 [0105.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.142] GetProcessHeap () returned 0xd20000 [0105.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.142] GetProcessHeap () returned 0xd20000 [0105.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.142] GetProcessHeap () returned 0xd20000 [0105.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0105.142] GetProcessHeap () returned 0xd20000 [0105.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0105.142] GetProcessHeap () returned 0xd20000 [0105.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0105.142] GetProcessHeap () returned 0xd20000 [0105.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0105.142] GetProcessHeap () returned 0xd20000 [0105.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0105.142] GetProcessHeap () returned 0xd20000 [0105.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0105.142] GetProcessHeap () returned 0xd20000 [0105.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0105.143] GetProcessHeap () returned 0xd20000 [0105.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0105.143] GetProcessHeap () returned 0xd20000 [0105.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444f8 | out: hHeap=0xd20000) returned 1 [0105.143] GetProcessHeap () returned 0xd20000 [0105.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b878 | out: hHeap=0xd20000) returned 1 [0105.143] GetProcessHeap () returned 0xd20000 [0105.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0105.143] GetProcessHeap () returned 0xd20000 [0105.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aca8 | out: hHeap=0xd20000) returned 1 [0105.143] GetProcessHeap () returned 0xd20000 [0105.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0105.143] GetProcessHeap () returned 0xd20000 [0105.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0105.143] GetProcessHeap () returned 0xd20000 [0105.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0105.143] WriteFile (in: hFile=0x230, lpBuffer=0xd4ed28*, nNumberOfBytesToWrite=0x381, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ed28*, lpNumberOfBytesWritten=0x299d864*=0x381, lpOverlapped=0x0) returned 1 [0105.146] GetProcessHeap () returned 0xd20000 [0105.146] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4ed28, Size=0x30) returned 0xd4ed28 [0105.146] GetProcessHeap () returned 0xd20000 [0105.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0105.147] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0105.147] GetProcessHeap () returned 0xd20000 [0105.147] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x15700) returned 0xd4ed60 [0105.147] ReadFile (in: hFile=0x230, lpBuffer=0xd4ed60, nNumberOfBytesToRead=0x15700, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4ed60*, lpNumberOfBytesRead=0x299d7e8*=0x15700, lpOverlapped=0x0) returned 1 [0105.149] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0105.149] WriteFile (in: hFile=0x230, lpBuffer=0xd4ed60*, nNumberOfBytesToWrite=0x15700, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4ed60*, lpNumberOfBytesWritten=0x299d7e4*=0x15700, lpOverlapped=0x0) returned 1 [0105.152] GetProcessHeap () returned 0xd20000 [0105.152] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ed60 | out: hHeap=0xd20000) returned 1 [0105.152] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0105.152] WriteFile (in: hFile=0x230, lpBuffer=0xd4ed28*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ed28*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0105.153] CloseHandle (hObject=0x230) returned 1 [0105.158] GetProcessHeap () returned 0xd20000 [0105.158] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd428a0 | out: hHeap=0xd20000) returned 1 [0105.158] GetProcessHeap () returned 0xd20000 [0105.158] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c1d8 | out: hHeap=0xd20000) returned 1 [0105.158] GetProcessHeap () returned 0xd20000 [0105.158] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0105.158] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\_OYDR1Tcr.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\_OYDR1Tcr.swf") returned="C:\\Users\\FD1HVy\\Videos\\_OYDR1Tcr.swf" [0105.158] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\_OYDR1Tcr.swf", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\_OYDR1Tcr.swf.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Videos\\_OYDR1Tcr.swf.[ponce.lorena@aol.com]" [0105.158] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\_OYDR1Tcr.swf" (normalized: "c:\\users\\fd1hvy\\videos\\_oydr1tcr.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\_OYDR1Tcr.swf.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\videos\\_oydr1tcr.swf.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0105.159] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\_OYDR1Tcr.swf" | out: pszPath="C:\\Users\\FD1HVy\\Videos") returned 1 [0105.159] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\") returned="" [0105.159] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Videos\\HOW_RECOVER.html" [0105.159] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\how_recover.html")) returned 0x20 [0105.159] GetProcessHeap () returned 0xd20000 [0105.159] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445d0 | out: hHeap=0xd20000) returned 1 [0105.159] FindNextFileW (in: hFindFile=0xd491a0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d116600, ftCreationTime.dwHighDateTime=0x1d4c594, ftLastAccessTime.dwLowDateTime=0x994bc930, ftLastAccessTime.dwHighDateTime=0x1d4ccd8, ftLastWriteTime.dwLowDateTime=0x994bc930, ftLastWriteTime.dwHighDateTime=0x1d4ccd8, nFileSizeHigh=0x0, nFileSizeLow=0x156ff, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_OYDR1Tcr.swf", cAlternateFileName="_OYDR1~1.SWF")) returned 0 [0105.159] FindClose (in: hFindFile=0xd491a0 | out: hFindFile=0xd491a0) returned 1 [0105.160] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\" [0105.160] GetProcessHeap () returned 0xd20000 [0105.160] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2e898 | out: hHeap=0xd20000) returned 1 [0105.160] GetProcessHeap () returned 0xd20000 [0105.160] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0105.160] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\") returned 37 [0105.160] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\*") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\*" [0105.160] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf868da0, ftCreationTime.dwHighDateTime=0x1d4d585, ftLastAccessTime.dwLowDateTime=0xa804f8b0, ftLastAccessTime.dwHighDateTime=0x1d4ca8b, ftLastWriteTime.dwLowDateTime=0xa804f8b0, ftLastWriteTime.dwHighDateTime=0x1d4ca8b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd49220 [0105.160] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0105.160] FindNextFileW (in: hFindFile=0xd49220, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf868da0, ftCreationTime.dwHighDateTime=0x1d4d585, ftLastAccessTime.dwLowDateTime=0xa804f8b0, ftLastAccessTime.dwHighDateTime=0x1d4ca8b, ftLastWriteTime.dwLowDateTime=0xa804f8b0, ftLastWriteTime.dwHighDateTime=0x1d4ca8b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.161] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0105.161] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0105.161] FindNextFileW (in: hFindFile=0xd49220, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85195b50, ftCreationTime.dwHighDateTime=0x1d4d25d, ftLastAccessTime.dwLowDateTime=0x435b3c10, ftLastAccessTime.dwHighDateTime=0x1d4cd99, ftLastWriteTime.dwLowDateTime=0x435b3c10, ftLastWriteTime.dwHighDateTime=0x1d4cd99, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pp4Pa7", cAlternateFileName="")) returned 1 [0105.161] lstrcmpiW (lpString1="pp4Pa7", lpString2=".") returned 1 [0105.161] lstrcmpiW (lpString1="pp4Pa7", lpString2="..") returned 1 [0105.161] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\", lpString2="pp4Pa7" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7" [0105.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pp4Pa7", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0105.161] GetProcessHeap () returned 0xd20000 [0105.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x7) returned 0xd3ce88 [0105.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pp4Pa7", cchWideChar=-1, lpMultiByteStr=0xd3ce88, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pp4Pa7", lpUsedDefaultChar=0x0) returned 7 [0105.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0105.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0105.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0105.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0105.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0105.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0105.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0105.161] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0105.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0105.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0105.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0105.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0105.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0105.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0105.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0105.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0105.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0105.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0105.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0105.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0105.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0105.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0105.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0105.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0105.162] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0105.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0105.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0105.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0105.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0105.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0105.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0105.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0105.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0105.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0105.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0105.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0105.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0105.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0105.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0105.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0105.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0105.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0105.163] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="pp4Pa7", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0105.164] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\" [0105.164] GetProcessHeap () returned 0xd20000 [0105.164] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3ce48 [0105.164] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\") returned 44 [0105.164] GetProcessHeap () returned 0xd20000 [0105.164] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x5a) returned 0xd2e898 [0105.164] lstrcpyW (in: lpString1=0xd2e898, lpString2="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\" [0105.164] GetProcessHeap () returned 0xd20000 [0105.164] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0105.164] FindNextFileW (in: hFindFile=0xd49220, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebba1cd0, ftCreationTime.dwHighDateTime=0x1d4c616, ftLastAccessTime.dwLowDateTime=0x8a6c7bb0, ftLastAccessTime.dwHighDateTime=0x1d4cc12, ftLastWriteTime.dwLowDateTime=0x8a6c7bb0, ftLastWriteTime.dwHighDateTime=0x1d4cc12, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Uobad49auEmCJXvufDb", cAlternateFileName="UOBAD4~1")) returned 1 [0105.164] lstrcmpiW (lpString1="Uobad49auEmCJXvufDb", lpString2=".") returned 1 [0105.164] lstrcmpiW (lpString1="Uobad49auEmCJXvufDb", lpString2="..") returned 1 [0105.164] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\", lpString2="Uobad49auEmCJXvufDb" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb" [0105.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Uobad49auEmCJXvufDb", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0105.164] GetProcessHeap () returned 0xd20000 [0105.164] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x14) returned 0xd364c8 [0105.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Uobad49auEmCJXvufDb", cchWideChar=-1, lpMultiByteStr=0xd364c8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Uobad49auEmCJXvufDb", lpUsedDefaultChar=0x0) returned 20 [0105.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0105.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0105.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0105.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0105.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0105.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0105.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0105.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0105.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0105.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0105.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0105.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0105.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0105.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0105.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0105.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0105.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0105.165] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0105.166] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0105.166] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0105.166] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0105.166] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0105.202] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0105.202] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0105.202] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0105.202] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0105.202] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0105.202] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0105.203] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0105.203] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0105.203] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0105.203] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0105.203] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0105.203] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0105.203] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0105.203] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0105.203] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0105.203] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0105.203] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0105.203] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0105.203] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0105.203] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0105.203] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Uobad49auEmCJXvufDb", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0105.203] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\" [0105.203] GetProcessHeap () returned 0xd20000 [0105.204] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cf38 [0105.204] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\") returned 57 [0105.204] GetProcessHeap () returned 0xd20000 [0105.204] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x74) returned 0xd4d518 [0105.204] lstrcpyW (in: lpString1=0xd4d518, lpString2="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\" [0105.204] GetProcessHeap () returned 0xd20000 [0105.204] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd364c8 | out: hHeap=0xd20000) returned 1 [0105.204] FindNextFileW (in: hFindFile=0xd49220, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f11e240, ftCreationTime.dwHighDateTime=0x1d4d0e4, ftLastAccessTime.dwLowDateTime=0x52755040, ftLastAccessTime.dwHighDateTime=0x1d4d29f, ftLastWriteTime.dwLowDateTime=0x52755040, ftLastWriteTime.dwHighDateTime=0x1d4d29f, nFileSizeHigh=0x0, nFileSizeLow=0x2eff, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="waAaf0.mkv", cAlternateFileName="")) returned 1 [0105.204] lstrcmpiW (lpString1="waAaf0.mkv", lpString2=".") returned 1 [0105.204] lstrcmpiW (lpString1="waAaf0.mkv", lpString2="..") returned 1 [0105.204] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\", lpString2="waAaf0.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\waAaf0.mkv") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\waAaf0.mkv" [0105.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="waAaf0.mkv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0105.204] GetProcessHeap () returned 0xd20000 [0105.204] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xb) returned 0xd44468 [0105.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="waAaf0.mkv", cchWideChar=-1, lpMultiByteStr=0xd44468, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="waAaf0.mkv", lpUsedDefaultChar=0x0) returned 11 [0105.204] lstrlenA (lpString="waAaf0.mkv") returned 10 [0105.204] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0105.205] lstrlenA (lpString="waAaf0.mkv") returned 10 [0105.205] lstrlenA (lpString=".dll") returned 4 [0105.205] lstrlenA (lpString=".dll") returned 4 [0105.205] lstrlenA (lpString="waAaf0.mkv") returned 10 [0105.205] lstrcmpiA (lpString1=".mkv", lpString2=".dll") returned 1 [0105.205] lstrlenA (lpString="waAaf0.mkv") returned 10 [0105.205] lstrlenA (lpString=".ini") returned 4 [0105.205] lstrlenA (lpString=".ini") returned 4 [0105.205] lstrlenA (lpString="waAaf0.mkv") returned 10 [0105.205] lstrcmpiA (lpString1=".mkv", lpString2=".ini") returned 1 [0105.205] lstrlenA (lpString="waAaf0.mkv") returned 10 [0105.205] lstrlenA (lpString=".inc") returned 4 [0105.205] lstrlenA (lpString=".inc") returned 4 [0105.205] lstrlenA (lpString="waAaf0.mkv") returned 10 [0105.205] lstrcmpiA (lpString1=".mkv", lpString2=".inc") returned 1 [0105.205] lstrcmpiW (lpString1="waAaf0.mkv", lpString2="HOW_RECOVER.html") returned 1 [0105.205] lstrcmpiW (lpString1="waAaf0.mkv", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0105.205] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0105.205] lstrcmpiW (lpString1="waAaf0.mkv", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0105.206] GetProcessHeap () returned 0xd20000 [0105.206] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd424e0 [0105.206] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\waAaf0.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\waaaf0.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0105.206] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=12031) returned 1 [0105.206] GetProcessHeap () returned 0xd20000 [0105.206] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bcb0 [0105.206] GetProcessHeap () returned 0xd20000 [0105.206] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0105.206] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\waAaf0.mkv") returned 47 [0105.206] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0105.207] GetProcessHeap () returned 0xd20000 [0105.207] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0105.207] GetProcessHeap () returned 0xd20000 [0105.207] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4ed60 [0105.207] lstrlenA (lpString="rsa_encrypt") returned 11 [0105.207] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0105.209] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0105.209] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0105.209] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0105.209] GetProcessHeap () returned 0xd20000 [0105.209] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0105.209] lstrlenA (lpString="010001") returned 6 [0105.209] GetProcessHeap () returned 0xd20000 [0105.210] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ce58 [0105.210] GetProcessHeap () returned 0xd20000 [0105.210] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0105.210] GetProcessHeap () returned 0xd20000 [0105.210] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b878 [0105.210] GetProcessHeap () returned 0xd20000 [0105.210] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0105.210] GetProcessHeap () returned 0xd20000 [0105.210] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b638 [0105.210] GetProcessHeap () returned 0xd20000 [0105.210] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44d80 [0105.210] GetProcessHeap () returned 0xd20000 [0105.210] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ce78 [0105.210] GetProcessHeap () returned 0xd20000 [0105.210] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0105.210] GetProcessHeap () returned 0xd20000 [0105.210] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.210] GetProcessHeap () returned 0xd20000 [0105.210] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0105.211] GetProcessHeap () returned 0xd20000 [0105.211] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0105.211] GetProcessHeap () returned 0xd20000 [0105.211] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44a38 [0105.211] GetProcessHeap () returned 0xd20000 [0105.211] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0105.211] GetProcessHeap () returned 0xd20000 [0105.211] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44600 [0105.211] GetProcessHeap () returned 0xd20000 [0105.211] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b3f8 [0105.211] GetProcessHeap () returned 0xd20000 [0105.211] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0105.211] GetProcessHeap () returned 0xd20000 [0105.211] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0105.211] GetProcessHeap () returned 0xd20000 [0105.211] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b3f8 | out: hHeap=0xd20000) returned 1 [0105.211] GetProcessHeap () returned 0xd20000 [0105.211] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0105.211] GetProcessHeap () returned 0xd20000 [0105.211] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44408 [0105.212] GetProcessHeap () returned 0xd20000 [0105.212] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0105.212] GetProcessHeap () returned 0xd20000 [0105.212] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0105.212] GetProcessHeap () returned 0xd20000 [0105.212] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0105.212] GetProcessHeap () returned 0xd20000 [0105.212] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0105.212] GetProcessHeap () returned 0xd20000 [0105.212] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0105.212] GetProcessHeap () returned 0xd20000 [0105.212] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0105.212] GetProcessHeap () returned 0xd20000 [0105.212] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b488 [0105.212] GetProcessHeap () returned 0xd20000 [0105.212] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44408 | out: hHeap=0xd20000) returned 1 [0105.212] GetProcessHeap () returned 0xd20000 [0105.212] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0105.212] GetProcessHeap () returned 0xd20000 [0105.212] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b488 | out: hHeap=0xd20000) returned 1 [0105.213] GetProcessHeap () returned 0xd20000 [0105.213] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0105.213] GetProcessHeap () returned 0xd20000 [0105.213] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0105.213] GetProcessHeap () returned 0xd20000 [0105.213] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0105.213] GetProcessHeap () returned 0xd20000 [0105.214] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0105.214] GetProcessHeap () returned 0xd20000 [0105.214] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0105.214] GetProcessHeap () returned 0xd20000 [0105.214] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0105.214] GetProcessHeap () returned 0xd20000 [0105.214] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.214] GetProcessHeap () returned 0xd20000 [0105.214] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.214] GetProcessHeap () returned 0xd20000 [0105.214] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.214] GetProcessHeap () returned 0xd20000 [0105.214] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.214] GetProcessHeap () returned 0xd20000 [0105.214] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0105.214] GetProcessHeap () returned 0xd20000 [0105.214] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0105.214] GetProcessHeap () returned 0xd20000 [0105.214] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0105.214] GetProcessHeap () returned 0xd20000 [0105.215] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0105.215] GetProcessHeap () returned 0xd20000 [0105.215] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0105.215] GetProcessHeap () returned 0xd20000 [0105.215] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0105.215] GetProcessHeap () returned 0xd20000 [0105.215] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0105.215] GetProcessHeap () returned 0xd20000 [0105.215] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0105.215] GetProcessHeap () returned 0xd20000 [0105.215] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0105.215] GetProcessHeap () returned 0xd20000 [0105.215] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0105.215] GetProcessHeap () returned 0xd20000 [0105.215] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.215] GetProcessHeap () returned 0xd20000 [0105.215] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.215] GetProcessHeap () returned 0xd20000 [0105.215] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0105.216] GetProcessHeap () returned 0xd20000 [0105.216] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0105.216] GetProcessHeap () returned 0xd20000 [0105.216] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0105.216] GetProcessHeap () returned 0xd20000 [0105.216] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0105.216] GetProcessHeap () returned 0xd20000 [0105.216] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0105.216] GetProcessHeap () returned 0xd20000 [0105.216] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0105.216] GetProcessHeap () returned 0xd20000 [0105.216] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.216] GetProcessHeap () returned 0xd20000 [0105.216] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.216] GetProcessHeap () returned 0xd20000 [0105.216] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.216] GetProcessHeap () returned 0xd20000 [0105.216] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.216] GetProcessHeap () returned 0xd20000 [0105.216] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.216] GetProcessHeap () returned 0xd20000 [0105.217] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.217] GetProcessHeap () returned 0xd20000 [0105.217] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.217] GetProcessHeap () returned 0xd20000 [0105.217] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.217] GetProcessHeap () returned 0xd20000 [0105.217] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0105.217] GetProcessHeap () returned 0xd20000 [0105.217] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0105.217] GetProcessHeap () returned 0xd20000 [0105.217] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0105.217] GetProcessHeap () returned 0xd20000 [0105.217] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0105.217] GetProcessHeap () returned 0xd20000 [0105.217] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0105.217] GetProcessHeap () returned 0xd20000 [0105.217] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0105.217] GetProcessHeap () returned 0xd20000 [0105.217] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0105.218] GetProcessHeap () returned 0xd20000 [0105.218] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0105.218] GetProcessHeap () returned 0xd20000 [0105.218] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0105.218] GetProcessHeap () returned 0xd20000 [0105.218] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0105.218] GetProcessHeap () returned 0xd20000 [0105.218] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0105.218] GetProcessHeap () returned 0xd20000 [0105.218] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0105.218] GetProcessHeap () returned 0xd20000 [0105.218] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0105.218] GetProcessHeap () returned 0xd20000 [0105.218] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0105.218] GetProcessHeap () returned 0xd20000 [0105.218] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0105.218] GetProcessHeap () returned 0xd20000 [0105.218] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0105.218] GetProcessHeap () returned 0xd20000 [0105.218] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.219] GetProcessHeap () returned 0xd20000 [0105.219] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.219] GetProcessHeap () returned 0xd20000 [0105.219] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0105.219] GetProcessHeap () returned 0xd20000 [0105.219] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0105.219] GetProcessHeap () returned 0xd20000 [0105.219] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0105.219] GetProcessHeap () returned 0xd20000 [0105.219] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0105.219] GetProcessHeap () returned 0xd20000 [0105.219] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.219] GetProcessHeap () returned 0xd20000 [0105.219] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.219] GetProcessHeap () returned 0xd20000 [0105.219] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0105.219] GetProcessHeap () returned 0xd20000 [0105.219] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0105.219] GetProcessHeap () returned 0xd20000 [0105.220] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0105.220] GetProcessHeap () returned 0xd20000 [0105.220] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0105.220] GetProcessHeap () returned 0xd20000 [0105.220] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0105.220] GetProcessHeap () returned 0xd20000 [0105.220] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0105.220] GetProcessHeap () returned 0xd20000 [0105.220] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.220] GetProcessHeap () returned 0xd20000 [0105.220] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.220] GetProcessHeap () returned 0xd20000 [0105.220] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.220] GetProcessHeap () returned 0xd20000 [0105.220] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.220] GetProcessHeap () returned 0xd20000 [0105.220] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0105.220] GetProcessHeap () returned 0xd20000 [0105.220] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0105.220] GetProcessHeap () returned 0xd20000 [0105.221] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0105.221] GetProcessHeap () returned 0xd20000 [0105.221] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0105.221] GetProcessHeap () returned 0xd20000 [0105.221] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0105.221] GetProcessHeap () returned 0xd20000 [0105.221] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0105.221] GetProcessHeap () returned 0xd20000 [0105.221] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.221] GetProcessHeap () returned 0xd20000 [0105.221] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.221] GetProcessHeap () returned 0xd20000 [0105.221] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0105.221] GetProcessHeap () returned 0xd20000 [0105.221] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0105.221] GetProcessHeap () returned 0xd20000 [0105.221] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.221] GetProcessHeap () returned 0xd20000 [0105.221] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.221] GetProcessHeap () returned 0xd20000 [0105.222] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.222] GetProcessHeap () returned 0xd20000 [0105.222] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.222] GetProcessHeap () returned 0xd20000 [0105.222] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0105.222] GetProcessHeap () returned 0xd20000 [0105.222] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0105.222] GetProcessHeap () returned 0xd20000 [0105.222] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.222] GetProcessHeap () returned 0xd20000 [0105.222] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.222] GetProcessHeap () returned 0xd20000 [0105.222] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.222] GetProcessHeap () returned 0xd20000 [0105.222] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.222] GetProcessHeap () returned 0xd20000 [0105.222] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0105.222] GetProcessHeap () returned 0xd20000 [0105.222] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0105.222] GetProcessHeap () returned 0xd20000 [0105.223] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0105.223] GetProcessHeap () returned 0xd20000 [0105.223] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0105.223] GetProcessHeap () returned 0xd20000 [0105.223] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0105.223] GetProcessHeap () returned 0xd20000 [0105.223] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0105.223] GetProcessHeap () returned 0xd20000 [0105.223] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.223] GetProcessHeap () returned 0xd20000 [0105.223] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.223] GetProcessHeap () returned 0xd20000 [0105.223] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0105.223] GetProcessHeap () returned 0xd20000 [0105.223] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0105.223] GetProcessHeap () returned 0xd20000 [0105.223] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.223] GetProcessHeap () returned 0xd20000 [0105.223] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.224] GetProcessHeap () returned 0xd20000 [0105.224] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0105.224] GetProcessHeap () returned 0xd20000 [0105.224] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0105.224] GetProcessHeap () returned 0xd20000 [0105.224] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0105.224] GetProcessHeap () returned 0xd20000 [0105.224] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0105.224] GetProcessHeap () returned 0xd20000 [0105.224] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0105.224] GetProcessHeap () returned 0xd20000 [0105.224] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0105.224] GetProcessHeap () returned 0xd20000 [0105.224] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0105.224] GetProcessHeap () returned 0xd20000 [0105.224] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0105.224] GetProcessHeap () returned 0xd20000 [0105.224] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0105.224] GetProcessHeap () returned 0xd20000 [0105.225] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0105.225] GetProcessHeap () returned 0xd20000 [0105.225] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0105.225] GetProcessHeap () returned 0xd20000 [0105.225] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0105.225] GetProcessHeap () returned 0xd20000 [0105.225] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.225] GetProcessHeap () returned 0xd20000 [0105.225] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.225] GetProcessHeap () returned 0xd20000 [0105.225] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0105.225] GetProcessHeap () returned 0xd20000 [0105.225] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0105.225] GetProcessHeap () returned 0xd20000 [0105.225] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0105.225] GetProcessHeap () returned 0xd20000 [0105.225] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0105.225] GetProcessHeap () returned 0xd20000 [0105.225] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0105.225] GetProcessHeap () returned 0xd20000 [0105.226] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0105.226] GetProcessHeap () returned 0xd20000 [0105.226] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0105.226] GetProcessHeap () returned 0xd20000 [0105.226] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0105.226] GetProcessHeap () returned 0xd20000 [0105.226] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0105.226] GetProcessHeap () returned 0xd20000 [0105.226] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0105.226] GetProcessHeap () returned 0xd20000 [0105.226] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0105.226] GetProcessHeap () returned 0xd20000 [0105.226] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0105.226] GetProcessHeap () returned 0xd20000 [0105.226] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.226] GetProcessHeap () returned 0xd20000 [0105.226] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.226] GetProcessHeap () returned 0xd20000 [0105.226] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0105.226] GetProcessHeap () returned 0xd20000 [0105.227] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0105.227] GetProcessHeap () returned 0xd20000 [0105.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0105.227] GetProcessHeap () returned 0xd20000 [0105.227] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0105.227] GetProcessHeap () returned 0xd20000 [0105.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0105.227] GetProcessHeap () returned 0xd20000 [0105.227] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0105.227] GetProcessHeap () returned 0xd20000 [0105.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0105.227] GetProcessHeap () returned 0xd20000 [0105.227] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0105.227] GetProcessHeap () returned 0xd20000 [0105.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.227] GetProcessHeap () returned 0xd20000 [0105.227] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.227] GetProcessHeap () returned 0xd20000 [0105.227] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.227] GetProcessHeap () returned 0xd20000 [0105.227] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.228] GetProcessHeap () returned 0xd20000 [0105.228] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.228] GetProcessHeap () returned 0xd20000 [0105.228] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.228] GetProcessHeap () returned 0xd20000 [0105.228] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0105.228] GetProcessHeap () returned 0xd20000 [0105.228] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0105.228] GetProcessHeap () returned 0xd20000 [0105.228] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0105.228] GetProcessHeap () returned 0xd20000 [0105.228] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0105.228] GetProcessHeap () returned 0xd20000 [0105.228] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0105.405] GetProcessHeap () returned 0xd20000 [0105.405] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0105.405] GetProcessHeap () returned 0xd20000 [0105.405] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.405] GetProcessHeap () returned 0xd20000 [0105.405] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.405] GetProcessHeap () returned 0xd20000 [0105.405] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.405] GetProcessHeap () returned 0xd20000 [0105.406] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.406] GetProcessHeap () returned 0xd20000 [0105.406] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.406] GetProcessHeap () returned 0xd20000 [0105.406] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.406] GetProcessHeap () returned 0xd20000 [0105.406] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0105.406] GetProcessHeap () returned 0xd20000 [0105.406] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0105.406] GetProcessHeap () returned 0xd20000 [0105.406] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0105.406] GetProcessHeap () returned 0xd20000 [0105.406] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0105.406] GetProcessHeap () returned 0xd20000 [0105.406] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.406] GetProcessHeap () returned 0xd20000 [0105.406] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.406] GetProcessHeap () returned 0xd20000 [0105.406] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0105.406] GetProcessHeap () returned 0xd20000 [0105.406] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0105.407] GetProcessHeap () returned 0xd20000 [0105.407] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0105.407] GetProcessHeap () returned 0xd20000 [0105.407] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0105.407] GetProcessHeap () returned 0xd20000 [0105.407] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0105.407] GetProcessHeap () returned 0xd20000 [0105.407] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0105.407] GetProcessHeap () returned 0xd20000 [0105.407] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.407] GetProcessHeap () returned 0xd20000 [0105.407] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.407] GetProcessHeap () returned 0xd20000 [0105.407] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0105.407] GetProcessHeap () returned 0xd20000 [0105.407] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0105.407] GetProcessHeap () returned 0xd20000 [0105.407] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0105.407] GetProcessHeap () returned 0xd20000 [0105.407] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0105.407] GetProcessHeap () returned 0xd20000 [0105.408] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44600 | out: hHeap=0xd20000) returned 1 [0105.408] GetProcessHeap () returned 0xd20000 [0105.408] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b638 | out: hHeap=0xd20000) returned 1 [0105.408] GetProcessHeap () returned 0xd20000 [0105.408] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0105.408] GetProcessHeap () returned 0xd20000 [0105.408] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b878 | out: hHeap=0xd20000) returned 1 [0105.408] GetProcessHeap () returned 0xd20000 [0105.408] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0105.408] GetProcessHeap () returned 0xd20000 [0105.408] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0105.408] GetProcessHeap () returned 0xd20000 [0105.408] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0105.408] WriteFile (in: hFile=0x230, lpBuffer=0xd4ed60*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ed60*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0105.412] GetProcessHeap () returned 0xd20000 [0105.412] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4ed60, Size=0x30) returned 0xd4ed60 [0105.412] GetProcessHeap () returned 0xd20000 [0105.412] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0105.412] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0105.412] GetProcessHeap () returned 0xd20000 [0105.412] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x2eff) returned 0xd4ed98 [0105.412] ReadFile (in: hFile=0x230, lpBuffer=0xd4ed98, nNumberOfBytesToRead=0x2eff, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4ed98*, lpNumberOfBytesRead=0x299d7e8*=0x2eff, lpOverlapped=0x0) returned 1 [0105.413] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0105.413] WriteFile (in: hFile=0x230, lpBuffer=0xd4ed98*, nNumberOfBytesToWrite=0x2eff, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4ed98*, lpNumberOfBytesWritten=0x299d7e4*=0x2eff, lpOverlapped=0x0) returned 1 [0105.414] GetProcessHeap () returned 0xd20000 [0105.414] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ed98 | out: hHeap=0xd20000) returned 1 [0105.415] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0105.415] WriteFile (in: hFile=0x230, lpBuffer=0xd4ed60*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ed60*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0105.417] CloseHandle (hObject=0x230) returned 1 [0105.423] GetProcessHeap () returned 0xd20000 [0105.423] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd424e0 | out: hHeap=0xd20000) returned 1 [0105.423] GetProcessHeap () returned 0xd20000 [0105.423] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bcb0 | out: hHeap=0xd20000) returned 1 [0105.423] GetProcessHeap () returned 0xd20000 [0105.423] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0105.423] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\waAaf0.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\waAaf0.mkv") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\waAaf0.mkv" [0105.423] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\waAaf0.mkv", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\waAaf0.mkv.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\waAaf0.mkv.[ponce.lorena@aol.com]" [0105.423] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\waAaf0.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\waaaf0.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\waAaf0.mkv.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\waaaf0.mkv.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0105.424] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\waAaf0.mkv" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG") returned 1 [0105.424] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\") returned="" [0105.424] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\HOW_RECOVER.html" [0105.424] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\how_recover.html")) returned 0xffffffff [0105.424] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\how_recover.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0105.425] GetProcessHeap () returned 0xd20000 [0105.425] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bf80 [0105.425] GetProcessHeap () returned 0xd20000 [0105.425] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0105.435] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.437] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.437] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.438] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.438] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.438] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.438] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.438] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.438] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.438] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.439] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.439] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.439] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.439] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.439] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.439] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.439] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.439] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.440] GetProcessHeap () returned 0xd20000 [0105.440] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bf80 | out: hHeap=0xd20000) returned 1 [0105.440] GetProcessHeap () returned 0xd20000 [0105.440] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0105.440] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x299d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x299d9d0*=0x300, lpOverlapped=0x0) returned 1 [0105.441] GetProcessHeap () returned 0xd20000 [0105.441] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4be90 [0105.441] GetProcessHeap () returned 0xd20000 [0105.441] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0105.451] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.452] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.452] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.452] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.452] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.452] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.452] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.452] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.452] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.452] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.452] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.453] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.453] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.453] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.453] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.453] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.453] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.453] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.453] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.454] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.454] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.454] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.454] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.454] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.454] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.454] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.454] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.455] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.455] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.455] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.455] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.455] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.455] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.455] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.455] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.456] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.456] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.456] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.456] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.456] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.456] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.456] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.457] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.457] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.457] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.457] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.457] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.457] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.457] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.457] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.457] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.458] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.458] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.458] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.458] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.458] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.458] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.458] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.459] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.459] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.459] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.459] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.459] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.459] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.459] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.459] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.460] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.460] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.460] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.576] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.576] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.576] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.576] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.576] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.576] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.576] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.576] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.577] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.577] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.577] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.577] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.577] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.577] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.577] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.577] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.577] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.577] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.578] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.578] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.578] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.578] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.578] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.578] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.578] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.578] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.578] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.579] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.579] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.579] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.579] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.579] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.579] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.579] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.579] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.579] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.580] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.580] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.580] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.580] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.580] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.580] GetProcessHeap () returned 0xd20000 [0105.580] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4be90 | out: hHeap=0xd20000) returned 1 [0105.580] GetProcessHeap () returned 0xd20000 [0105.580] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0105.580] CloseHandle (hObject=0x230) returned 1 [0105.581] GetProcessHeap () returned 0xd20000 [0105.582] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44468 | out: hHeap=0xd20000) returned 1 [0105.582] FindNextFileW (in: hFindFile=0xd49220, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x950779c0, ftCreationTime.dwHighDateTime=0x1d4c9ac, ftLastAccessTime.dwLowDateTime=0xbb974a70, ftLastAccessTime.dwHighDateTime=0x1d4d145, ftLastWriteTime.dwLowDateTime=0xbb974a70, ftLastWriteTime.dwHighDateTime=0x1d4d145, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WR_a7iufou", cAlternateFileName="WR_A7I~1")) returned 1 [0105.582] lstrcmpiW (lpString1="WR_a7iufou", lpString2=".") returned 1 [0105.582] lstrcmpiW (lpString1="WR_a7iufou", lpString2="..") returned 1 [0105.582] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\", lpString2="WR_a7iufou" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou" [0105.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WR_a7iufou", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0105.582] GetProcessHeap () returned 0xd20000 [0105.582] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xb) returned 0xd446d8 [0105.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WR_a7iufou", cchWideChar=-1, lpMultiByteStr=0xd446d8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WR_a7iufou", lpUsedDefaultChar=0x0) returned 11 [0105.582] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 3 [0105.582] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 3 [0105.582] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 3 [0105.582] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 3 [0105.582] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 3 [0105.582] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 3 [0105.582] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0105.582] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 3 [0105.582] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 3 [0105.582] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 3 [0105.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 3 [0105.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 3 [0105.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 3 [0105.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 3 [0105.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 3 [0105.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 3 [0105.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 3 [0105.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 3 [0105.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 3 [0105.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 3 [0105.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 3 [0105.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 3 [0105.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 3 [0105.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0105.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 3 [0105.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 3 [0105.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0105.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0105.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 3 [0105.583] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 3 [0105.584] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 3 [0105.584] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0105.584] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 3 [0105.584] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0105.584] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 3 [0105.584] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 3 [0105.584] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0105.584] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 3 [0105.584] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 3 [0105.584] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0105.584] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 3 [0105.584] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0105.584] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="WR_a7iufou", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 3 [0105.584] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\" [0105.584] GetProcessHeap () returned 0xd20000 [0105.584] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3ce08 [0105.584] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\") returned 48 [0105.584] GetProcessHeap () returned 0xd20000 [0105.584] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x62) returned 0xd4e4a0 [0105.584] lstrcpyW (in: lpString1=0xd4e4a0, lpString2="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\" [0105.585] GetProcessHeap () returned 0xd20000 [0105.585] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446d8 | out: hHeap=0xd20000) returned 1 [0105.585] FindNextFileW (in: hFindFile=0xd49220, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x950779c0, ftCreationTime.dwHighDateTime=0x1d4c9ac, ftLastAccessTime.dwLowDateTime=0xbb974a70, ftLastAccessTime.dwHighDateTime=0x1d4d145, ftLastWriteTime.dwLowDateTime=0xbb974a70, ftLastWriteTime.dwHighDateTime=0x1d4d145, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WR_a7iufou", cAlternateFileName="WR_A7I~1")) returned 0 [0105.585] FindClose (in: hFindFile=0xd49220 | out: hFindFile=0xd49220) returned 1 [0105.585] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\" [0105.585] GetProcessHeap () returned 0xd20000 [0105.585] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4e4a0 | out: hHeap=0xd20000) returned 1 [0105.585] GetProcessHeap () returned 0xd20000 [0105.585] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0105.585] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\") returned 48 [0105.585] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\*") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\*" [0105.585] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x950779c0, ftCreationTime.dwHighDateTime=0x1d4c9ac, ftLastAccessTime.dwLowDateTime=0xbb974a70, ftLastAccessTime.dwHighDateTime=0x1d4d145, ftLastWriteTime.dwLowDateTime=0xbb974a70, ftLastWriteTime.dwHighDateTime=0x1d4d145, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd48de0 [0105.586] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0105.586] FindNextFileW (in: hFindFile=0xd48de0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x950779c0, ftCreationTime.dwHighDateTime=0x1d4c9ac, ftLastAccessTime.dwLowDateTime=0xbb974a70, ftLastAccessTime.dwHighDateTime=0x1d4d145, ftLastWriteTime.dwLowDateTime=0xbb974a70, ftLastWriteTime.dwHighDateTime=0x1d4d145, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.586] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0105.586] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0105.586] FindNextFileW (in: hFindFile=0xd48de0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520e1990, ftCreationTime.dwHighDateTime=0x1d4c794, ftLastAccessTime.dwLowDateTime=0xa8e98d80, ftLastAccessTime.dwHighDateTime=0x1d4cf87, ftLastWriteTime.dwLowDateTime=0xa8e98d80, ftLastWriteTime.dwHighDateTime=0x1d4cf87, nFileSizeHigh=0x0, nFileSizeLow=0x1492d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1Uiq7Jgw9IuB9.mkv", cAlternateFileName="1UIQ7J~1.MKV")) returned 1 [0105.586] lstrcmpiW (lpString1="1Uiq7Jgw9IuB9.mkv", lpString2=".") returned 1 [0105.586] lstrcmpiW (lpString1="1Uiq7Jgw9IuB9.mkv", lpString2="..") returned 1 [0105.586] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\", lpString2="1Uiq7Jgw9IuB9.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\1Uiq7Jgw9IuB9.mkv") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\1Uiq7Jgw9IuB9.mkv" [0105.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1Uiq7Jgw9IuB9.mkv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0105.586] GetProcessHeap () returned 0xd20000 [0105.586] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x12) returned 0xd36488 [0105.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1Uiq7Jgw9IuB9.mkv", cchWideChar=-1, lpMultiByteStr=0xd36488, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1Uiq7Jgw9IuB9.mkv", lpUsedDefaultChar=0x0) returned 18 [0105.586] lstrlenA (lpString="1Uiq7Jgw9IuB9.mkv") returned 17 [0105.586] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0105.586] lstrlenA (lpString="1Uiq7Jgw9IuB9.mkv") returned 17 [0105.586] lstrlenA (lpString=".dll") returned 4 [0105.586] lstrlenA (lpString=".dll") returned 4 [0105.586] lstrlenA (lpString="1Uiq7Jgw9IuB9.mkv") returned 17 [0105.587] lstrcmpiA (lpString1=".mkv", lpString2=".dll") returned 1 [0105.587] lstrlenA (lpString="1Uiq7Jgw9IuB9.mkv") returned 17 [0105.587] lstrlenA (lpString=".ini") returned 4 [0105.587] lstrlenA (lpString=".ini") returned 4 [0105.587] lstrlenA (lpString="1Uiq7Jgw9IuB9.mkv") returned 17 [0105.587] lstrcmpiA (lpString1=".mkv", lpString2=".ini") returned 1 [0105.587] lstrlenA (lpString="1Uiq7Jgw9IuB9.mkv") returned 17 [0105.587] lstrlenA (lpString=".inc") returned 4 [0105.587] lstrlenA (lpString=".inc") returned 4 [0105.587] lstrlenA (lpString="1Uiq7Jgw9IuB9.mkv") returned 17 [0105.587] lstrcmpiA (lpString1=".mkv", lpString2=".inc") returned 1 [0105.587] lstrcmpiW (lpString1="1Uiq7Jgw9IuB9.mkv", lpString2="HOW_RECOVER.html") returned -1 [0105.587] lstrcmpiW (lpString1="1Uiq7Jgw9IuB9.mkv", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0105.587] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0105.587] lstrcmpiW (lpString1="1Uiq7Jgw9IuB9.mkv", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0105.587] GetProcessHeap () returned 0xd20000 [0105.587] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd428c8 [0105.587] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\1Uiq7Jgw9IuB9.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\wr_a7iufou\\1uiq7jgw9iub9.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0105.588] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=84269) returned 1 [0105.588] GetProcessHeap () returned 0xd20000 [0105.588] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bd28 [0105.588] GetProcessHeap () returned 0xd20000 [0105.588] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0105.588] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\1Uiq7Jgw9IuB9.mkv") returned 65 [0105.589] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0105.589] GetProcessHeap () returned 0xd20000 [0105.589] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0105.589] GetProcessHeap () returned 0xd20000 [0105.589] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x383) returned 0xd4ed98 [0105.589] lstrlenA (lpString="rsa_encrypt") returned 11 [0105.589] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0105.591] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0105.591] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0105.591] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0105.591] GetProcessHeap () returned 0xd20000 [0105.591] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0105.591] lstrlenA (lpString="010001") returned 6 [0105.591] GetProcessHeap () returned 0xd20000 [0105.591] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ce58 [0105.591] GetProcessHeap () returned 0xd20000 [0105.592] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0105.592] GetProcessHeap () returned 0xd20000 [0105.592] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b128 [0105.592] GetProcessHeap () returned 0xd20000 [0105.592] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0105.592] GetProcessHeap () returned 0xd20000 [0105.592] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b368 [0105.592] GetProcessHeap () returned 0xd20000 [0105.592] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44d80 [0105.592] GetProcessHeap () returned 0xd20000 [0105.592] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cee8 [0105.592] GetProcessHeap () returned 0xd20000 [0105.592] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0105.592] GetProcessHeap () returned 0xd20000 [0105.592] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0105.592] GetProcessHeap () returned 0xd20000 [0105.592] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0105.592] GetProcessHeap () returned 0xd20000 [0105.592] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0105.592] GetProcessHeap () returned 0xd20000 [0105.592] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44c68 [0105.592] GetProcessHeap () returned 0xd20000 [0105.592] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0105.593] GetProcessHeap () returned 0xd20000 [0105.593] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44648 [0105.593] GetProcessHeap () returned 0xd20000 [0105.593] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4a9d8 [0105.593] GetProcessHeap () returned 0xd20000 [0105.593] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0105.593] GetProcessHeap () returned 0xd20000 [0105.593] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0105.593] GetProcessHeap () returned 0xd20000 [0105.593] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a9d8 | out: hHeap=0xd20000) returned 1 [0105.593] GetProcessHeap () returned 0xd20000 [0105.593] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.593] GetProcessHeap () returned 0xd20000 [0105.593] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444c8 [0105.593] GetProcessHeap () returned 0xd20000 [0105.593] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0105.593] GetProcessHeap () returned 0xd20000 [0105.593] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.593] GetProcessHeap () returned 0xd20000 [0105.593] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0105.593] GetProcessHeap () returned 0xd20000 [0105.593] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0105.593] GetProcessHeap () returned 0xd20000 [0105.594] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0105.594] GetProcessHeap () returned 0xd20000 [0105.594] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0105.594] GetProcessHeap () returned 0xd20000 [0105.594] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b248 [0105.594] GetProcessHeap () returned 0xd20000 [0105.594] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444c8 | out: hHeap=0xd20000) returned 1 [0105.594] GetProcessHeap () returned 0xd20000 [0105.594] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0105.594] GetProcessHeap () returned 0xd20000 [0105.594] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b248 | out: hHeap=0xd20000) returned 1 [0105.594] GetProcessHeap () returned 0xd20000 [0105.594] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0105.594] GetProcessHeap () returned 0xd20000 [0105.594] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0105.594] GetProcessHeap () returned 0xd20000 [0105.594] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0105.594] GetProcessHeap () returned 0xd20000 [0105.594] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0105.594] GetProcessHeap () returned 0xd20000 [0105.594] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0105.594] GetProcessHeap () returned 0xd20000 [0105.594] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0105.595] GetProcessHeap () returned 0xd20000 [0105.595] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0105.595] GetProcessHeap () returned 0xd20000 [0105.595] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0105.595] GetProcessHeap () returned 0xd20000 [0105.595] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.595] GetProcessHeap () returned 0xd20000 [0105.595] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.595] GetProcessHeap () returned 0xd20000 [0105.595] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0105.595] GetProcessHeap () returned 0xd20000 [0105.595] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0105.595] GetProcessHeap () returned 0xd20000 [0105.595] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0105.595] GetProcessHeap () returned 0xd20000 [0105.595] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0105.595] GetProcessHeap () returned 0xd20000 [0105.595] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.595] GetProcessHeap () returned 0xd20000 [0105.595] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.595] GetProcessHeap () returned 0xd20000 [0105.595] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0105.595] GetProcessHeap () returned 0xd20000 [0105.596] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0105.596] GetProcessHeap () returned 0xd20000 [0105.596] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.596] GetProcessHeap () returned 0xd20000 [0105.596] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.596] GetProcessHeap () returned 0xd20000 [0105.596] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0105.596] GetProcessHeap () returned 0xd20000 [0105.596] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0105.596] GetProcessHeap () returned 0xd20000 [0105.596] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.596] GetProcessHeap () returned 0xd20000 [0105.596] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.596] GetProcessHeap () returned 0xd20000 [0105.596] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0105.596] GetProcessHeap () returned 0xd20000 [0105.596] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0105.596] GetProcessHeap () returned 0xd20000 [0105.596] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0105.596] GetProcessHeap () returned 0xd20000 [0105.596] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0105.596] GetProcessHeap () returned 0xd20000 [0105.597] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.597] GetProcessHeap () returned 0xd20000 [0105.597] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.597] GetProcessHeap () returned 0xd20000 [0105.597] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0105.597] GetProcessHeap () returned 0xd20000 [0105.597] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0105.597] GetProcessHeap () returned 0xd20000 [0105.597] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0105.597] GetProcessHeap () returned 0xd20000 [0105.597] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0105.597] GetProcessHeap () returned 0xd20000 [0105.597] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0105.597] GetProcessHeap () returned 0xd20000 [0105.597] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0105.597] GetProcessHeap () returned 0xd20000 [0105.597] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0105.597] GetProcessHeap () returned 0xd20000 [0105.597] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0105.597] GetProcessHeap () returned 0xd20000 [0105.597] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.597] GetProcessHeap () returned 0xd20000 [0105.597] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.597] GetProcessHeap () returned 0xd20000 [0105.598] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0105.598] GetProcessHeap () returned 0xd20000 [0105.598] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0105.598] GetProcessHeap () returned 0xd20000 [0105.598] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.598] GetProcessHeap () returned 0xd20000 [0105.598] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.598] GetProcessHeap () returned 0xd20000 [0105.598] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0105.598] GetProcessHeap () returned 0xd20000 [0105.598] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0105.598] GetProcessHeap () returned 0xd20000 [0105.598] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0105.598] GetProcessHeap () returned 0xd20000 [0105.598] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0105.598] GetProcessHeap () returned 0xd20000 [0105.598] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0105.598] GetProcessHeap () returned 0xd20000 [0105.598] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0105.598] GetProcessHeap () returned 0xd20000 [0105.598] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0105.598] GetProcessHeap () returned 0xd20000 [0105.598] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0105.598] GetProcessHeap () returned 0xd20000 [0105.599] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0105.599] GetProcessHeap () returned 0xd20000 [0105.599] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0105.599] GetProcessHeap () returned 0xd20000 [0105.599] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.599] GetProcessHeap () returned 0xd20000 [0105.599] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.599] GetProcessHeap () returned 0xd20000 [0105.599] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0105.599] GetProcessHeap () returned 0xd20000 [0105.599] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0105.599] GetProcessHeap () returned 0xd20000 [0105.599] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.599] GetProcessHeap () returned 0xd20000 [0105.599] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.599] GetProcessHeap () returned 0xd20000 [0105.599] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0105.599] GetProcessHeap () returned 0xd20000 [0105.599] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0105.599] GetProcessHeap () returned 0xd20000 [0105.599] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.599] GetProcessHeap () returned 0xd20000 [0105.599] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.599] GetProcessHeap () returned 0xd20000 [0105.600] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0105.600] GetProcessHeap () returned 0xd20000 [0105.600] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0105.600] GetProcessHeap () returned 0xd20000 [0105.600] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.600] GetProcessHeap () returned 0xd20000 [0105.600] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.600] GetProcessHeap () returned 0xd20000 [0105.600] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0105.600] GetProcessHeap () returned 0xd20000 [0105.600] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0105.600] GetProcessHeap () returned 0xd20000 [0105.600] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.600] GetProcessHeap () returned 0xd20000 [0105.600] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.600] GetProcessHeap () returned 0xd20000 [0105.600] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.600] GetProcessHeap () returned 0xd20000 [0105.600] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.600] GetProcessHeap () returned 0xd20000 [0105.600] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0105.600] GetProcessHeap () returned 0xd20000 [0105.600] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0105.600] GetProcessHeap () returned 0xd20000 [0105.601] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0105.601] GetProcessHeap () returned 0xd20000 [0105.601] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0105.601] GetProcessHeap () returned 0xd20000 [0105.601] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.601] GetProcessHeap () returned 0xd20000 [0105.601] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.601] GetProcessHeap () returned 0xd20000 [0105.601] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0105.601] GetProcessHeap () returned 0xd20000 [0105.601] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0105.601] GetProcessHeap () returned 0xd20000 [0105.601] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0105.601] GetProcessHeap () returned 0xd20000 [0105.601] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0105.601] GetProcessHeap () returned 0xd20000 [0105.601] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0105.601] GetProcessHeap () returned 0xd20000 [0105.601] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0105.601] GetProcessHeap () returned 0xd20000 [0105.601] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.601] GetProcessHeap () returned 0xd20000 [0105.601] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.602] GetProcessHeap () returned 0xd20000 [0105.602] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0105.602] GetProcessHeap () returned 0xd20000 [0105.602] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0105.602] GetProcessHeap () returned 0xd20000 [0105.602] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0105.602] GetProcessHeap () returned 0xd20000 [0105.602] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0105.602] GetProcessHeap () returned 0xd20000 [0105.602] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0105.602] GetProcessHeap () returned 0xd20000 [0105.602] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0105.602] GetProcessHeap () returned 0xd20000 [0105.602] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0105.602] GetProcessHeap () returned 0xd20000 [0105.602] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0105.602] GetProcessHeap () returned 0xd20000 [0105.602] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0105.602] GetProcessHeap () returned 0xd20000 [0105.602] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0105.602] GetProcessHeap () returned 0xd20000 [0105.603] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.603] GetProcessHeap () returned 0xd20000 [0105.603] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.603] GetProcessHeap () returned 0xd20000 [0105.603] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.603] GetProcessHeap () returned 0xd20000 [0105.603] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.603] GetProcessHeap () returned 0xd20000 [0105.603] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.603] GetProcessHeap () returned 0xd20000 [0105.603] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.603] GetProcessHeap () returned 0xd20000 [0105.603] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0105.603] GetProcessHeap () returned 0xd20000 [0105.603] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0105.603] GetProcessHeap () returned 0xd20000 [0105.604] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0105.604] GetProcessHeap () returned 0xd20000 [0105.604] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0105.604] GetProcessHeap () returned 0xd20000 [0105.604] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0105.604] GetProcessHeap () returned 0xd20000 [0105.604] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0105.604] GetProcessHeap () returned 0xd20000 [0105.604] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.604] GetProcessHeap () returned 0xd20000 [0105.604] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.604] GetProcessHeap () returned 0xd20000 [0105.604] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.604] GetProcessHeap () returned 0xd20000 [0105.604] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.604] GetProcessHeap () returned 0xd20000 [0105.604] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0105.605] GetProcessHeap () returned 0xd20000 [0105.605] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0105.605] GetProcessHeap () returned 0xd20000 [0105.605] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0105.605] GetProcessHeap () returned 0xd20000 [0105.605] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0105.605] GetProcessHeap () returned 0xd20000 [0105.605] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0105.605] GetProcessHeap () returned 0xd20000 [0105.605] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0105.605] GetProcessHeap () returned 0xd20000 [0105.605] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.605] GetProcessHeap () returned 0xd20000 [0105.605] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.605] GetProcessHeap () returned 0xd20000 [0105.605] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.605] GetProcessHeap () returned 0xd20000 [0105.605] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.605] GetProcessHeap () returned 0xd20000 [0105.605] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.605] GetProcessHeap () returned 0xd20000 [0105.605] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.605] GetProcessHeap () returned 0xd20000 [0105.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.606] GetProcessHeap () returned 0xd20000 [0105.606] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.606] GetProcessHeap () returned 0xd20000 [0105.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0105.606] GetProcessHeap () returned 0xd20000 [0105.606] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0105.606] GetProcessHeap () returned 0xd20000 [0105.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0105.606] GetProcessHeap () returned 0xd20000 [0105.606] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0105.606] GetProcessHeap () returned 0xd20000 [0105.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0105.606] GetProcessHeap () returned 0xd20000 [0105.606] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0105.606] GetProcessHeap () returned 0xd20000 [0105.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0105.606] GetProcessHeap () returned 0xd20000 [0105.606] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0105.606] GetProcessHeap () returned 0xd20000 [0105.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.606] GetProcessHeap () returned 0xd20000 [0105.606] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.606] GetProcessHeap () returned 0xd20000 [0105.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.607] GetProcessHeap () returned 0xd20000 [0105.607] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.607] GetProcessHeap () returned 0xd20000 [0105.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.607] GetProcessHeap () returned 0xd20000 [0105.607] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.607] GetProcessHeap () returned 0xd20000 [0105.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0105.607] GetProcessHeap () returned 0xd20000 [0105.607] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0105.607] GetProcessHeap () returned 0xd20000 [0105.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0105.607] GetProcessHeap () returned 0xd20000 [0105.607] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0105.607] GetProcessHeap () returned 0xd20000 [0105.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.607] GetProcessHeap () returned 0xd20000 [0105.607] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.607] GetProcessHeap () returned 0xd20000 [0105.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0105.607] GetProcessHeap () returned 0xd20000 [0105.607] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0105.608] GetProcessHeap () returned 0xd20000 [0105.608] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.608] GetProcessHeap () returned 0xd20000 [0105.608] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.608] GetProcessHeap () returned 0xd20000 [0105.608] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0105.608] GetProcessHeap () returned 0xd20000 [0105.608] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0105.608] GetProcessHeap () returned 0xd20000 [0105.608] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0105.608] GetProcessHeap () returned 0xd20000 [0105.608] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0105.608] GetProcessHeap () returned 0xd20000 [0105.608] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0105.608] GetProcessHeap () returned 0xd20000 [0105.608] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0105.609] GetProcessHeap () returned 0xd20000 [0105.609] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0105.609] GetProcessHeap () returned 0xd20000 [0105.609] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0105.609] GetProcessHeap () returned 0xd20000 [0105.609] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0105.609] GetProcessHeap () returned 0xd20000 [0105.609] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0105.609] GetProcessHeap () returned 0xd20000 [0105.609] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0105.609] GetProcessHeap () returned 0xd20000 [0105.609] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0105.609] GetProcessHeap () returned 0xd20000 [0105.609] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0105.609] GetProcessHeap () returned 0xd20000 [0105.609] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0105.609] GetProcessHeap () returned 0xd20000 [0105.609] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.610] GetProcessHeap () returned 0xd20000 [0105.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.610] GetProcessHeap () returned 0xd20000 [0105.610] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0105.610] GetProcessHeap () returned 0xd20000 [0105.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0105.610] GetProcessHeap () returned 0xd20000 [0105.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0105.610] GetProcessHeap () returned 0xd20000 [0105.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0105.610] GetProcessHeap () returned 0xd20000 [0105.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0105.610] GetProcessHeap () returned 0xd20000 [0105.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0105.610] GetProcessHeap () returned 0xd20000 [0105.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44648 | out: hHeap=0xd20000) returned 1 [0105.610] GetProcessHeap () returned 0xd20000 [0105.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b368 | out: hHeap=0xd20000) returned 1 [0105.610] GetProcessHeap () returned 0xd20000 [0105.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0105.611] GetProcessHeap () returned 0xd20000 [0105.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b128 | out: hHeap=0xd20000) returned 1 [0105.611] GetProcessHeap () returned 0xd20000 [0105.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0105.611] GetProcessHeap () returned 0xd20000 [0105.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0105.611] GetProcessHeap () returned 0xd20000 [0105.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0105.611] WriteFile (in: hFile=0x230, lpBuffer=0xd4ed98*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ed98*, lpNumberOfBytesWritten=0x299d864*=0x383, lpOverlapped=0x0) returned 1 [0105.614] GetProcessHeap () returned 0xd20000 [0105.614] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4ed98, Size=0x30) returned 0xd4ed98 [0105.614] GetProcessHeap () returned 0xd20000 [0105.614] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0105.614] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0105.614] GetProcessHeap () returned 0xd20000 [0105.614] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x14930) returned 0xd4edd0 [0105.616] ReadFile (in: hFile=0x230, lpBuffer=0xd4edd0, nNumberOfBytesToRead=0x14930, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4edd0*, lpNumberOfBytesRead=0x299d7e8*=0x14930, lpOverlapped=0x0) returned 1 [0105.618] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0105.618] WriteFile (in: hFile=0x230, lpBuffer=0xd4edd0*, nNumberOfBytesToWrite=0x14930, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4edd0*, lpNumberOfBytesWritten=0x299d7e4*=0x14930, lpOverlapped=0x0) returned 1 [0105.621] GetProcessHeap () returned 0xd20000 [0105.621] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4edd0 | out: hHeap=0xd20000) returned 1 [0105.621] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0105.621] WriteFile (in: hFile=0x230, lpBuffer=0xd4ed98*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ed98*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0105.622] CloseHandle (hObject=0x230) returned 1 [0105.628] GetProcessHeap () returned 0xd20000 [0105.628] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd428c8 | out: hHeap=0xd20000) returned 1 [0105.628] GetProcessHeap () returned 0xd20000 [0105.628] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bd28 | out: hHeap=0xd20000) returned 1 [0105.628] GetProcessHeap () returned 0xd20000 [0105.628] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0105.628] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\1Uiq7Jgw9IuB9.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\1Uiq7Jgw9IuB9.mkv") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\1Uiq7Jgw9IuB9.mkv" [0105.628] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\1Uiq7Jgw9IuB9.mkv", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\1Uiq7Jgw9IuB9.mkv.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\1Uiq7Jgw9IuB9.mkv.[ponce.lorena@aol.com]" [0105.628] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\1Uiq7Jgw9IuB9.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\wr_a7iufou\\1uiq7jgw9iub9.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\1Uiq7Jgw9IuB9.mkv.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\wr_a7iufou\\1uiq7jgw9iub9.mkv.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0105.629] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\1Uiq7Jgw9IuB9.mkv" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou") returned 1 [0105.629] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\") returned="" [0105.629] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\HOW_RECOVER.html" [0105.629] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\wr_a7iufou\\how_recover.html")) returned 0xffffffff [0105.629] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\wr_a7iufou\\how_recover.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0105.631] GetProcessHeap () returned 0xd20000 [0105.631] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c0e8 [0105.631] GetProcessHeap () returned 0xd20000 [0105.631] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0105.642] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.643] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.644] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.644] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.644] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.644] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.644] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.644] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.644] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.645] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.645] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.645] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.645] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.645] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.645] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.645] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.646] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.646] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.646] GetProcessHeap () returned 0xd20000 [0105.646] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c0e8 | out: hHeap=0xd20000) returned 1 [0105.646] GetProcessHeap () returned 0xd20000 [0105.646] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0105.646] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x299d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x299d9d0*=0x300, lpOverlapped=0x0) returned 1 [0105.647] GetProcessHeap () returned 0xd20000 [0105.647] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bff8 [0105.647] GetProcessHeap () returned 0xd20000 [0105.647] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0105.658] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.658] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.658] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.658] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.658] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.658] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.659] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.659] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.659] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.659] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.659] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.659] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.659] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.660] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.660] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.660] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.660] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.660] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.660] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.660] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.660] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.661] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.661] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.661] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.661] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.661] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.661] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.717] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.717] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.717] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.717] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.717] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.717] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.717] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.718] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.718] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.718] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.718] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.718] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.718] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.718] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.718] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.719] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.719] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.719] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.719] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.719] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.719] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.719] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.720] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.720] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.720] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.720] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.720] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.720] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.720] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.721] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.721] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.721] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.721] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.721] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.721] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.721] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.721] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.722] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.722] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.722] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.722] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.722] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.722] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.722] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.722] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.723] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.723] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.723] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.723] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.723] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.723] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.723] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.723] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.724] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.724] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.724] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.724] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.724] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.724] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.724] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.725] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.725] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.725] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.725] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.725] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.725] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.725] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.725] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.726] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.726] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.726] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.726] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.726] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.726] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.726] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.726] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.727] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.727] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.727] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.727] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.727] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.727] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.727] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0105.727] GetProcessHeap () returned 0xd20000 [0105.728] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bff8 | out: hHeap=0xd20000) returned 1 [0105.728] GetProcessHeap () returned 0xd20000 [0105.728] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0105.728] CloseHandle (hObject=0x230) returned 1 [0105.728] GetProcessHeap () returned 0xd20000 [0105.728] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36488 | out: hHeap=0xd20000) returned 1 [0105.744] FindNextFileW (in: hFindFile=0xd48de0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa70b08f0, ftCreationTime.dwHighDateTime=0x1d4ca36, ftLastAccessTime.dwLowDateTime=0xeed34200, ftLastAccessTime.dwHighDateTime=0x1d4d0fe, ftLastWriteTime.dwLowDateTime=0xeed34200, ftLastWriteTime.dwHighDateTime=0x1d4d0fe, nFileSizeHigh=0x0, nFileSizeLow=0x16e6c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8B0nR6.mkv", cAlternateFileName="")) returned 1 [0105.744] lstrcmpiW (lpString1="8B0nR6.mkv", lpString2=".") returned 1 [0105.744] lstrcmpiW (lpString1="8B0nR6.mkv", lpString2="..") returned 1 [0105.744] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\", lpString2="8B0nR6.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\8B0nR6.mkv") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\8B0nR6.mkv" [0105.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="8B0nR6.mkv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0105.744] GetProcessHeap () returned 0xd20000 [0105.744] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xb) returned 0xd44678 [0105.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="8B0nR6.mkv", cchWideChar=-1, lpMultiByteStr=0xd44678, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8B0nR6.mkv", lpUsedDefaultChar=0x0) returned 11 [0105.745] lstrlenA (lpString="8B0nR6.mkv") returned 10 [0105.745] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0105.745] lstrlenA (lpString="8B0nR6.mkv") returned 10 [0105.745] lstrlenA (lpString=".dll") returned 4 [0105.745] lstrlenA (lpString=".dll") returned 4 [0105.745] lstrlenA (lpString="8B0nR6.mkv") returned 10 [0105.745] lstrcmpiA (lpString1=".mkv", lpString2=".dll") returned 1 [0105.745] lstrlenA (lpString="8B0nR6.mkv") returned 10 [0105.745] lstrlenA (lpString=".ini") returned 4 [0105.745] lstrlenA (lpString=".ini") returned 4 [0105.745] lstrlenA (lpString="8B0nR6.mkv") returned 10 [0105.745] lstrcmpiA (lpString1=".mkv", lpString2=".ini") returned 1 [0105.745] lstrlenA (lpString="8B0nR6.mkv") returned 10 [0105.745] lstrlenA (lpString=".inc") returned 4 [0105.745] lstrlenA (lpString=".inc") returned 4 [0105.745] lstrlenA (lpString="8B0nR6.mkv") returned 10 [0105.745] lstrcmpiA (lpString1=".mkv", lpString2=".inc") returned 1 [0105.745] lstrcmpiW (lpString1="8B0nR6.mkv", lpString2="HOW_RECOVER.html") returned -1 [0105.746] lstrcmpiW (lpString1="8B0nR6.mkv", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0105.746] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0105.746] lstrcmpiW (lpString1="8B0nR6.mkv", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0105.746] GetProcessHeap () returned 0xd20000 [0105.746] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd424e0 [0105.746] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\8B0nR6.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\wr_a7iufou\\8b0nr6.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0105.749] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=93804) returned 1 [0105.749] GetProcessHeap () returned 0xd20000 [0105.749] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4be18 [0105.749] GetProcessHeap () returned 0xd20000 [0105.749] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0105.749] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\8B0nR6.mkv") returned 58 [0105.749] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0105.750] GetProcessHeap () returned 0xd20000 [0105.750] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0105.750] GetProcessHeap () returned 0xd20000 [0105.750] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4edd0 [0105.750] lstrlenA (lpString="rsa_encrypt") returned 11 [0105.750] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0105.753] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0105.753] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0105.753] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0105.753] GetProcessHeap () returned 0xd20000 [0105.753] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0105.753] lstrlenA (lpString="010001") returned 6 [0105.753] GetProcessHeap () returned 0xd20000 [0105.753] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cec8 [0105.754] GetProcessHeap () returned 0xd20000 [0105.754] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0105.754] GetProcessHeap () returned 0xd20000 [0105.754] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4a948 [0105.754] GetProcessHeap () returned 0xd20000 [0105.754] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0105.754] GetProcessHeap () returned 0xd20000 [0105.754] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b008 [0105.754] GetProcessHeap () returned 0xd20000 [0105.754] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44d80 [0105.754] GetProcessHeap () returned 0xd20000 [0105.754] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ced8 [0105.754] GetProcessHeap () returned 0xd20000 [0105.754] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0105.754] GetProcessHeap () returned 0xd20000 [0105.754] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0105.754] GetProcessHeap () returned 0xd20000 [0105.754] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0105.754] GetProcessHeap () returned 0xd20000 [0105.754] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0105.755] GetProcessHeap () returned 0xd20000 [0105.755] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd45410 [0105.755] GetProcessHeap () returned 0xd20000 [0105.755] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0105.755] GetProcessHeap () returned 0xd20000 [0105.755] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44690 [0105.755] GetProcessHeap () returned 0xd20000 [0105.755] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b098 [0105.755] GetProcessHeap () returned 0xd20000 [0105.755] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0105.755] GetProcessHeap () returned 0xd20000 [0105.755] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0105.755] GetProcessHeap () returned 0xd20000 [0105.755] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b098 | out: hHeap=0xd20000) returned 1 [0105.755] GetProcessHeap () returned 0xd20000 [0105.755] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0105.755] GetProcessHeap () returned 0xd20000 [0105.755] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445d0 [0105.755] GetProcessHeap () returned 0xd20000 [0105.755] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0105.755] GetProcessHeap () returned 0xd20000 [0105.756] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0105.756] GetProcessHeap () returned 0xd20000 [0105.756] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0105.756] GetProcessHeap () returned 0xd20000 [0105.756] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0105.756] GetProcessHeap () returned 0xd20000 [0105.756] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0105.756] GetProcessHeap () returned 0xd20000 [0105.756] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0105.756] GetProcessHeap () returned 0xd20000 [0105.756] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b7e8 [0105.756] GetProcessHeap () returned 0xd20000 [0105.756] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445d0 | out: hHeap=0xd20000) returned 1 [0105.756] GetProcessHeap () returned 0xd20000 [0105.756] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0105.756] GetProcessHeap () returned 0xd20000 [0105.756] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0105.756] GetProcessHeap () returned 0xd20000 [0105.756] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0105.756] GetProcessHeap () returned 0xd20000 [0105.757] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0105.757] GetProcessHeap () returned 0xd20000 [0105.757] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.757] GetProcessHeap () returned 0xd20000 [0105.757] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.757] GetProcessHeap () returned 0xd20000 [0105.757] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0105.757] GetProcessHeap () returned 0xd20000 [0105.757] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0105.757] GetProcessHeap () returned 0xd20000 [0105.757] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0105.757] GetProcessHeap () returned 0xd20000 [0105.757] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0105.757] GetProcessHeap () returned 0xd20000 [0105.757] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0105.757] GetProcessHeap () returned 0xd20000 [0105.757] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0105.757] GetProcessHeap () returned 0xd20000 [0105.757] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0105.757] GetProcessHeap () returned 0xd20000 [0105.757] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0105.758] GetProcessHeap () returned 0xd20000 [0105.758] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0105.758] GetProcessHeap () returned 0xd20000 [0105.758] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0105.758] GetProcessHeap () returned 0xd20000 [0105.758] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0105.758] GetProcessHeap () returned 0xd20000 [0105.758] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0105.758] GetProcessHeap () returned 0xd20000 [0105.758] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.758] GetProcessHeap () returned 0xd20000 [0105.758] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.758] GetProcessHeap () returned 0xd20000 [0105.758] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.758] GetProcessHeap () returned 0xd20000 [0105.758] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.758] GetProcessHeap () returned 0xd20000 [0105.758] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0105.758] GetProcessHeap () returned 0xd20000 [0105.759] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0105.759] GetProcessHeap () returned 0xd20000 [0105.759] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0105.759] GetProcessHeap () returned 0xd20000 [0105.759] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0105.759] GetProcessHeap () returned 0xd20000 [0105.759] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0105.759] GetProcessHeap () returned 0xd20000 [0105.759] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0105.759] GetProcessHeap () returned 0xd20000 [0105.759] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.759] GetProcessHeap () returned 0xd20000 [0105.759] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.759] GetProcessHeap () returned 0xd20000 [0105.759] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0105.759] GetProcessHeap () returned 0xd20000 [0105.759] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0105.759] GetProcessHeap () returned 0xd20000 [0105.759] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0105.759] GetProcessHeap () returned 0xd20000 [0105.760] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0105.760] GetProcessHeap () returned 0xd20000 [0105.760] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.760] GetProcessHeap () returned 0xd20000 [0105.760] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.761] GetProcessHeap () returned 0xd20000 [0105.761] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0105.761] GetProcessHeap () returned 0xd20000 [0105.761] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0105.761] GetProcessHeap () returned 0xd20000 [0105.761] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.761] GetProcessHeap () returned 0xd20000 [0105.761] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.761] GetProcessHeap () returned 0xd20000 [0105.761] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0105.761] GetProcessHeap () returned 0xd20000 [0105.761] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0105.761] GetProcessHeap () returned 0xd20000 [0105.761] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0105.761] GetProcessHeap () returned 0xd20000 [0105.761] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0105.761] GetProcessHeap () returned 0xd20000 [0105.761] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0105.761] GetProcessHeap () returned 0xd20000 [0105.762] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0105.762] GetProcessHeap () returned 0xd20000 [0105.762] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0105.762] GetProcessHeap () returned 0xd20000 [0105.762] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0105.762] GetProcessHeap () returned 0xd20000 [0105.762] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0105.762] GetProcessHeap () returned 0xd20000 [0105.762] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0105.762] GetProcessHeap () returned 0xd20000 [0105.762] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0105.762] GetProcessHeap () returned 0xd20000 [0105.762] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0105.762] GetProcessHeap () returned 0xd20000 [0105.762] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.762] GetProcessHeap () returned 0xd20000 [0105.762] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.762] GetProcessHeap () returned 0xd20000 [0105.762] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0105.762] GetProcessHeap () returned 0xd20000 [0105.763] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0105.763] GetProcessHeap () returned 0xd20000 [0105.763] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0105.763] GetProcessHeap () returned 0xd20000 [0105.763] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0105.763] GetProcessHeap () returned 0xd20000 [0105.763] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0105.763] GetProcessHeap () returned 0xd20000 [0105.763] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0105.763] GetProcessHeap () returned 0xd20000 [0105.763] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0105.763] GetProcessHeap () returned 0xd20000 [0105.763] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0105.763] GetProcessHeap () returned 0xd20000 [0105.763] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0105.763] GetProcessHeap () returned 0xd20000 [0105.763] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0105.763] GetProcessHeap () returned 0xd20000 [0105.763] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0105.763] GetProcessHeap () returned 0xd20000 [0105.764] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0105.764] GetProcessHeap () returned 0xd20000 [0105.764] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.764] GetProcessHeap () returned 0xd20000 [0105.764] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.764] GetProcessHeap () returned 0xd20000 [0105.764] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0105.764] GetProcessHeap () returned 0xd20000 [0105.764] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0105.764] GetProcessHeap () returned 0xd20000 [0105.764] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0105.764] GetProcessHeap () returned 0xd20000 [0105.764] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0105.764] GetProcessHeap () returned 0xd20000 [0105.764] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0105.764] GetProcessHeap () returned 0xd20000 [0105.764] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0105.764] GetProcessHeap () returned 0xd20000 [0105.764] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0105.764] GetProcessHeap () returned 0xd20000 [0105.765] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0105.765] GetProcessHeap () returned 0xd20000 [0105.765] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0105.765] GetProcessHeap () returned 0xd20000 [0105.765] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0105.765] GetProcessHeap () returned 0xd20000 [0105.765] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0105.765] GetProcessHeap () returned 0xd20000 [0105.765] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0105.765] GetProcessHeap () returned 0xd20000 [0105.765] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.765] GetProcessHeap () returned 0xd20000 [0105.765] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.765] GetProcessHeap () returned 0xd20000 [0105.765] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0105.765] GetProcessHeap () returned 0xd20000 [0105.765] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0105.765] GetProcessHeap () returned 0xd20000 [0105.765] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0105.765] GetProcessHeap () returned 0xd20000 [0105.765] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0105.766] GetProcessHeap () returned 0xd20000 [0105.766] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0105.766] GetProcessHeap () returned 0xd20000 [0105.766] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0105.766] GetProcessHeap () returned 0xd20000 [0105.766] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0105.766] GetProcessHeap () returned 0xd20000 [0105.766] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0105.766] GetProcessHeap () returned 0xd20000 [0105.766] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0105.766] GetProcessHeap () returned 0xd20000 [0105.766] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0105.766] GetProcessHeap () returned 0xd20000 [0105.766] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.766] GetProcessHeap () returned 0xd20000 [0105.766] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.766] GetProcessHeap () returned 0xd20000 [0105.766] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.766] GetProcessHeap () returned 0xd20000 [0105.766] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.766] GetProcessHeap () returned 0xd20000 [0105.767] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0105.767] GetProcessHeap () returned 0xd20000 [0105.767] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0105.767] GetProcessHeap () returned 0xd20000 [0105.767] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0105.767] GetProcessHeap () returned 0xd20000 [0105.767] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0105.767] GetProcessHeap () returned 0xd20000 [0105.767] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0105.767] GetProcessHeap () returned 0xd20000 [0105.767] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0105.767] GetProcessHeap () returned 0xd20000 [0105.767] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0105.767] GetProcessHeap () returned 0xd20000 [0105.767] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0105.767] GetProcessHeap () returned 0xd20000 [0105.767] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.767] GetProcessHeap () returned 0xd20000 [0105.767] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.767] GetProcessHeap () returned 0xd20000 [0105.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.768] GetProcessHeap () returned 0xd20000 [0105.768] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.768] GetProcessHeap () returned 0xd20000 [0105.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0105.768] GetProcessHeap () returned 0xd20000 [0105.768] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0105.768] GetProcessHeap () returned 0xd20000 [0105.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0105.768] GetProcessHeap () returned 0xd20000 [0105.768] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0105.768] GetProcessHeap () returned 0xd20000 [0105.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.768] GetProcessHeap () returned 0xd20000 [0105.768] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.768] GetProcessHeap () returned 0xd20000 [0105.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0105.768] GetProcessHeap () returned 0xd20000 [0105.768] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0105.768] GetProcessHeap () returned 0xd20000 [0105.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0105.769] GetProcessHeap () returned 0xd20000 [0105.769] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0105.769] GetProcessHeap () returned 0xd20000 [0105.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0105.769] GetProcessHeap () returned 0xd20000 [0105.769] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0105.769] GetProcessHeap () returned 0xd20000 [0105.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.769] GetProcessHeap () returned 0xd20000 [0105.769] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.769] GetProcessHeap () returned 0xd20000 [0105.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0105.769] GetProcessHeap () returned 0xd20000 [0105.769] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0105.769] GetProcessHeap () returned 0xd20000 [0105.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0105.769] GetProcessHeap () returned 0xd20000 [0105.769] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0105.769] GetProcessHeap () returned 0xd20000 [0105.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0105.770] GetProcessHeap () returned 0xd20000 [0105.770] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0105.770] GetProcessHeap () returned 0xd20000 [0105.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0105.770] GetProcessHeap () returned 0xd20000 [0105.770] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0105.770] GetProcessHeap () returned 0xd20000 [0105.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0105.770] GetProcessHeap () returned 0xd20000 [0105.770] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0105.770] GetProcessHeap () returned 0xd20000 [0105.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0105.770] GetProcessHeap () returned 0xd20000 [0105.770] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0105.770] GetProcessHeap () returned 0xd20000 [0105.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.770] GetProcessHeap () returned 0xd20000 [0105.770] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.770] GetProcessHeap () returned 0xd20000 [0105.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0105.770] GetProcessHeap () returned 0xd20000 [0105.771] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0105.771] GetProcessHeap () returned 0xd20000 [0105.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0105.771] GetProcessHeap () returned 0xd20000 [0105.771] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0105.771] GetProcessHeap () returned 0xd20000 [0105.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.771] GetProcessHeap () returned 0xd20000 [0105.771] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.771] GetProcessHeap () returned 0xd20000 [0105.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0105.771] GetProcessHeap () returned 0xd20000 [0105.771] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0105.771] GetProcessHeap () returned 0xd20000 [0105.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0105.771] GetProcessHeap () returned 0xd20000 [0105.771] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0105.771] GetProcessHeap () returned 0xd20000 [0105.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.771] GetProcessHeap () returned 0xd20000 [0105.772] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.772] GetProcessHeap () returned 0xd20000 [0105.772] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.772] GetProcessHeap () returned 0xd20000 [0105.772] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.772] GetProcessHeap () returned 0xd20000 [0105.772] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0105.772] GetProcessHeap () returned 0xd20000 [0105.772] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0105.772] GetProcessHeap () returned 0xd20000 [0105.772] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0105.772] GetProcessHeap () returned 0xd20000 [0105.772] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0105.772] GetProcessHeap () returned 0xd20000 [0105.772] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0105.772] GetProcessHeap () returned 0xd20000 [0105.772] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0105.772] GetProcessHeap () returned 0xd20000 [0105.772] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0105.772] GetProcessHeap () returned 0xd20000 [0105.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0105.773] GetProcessHeap () returned 0xd20000 [0105.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0105.773] GetProcessHeap () returned 0xd20000 [0105.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0105.773] GetProcessHeap () returned 0xd20000 [0105.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0105.773] GetProcessHeap () returned 0xd20000 [0105.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0105.773] GetProcessHeap () returned 0xd20000 [0105.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0105.773] GetProcessHeap () returned 0xd20000 [0105.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0105.773] GetProcessHeap () returned 0xd20000 [0105.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.773] GetProcessHeap () returned 0xd20000 [0105.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.773] GetProcessHeap () returned 0xd20000 [0105.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0105.773] GetProcessHeap () returned 0xd20000 [0105.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0105.774] GetProcessHeap () returned 0xd20000 [0105.774] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0105.774] GetProcessHeap () returned 0xd20000 [0105.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0105.774] GetProcessHeap () returned 0xd20000 [0105.774] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0105.774] GetProcessHeap () returned 0xd20000 [0105.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0105.774] GetProcessHeap () returned 0xd20000 [0105.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0105.774] GetProcessHeap () returned 0xd20000 [0105.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0105.774] GetProcessHeap () returned 0xd20000 [0105.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0105.774] GetProcessHeap () returned 0xd20000 [0105.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0105.774] GetProcessHeap () returned 0xd20000 [0105.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44690 | out: hHeap=0xd20000) returned 1 [0105.774] GetProcessHeap () returned 0xd20000 [0105.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b008 | out: hHeap=0xd20000) returned 1 [0105.775] GetProcessHeap () returned 0xd20000 [0105.775] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0105.775] GetProcessHeap () returned 0xd20000 [0105.775] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a948 | out: hHeap=0xd20000) returned 1 [0105.775] GetProcessHeap () returned 0xd20000 [0105.775] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0105.775] GetProcessHeap () returned 0xd20000 [0105.775] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0105.775] GetProcessHeap () returned 0xd20000 [0105.775] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0105.775] WriteFile (in: hFile=0x230, lpBuffer=0xd4edd0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4edd0*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0106.123] GetProcessHeap () returned 0xd20000 [0106.123] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4edd0, Size=0x30) returned 0xd4edd0 [0106.123] GetProcessHeap () returned 0xd20000 [0106.123] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0106.124] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0106.124] GetProcessHeap () returned 0xd20000 [0106.124] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x16e6c) returned 0xd4ee08 [0106.124] ReadFile (in: hFile=0x230, lpBuffer=0xd4ee08, nNumberOfBytesToRead=0x16e6c, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4ee08*, lpNumberOfBytesRead=0x299d7e8*=0x16e6c, lpOverlapped=0x0) returned 1 [0106.127] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0106.127] WriteFile (in: hFile=0x230, lpBuffer=0xd4ee08*, nNumberOfBytesToWrite=0x16e6c, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4ee08*, lpNumberOfBytesWritten=0x299d7e4*=0x16e6c, lpOverlapped=0x0) returned 1 [0106.130] GetProcessHeap () returned 0xd20000 [0106.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ee08 | out: hHeap=0xd20000) returned 1 [0106.130] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0106.130] WriteFile (in: hFile=0x230, lpBuffer=0xd4edd0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4edd0*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0106.132] CloseHandle (hObject=0x230) returned 1 [0106.143] GetProcessHeap () returned 0xd20000 [0106.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd424e0 | out: hHeap=0xd20000) returned 1 [0106.143] GetProcessHeap () returned 0xd20000 [0106.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4be18 | out: hHeap=0xd20000) returned 1 [0106.143] GetProcessHeap () returned 0xd20000 [0106.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0106.143] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\8B0nR6.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\8B0nR6.mkv") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\8B0nR6.mkv" [0106.143] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\8B0nR6.mkv", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\8B0nR6.mkv.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\8B0nR6.mkv.[ponce.lorena@aol.com]" [0106.143] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\8B0nR6.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\wr_a7iufou\\8b0nr6.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\8B0nR6.mkv.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\wr_a7iufou\\8b0nr6.mkv.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0106.145] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\8B0nR6.mkv" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou") returned 1 [0106.145] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\") returned="" [0106.145] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\HOW_RECOVER.html" [0106.145] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\wr_a7iufou\\how_recover.html")) returned 0x20 [0106.145] GetProcessHeap () returned 0xd20000 [0106.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44678 | out: hHeap=0xd20000) returned 1 [0106.145] FindNextFileW (in: hFindFile=0xd48de0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c924d70, ftCreationTime.dwHighDateTime=0x1d4d35b, ftLastAccessTime.dwLowDateTime=0xbabec9d0, ftLastAccessTime.dwHighDateTime=0x1d4d2bb, ftLastWriteTime.dwLowDateTime=0xbabec9d0, ftLastWriteTime.dwHighDateTime=0x1d4d2bb, nFileSizeHigh=0x0, nFileSizeLow=0x6d3b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="M 0Mxilr2.mp4", cAlternateFileName="M0MXIL~1.MP4")) returned 1 [0106.145] lstrcmpiW (lpString1="M 0Mxilr2.mp4", lpString2=".") returned 1 [0106.145] lstrcmpiW (lpString1="M 0Mxilr2.mp4", lpString2="..") returned 1 [0106.145] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\", lpString2="M 0Mxilr2.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\M 0Mxilr2.mp4") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\M 0Mxilr2.mp4" [0106.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="M 0Mxilr2.mp4", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0106.146] GetProcessHeap () returned 0xd20000 [0106.146] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xe) returned 0xd445b8 [0106.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="M 0Mxilr2.mp4", cchWideChar=-1, lpMultiByteStr=0xd445b8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M 0Mxilr2.mp4", lpUsedDefaultChar=0x0) returned 14 [0106.146] lstrlenA (lpString="M 0Mxilr2.mp4") returned 13 [0106.146] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0106.146] lstrlenA (lpString="M 0Mxilr2.mp4") returned 13 [0106.146] lstrlenA (lpString=".dll") returned 4 [0106.146] lstrlenA (lpString=".dll") returned 4 [0106.146] lstrlenA (lpString="M 0Mxilr2.mp4") returned 13 [0106.146] lstrcmpiA (lpString1=".mp4", lpString2=".dll") returned 1 [0106.146] lstrlenA (lpString="M 0Mxilr2.mp4") returned 13 [0106.146] lstrlenA (lpString=".ini") returned 4 [0106.146] lstrlenA (lpString=".ini") returned 4 [0106.146] lstrlenA (lpString="M 0Mxilr2.mp4") returned 13 [0106.146] lstrcmpiA (lpString1=".mp4", lpString2=".ini") returned 1 [0106.146] lstrlenA (lpString="M 0Mxilr2.mp4") returned 13 [0106.146] lstrlenA (lpString=".inc") returned 4 [0106.146] lstrlenA (lpString=".inc") returned 4 [0106.147] lstrlenA (lpString="M 0Mxilr2.mp4") returned 13 [0106.147] lstrcmpiA (lpString1=".mp4", lpString2=".inc") returned 1 [0106.147] lstrcmpiW (lpString1="M 0Mxilr2.mp4", lpString2="HOW_RECOVER.html") returned 1 [0106.147] lstrcmpiW (lpString1="M 0Mxilr2.mp4", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0106.147] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0106.147] lstrcmpiW (lpString1="M 0Mxilr2.mp4", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0106.147] GetProcessHeap () returned 0xd20000 [0106.147] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42788 [0106.147] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\M 0Mxilr2.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\wr_a7iufou\\m 0mxilr2.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0106.147] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=27963) returned 1 [0106.147] GetProcessHeap () returned 0xd20000 [0106.147] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c250 [0106.147] GetProcessHeap () returned 0xd20000 [0106.147] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0106.148] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\M 0Mxilr2.mp4") returned 61 [0106.148] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0106.148] GetProcessHeap () returned 0xd20000 [0106.148] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0106.148] GetProcessHeap () returned 0xd20000 [0106.148] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4ee08 [0106.157] lstrlenA (lpString="rsa_encrypt") returned 11 [0106.157] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0106.159] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0106.159] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0106.159] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0106.159] GetProcessHeap () returned 0xd20000 [0106.159] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0106.160] lstrlenA (lpString="010001") returned 6 [0106.160] GetProcessHeap () returned 0xd20000 [0106.160] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cdf8 [0106.160] GetProcessHeap () returned 0xd20000 [0106.160] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0106.160] GetProcessHeap () returned 0xd20000 [0106.160] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b248 [0106.160] GetProcessHeap () returned 0xd20000 [0106.160] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0106.160] GetProcessHeap () returned 0xd20000 [0106.160] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aee8 [0106.160] GetProcessHeap () returned 0xd20000 [0106.160] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd450c8 [0106.160] GetProcessHeap () returned 0xd20000 [0106.160] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cee8 [0106.160] GetProcessHeap () returned 0xd20000 [0106.160] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0106.160] GetProcessHeap () returned 0xd20000 [0106.161] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0106.161] GetProcessHeap () returned 0xd20000 [0106.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0106.161] GetProcessHeap () returned 0xd20000 [0106.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0106.161] GetProcessHeap () returned 0xd20000 [0106.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd45410 [0106.161] GetProcessHeap () returned 0xd20000 [0106.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0106.161] GetProcessHeap () returned 0xd20000 [0106.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44408 [0106.161] GetProcessHeap () returned 0xd20000 [0106.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4adc8 [0106.161] GetProcessHeap () returned 0xd20000 [0106.161] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0106.161] GetProcessHeap () returned 0xd20000 [0106.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0106.161] GetProcessHeap () returned 0xd20000 [0106.161] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4adc8 | out: hHeap=0xd20000) returned 1 [0106.162] GetProcessHeap () returned 0xd20000 [0106.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.162] GetProcessHeap () returned 0xd20000 [0106.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445e8 [0106.162] GetProcessHeap () returned 0xd20000 [0106.162] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0106.162] GetProcessHeap () returned 0xd20000 [0106.162] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.162] GetProcessHeap () returned 0xd20000 [0106.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.162] GetProcessHeap () returned 0xd20000 [0106.162] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.162] GetProcessHeap () returned 0xd20000 [0106.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0106.162] GetProcessHeap () returned 0xd20000 [0106.162] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0106.162] GetProcessHeap () returned 0xd20000 [0106.163] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b518 [0106.163] GetProcessHeap () returned 0xd20000 [0106.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445e8 | out: hHeap=0xd20000) returned 1 [0106.163] GetProcessHeap () returned 0xd20000 [0106.163] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0106.163] GetProcessHeap () returned 0xd20000 [0106.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0106.163] GetProcessHeap () returned 0xd20000 [0106.163] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0106.163] GetProcessHeap () returned 0xd20000 [0106.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0106.163] GetProcessHeap () returned 0xd20000 [0106.163] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0106.163] GetProcessHeap () returned 0xd20000 [0106.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0106.163] GetProcessHeap () returned 0xd20000 [0106.163] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0106.163] GetProcessHeap () returned 0xd20000 [0106.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0106.164] GetProcessHeap () returned 0xd20000 [0106.164] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0106.164] GetProcessHeap () returned 0xd20000 [0106.164] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.164] GetProcessHeap () returned 0xd20000 [0106.164] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.164] GetProcessHeap () returned 0xd20000 [0106.164] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.164] GetProcessHeap () returned 0xd20000 [0106.164] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0106.164] GetProcessHeap () returned 0xd20000 [0106.164] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.164] GetProcessHeap () returned 0xd20000 [0106.164] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.164] GetProcessHeap () returned 0xd20000 [0106.164] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.164] GetProcessHeap () returned 0xd20000 [0106.164] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0106.164] GetProcessHeap () returned 0xd20000 [0106.164] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0106.164] GetProcessHeap () returned 0xd20000 [0106.164] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0106.164] GetProcessHeap () returned 0xd20000 [0106.165] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.165] GetProcessHeap () returned 0xd20000 [0106.165] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0106.165] GetProcessHeap () returned 0xd20000 [0106.165] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0106.165] GetProcessHeap () returned 0xd20000 [0106.165] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0106.165] GetProcessHeap () returned 0xd20000 [0106.165] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0106.165] GetProcessHeap () returned 0xd20000 [0106.165] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0106.165] GetProcessHeap () returned 0xd20000 [0106.165] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0106.165] GetProcessHeap () returned 0xd20000 [0106.165] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.165] GetProcessHeap () returned 0xd20000 [0106.165] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.165] GetProcessHeap () returned 0xd20000 [0106.165] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0106.165] GetProcessHeap () returned 0xd20000 [0106.166] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0106.166] GetProcessHeap () returned 0xd20000 [0106.166] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.166] GetProcessHeap () returned 0xd20000 [0106.166] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.166] GetProcessHeap () returned 0xd20000 [0106.166] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0106.166] GetProcessHeap () returned 0xd20000 [0106.166] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0106.166] GetProcessHeap () returned 0xd20000 [0106.167] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.167] GetProcessHeap () returned 0xd20000 [0106.167] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.167] GetProcessHeap () returned 0xd20000 [0106.167] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0106.167] GetProcessHeap () returned 0xd20000 [0106.167] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.167] GetProcessHeap () returned 0xd20000 [0106.167] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.167] GetProcessHeap () returned 0xd20000 [0106.167] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.167] GetProcessHeap () returned 0xd20000 [0106.167] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0106.167] GetProcessHeap () returned 0xd20000 [0106.167] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0106.167] GetProcessHeap () returned 0xd20000 [0106.167] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.167] GetProcessHeap () returned 0xd20000 [0106.167] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.168] GetProcessHeap () returned 0xd20000 [0106.168] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.168] GetProcessHeap () returned 0xd20000 [0106.168] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.168] GetProcessHeap () returned 0xd20000 [0106.168] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.168] GetProcessHeap () returned 0xd20000 [0106.168] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.168] GetProcessHeap () returned 0xd20000 [0106.168] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0106.168] GetProcessHeap () returned 0xd20000 [0106.168] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0106.168] GetProcessHeap () returned 0xd20000 [0106.168] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.168] GetProcessHeap () returned 0xd20000 [0106.168] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.168] GetProcessHeap () returned 0xd20000 [0106.168] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0106.168] GetProcessHeap () returned 0xd20000 [0106.168] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0106.169] GetProcessHeap () returned 0xd20000 [0106.169] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0106.169] GetProcessHeap () returned 0xd20000 [0106.169] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0106.169] GetProcessHeap () returned 0xd20000 [0106.169] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0106.169] GetProcessHeap () returned 0xd20000 [0106.169] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0106.169] GetProcessHeap () returned 0xd20000 [0106.169] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.169] GetProcessHeap () returned 0xd20000 [0106.169] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.169] GetProcessHeap () returned 0xd20000 [0106.169] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0106.169] GetProcessHeap () returned 0xd20000 [0106.169] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0106.169] GetProcessHeap () returned 0xd20000 [0106.169] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0106.169] GetProcessHeap () returned 0xd20000 [0106.170] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0106.170] GetProcessHeap () returned 0xd20000 [0106.170] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.170] GetProcessHeap () returned 0xd20000 [0106.170] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.170] GetProcessHeap () returned 0xd20000 [0106.170] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0106.170] GetProcessHeap () returned 0xd20000 [0106.170] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0106.170] GetProcessHeap () returned 0xd20000 [0106.170] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.170] GetProcessHeap () returned 0xd20000 [0106.170] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.170] GetProcessHeap () returned 0xd20000 [0106.170] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.170] GetProcessHeap () returned 0xd20000 [0106.170] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.170] GetProcessHeap () returned 0xd20000 [0106.170] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.171] GetProcessHeap () returned 0xd20000 [0106.171] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.171] GetProcessHeap () returned 0xd20000 [0106.171] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.171] GetProcessHeap () returned 0xd20000 [0106.171] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.171] GetProcessHeap () returned 0xd20000 [0106.171] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0106.171] GetProcessHeap () returned 0xd20000 [0106.171] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0106.171] GetProcessHeap () returned 0xd20000 [0106.171] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0106.171] GetProcessHeap () returned 0xd20000 [0106.171] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0106.171] GetProcessHeap () returned 0xd20000 [0106.171] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0106.171] GetProcessHeap () returned 0xd20000 [0106.171] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0106.171] GetProcessHeap () returned 0xd20000 [0106.172] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.172] GetProcessHeap () returned 0xd20000 [0106.172] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.172] GetProcessHeap () returned 0xd20000 [0106.172] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.172] GetProcessHeap () returned 0xd20000 [0106.172] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.172] GetProcessHeap () returned 0xd20000 [0106.172] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0106.172] GetProcessHeap () returned 0xd20000 [0106.172] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0106.172] GetProcessHeap () returned 0xd20000 [0106.172] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0106.172] GetProcessHeap () returned 0xd20000 [0106.172] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0106.172] GetProcessHeap () returned 0xd20000 [0106.172] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0106.172] GetProcessHeap () returned 0xd20000 [0106.172] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0106.172] GetProcessHeap () returned 0xd20000 [0106.172] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.172] GetProcessHeap () returned 0xd20000 [0106.173] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.173] GetProcessHeap () returned 0xd20000 [0106.173] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.173] GetProcessHeap () returned 0xd20000 [0106.173] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.173] GetProcessHeap () returned 0xd20000 [0106.173] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.173] GetProcessHeap () returned 0xd20000 [0106.173] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.173] GetProcessHeap () returned 0xd20000 [0106.173] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.173] GetProcessHeap () returned 0xd20000 [0106.173] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.173] GetProcessHeap () returned 0xd20000 [0106.173] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0106.173] GetProcessHeap () returned 0xd20000 [0106.173] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0106.173] GetProcessHeap () returned 0xd20000 [0106.173] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0106.173] GetProcessHeap () returned 0xd20000 [0106.174] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0106.174] GetProcessHeap () returned 0xd20000 [0106.174] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0106.174] GetProcessHeap () returned 0xd20000 [0106.174] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0106.174] GetProcessHeap () returned 0xd20000 [0106.174] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0106.174] GetProcessHeap () returned 0xd20000 [0106.174] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0106.174] GetProcessHeap () returned 0xd20000 [0106.174] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.174] GetProcessHeap () returned 0xd20000 [0106.174] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.174] GetProcessHeap () returned 0xd20000 [0106.174] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.174] GetProcessHeap () returned 0xd20000 [0106.174] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.174] GetProcessHeap () returned 0xd20000 [0106.174] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.174] GetProcessHeap () returned 0xd20000 [0106.175] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.175] GetProcessHeap () returned 0xd20000 [0106.175] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0106.175] GetProcessHeap () returned 0xd20000 [0106.175] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0106.175] GetProcessHeap () returned 0xd20000 [0106.175] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0106.175] GetProcessHeap () returned 0xd20000 [0106.175] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0106.175] GetProcessHeap () returned 0xd20000 [0106.175] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.175] GetProcessHeap () returned 0xd20000 [0106.175] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.175] GetProcessHeap () returned 0xd20000 [0106.175] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0106.175] GetProcessHeap () returned 0xd20000 [0106.175] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0106.175] GetProcessHeap () returned 0xd20000 [0106.175] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.176] GetProcessHeap () returned 0xd20000 [0106.176] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.176] GetProcessHeap () returned 0xd20000 [0106.176] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.176] GetProcessHeap () returned 0xd20000 [0106.176] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.176] GetProcessHeap () returned 0xd20000 [0106.176] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0106.176] GetProcessHeap () returned 0xd20000 [0106.176] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0106.176] GetProcessHeap () returned 0xd20000 [0106.176] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0106.176] GetProcessHeap () returned 0xd20000 [0106.176] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0106.176] GetProcessHeap () returned 0xd20000 [0106.176] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0106.176] GetProcessHeap () returned 0xd20000 [0106.176] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0106.176] GetProcessHeap () returned 0xd20000 [0106.176] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0106.176] GetProcessHeap () returned 0xd20000 [0106.177] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0106.177] GetProcessHeap () returned 0xd20000 [0106.177] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.177] GetProcessHeap () returned 0xd20000 [0106.177] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.177] GetProcessHeap () returned 0xd20000 [0106.177] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0106.177] GetProcessHeap () returned 0xd20000 [0106.177] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0106.177] GetProcessHeap () returned 0xd20000 [0106.177] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.177] GetProcessHeap () returned 0xd20000 [0106.177] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.177] GetProcessHeap () returned 0xd20000 [0106.177] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0106.177] GetProcessHeap () returned 0xd20000 [0106.177] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0106.177] GetProcessHeap () returned 0xd20000 [0106.177] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0106.177] GetProcessHeap () returned 0xd20000 [0106.177] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.178] GetProcessHeap () returned 0xd20000 [0106.178] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.178] GetProcessHeap () returned 0xd20000 [0106.178] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.178] GetProcessHeap () returned 0xd20000 [0106.178] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0106.178] GetProcessHeap () returned 0xd20000 [0106.178] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0106.178] GetProcessHeap () returned 0xd20000 [0106.178] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.178] GetProcessHeap () returned 0xd20000 [0106.178] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.178] GetProcessHeap () returned 0xd20000 [0106.178] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0106.178] GetProcessHeap () returned 0xd20000 [0106.178] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0106.178] GetProcessHeap () returned 0xd20000 [0106.178] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.178] GetProcessHeap () returned 0xd20000 [0106.178] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.179] GetProcessHeap () returned 0xd20000 [0106.179] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0106.179] GetProcessHeap () returned 0xd20000 [0106.179] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0106.179] GetProcessHeap () returned 0xd20000 [0106.179] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.179] GetProcessHeap () returned 0xd20000 [0106.179] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.179] GetProcessHeap () returned 0xd20000 [0106.179] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0106.179] GetProcessHeap () returned 0xd20000 [0106.179] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0106.179] GetProcessHeap () returned 0xd20000 [0106.179] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.179] GetProcessHeap () returned 0xd20000 [0106.179] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.179] GetProcessHeap () returned 0xd20000 [0106.179] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.179] GetProcessHeap () returned 0xd20000 [0106.179] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.180] GetProcessHeap () returned 0xd20000 [0106.180] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.180] GetProcessHeap () returned 0xd20000 [0106.180] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.180] GetProcessHeap () returned 0xd20000 [0106.180] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.180] GetProcessHeap () returned 0xd20000 [0106.180] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.180] GetProcessHeap () returned 0xd20000 [0106.180] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.180] GetProcessHeap () returned 0xd20000 [0106.180] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.180] GetProcessHeap () returned 0xd20000 [0106.180] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0106.180] GetProcessHeap () returned 0xd20000 [0106.180] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0106.180] GetProcessHeap () returned 0xd20000 [0106.180] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0106.180] GetProcessHeap () returned 0xd20000 [0106.180] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0106.181] GetProcessHeap () returned 0xd20000 [0106.181] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0106.181] GetProcessHeap () returned 0xd20000 [0106.181] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0106.181] GetProcessHeap () returned 0xd20000 [0106.181] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44408 | out: hHeap=0xd20000) returned 1 [0106.181] GetProcessHeap () returned 0xd20000 [0106.181] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aee8 | out: hHeap=0xd20000) returned 1 [0106.181] GetProcessHeap () returned 0xd20000 [0106.181] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0106.181] GetProcessHeap () returned 0xd20000 [0106.181] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b248 | out: hHeap=0xd20000) returned 1 [0106.181] GetProcessHeap () returned 0xd20000 [0106.181] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0106.181] GetProcessHeap () returned 0xd20000 [0106.181] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0106.268] GetProcessHeap () returned 0xd20000 [0106.268] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0106.268] WriteFile (in: hFile=0x230, lpBuffer=0xd4ee08*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ee08*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0106.323] GetProcessHeap () returned 0xd20000 [0106.324] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4ee08, Size=0x30) returned 0xd4ee08 [0106.324] GetProcessHeap () returned 0xd20000 [0106.324] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0106.324] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0106.324] GetProcessHeap () returned 0xd20000 [0106.324] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x6d3b) returned 0xd4ee40 [0106.324] ReadFile (in: hFile=0x230, lpBuffer=0xd4ee40, nNumberOfBytesToRead=0x6d3b, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4ee40*, lpNumberOfBytesRead=0x299d7e8*=0x6d3b, lpOverlapped=0x0) returned 1 [0106.325] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0106.325] WriteFile (in: hFile=0x230, lpBuffer=0xd4ee40*, nNumberOfBytesToWrite=0x6d3b, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4ee40*, lpNumberOfBytesWritten=0x299d7e4*=0x6d3b, lpOverlapped=0x0) returned 1 [0106.327] GetProcessHeap () returned 0xd20000 [0106.327] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ee40 | out: hHeap=0xd20000) returned 1 [0106.328] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0106.328] WriteFile (in: hFile=0x230, lpBuffer=0xd4ee08*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ee08*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0106.330] CloseHandle (hObject=0x230) returned 1 [0106.341] GetProcessHeap () returned 0xd20000 [0106.342] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42788 | out: hHeap=0xd20000) returned 1 [0106.342] GetProcessHeap () returned 0xd20000 [0106.342] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c250 | out: hHeap=0xd20000) returned 1 [0106.342] GetProcessHeap () returned 0xd20000 [0106.342] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0106.342] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\M 0Mxilr2.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\M 0Mxilr2.mp4") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\M 0Mxilr2.mp4" [0106.342] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\M 0Mxilr2.mp4", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\M 0Mxilr2.mp4.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\M 0Mxilr2.mp4.[ponce.lorena@aol.com]" [0106.342] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\M 0Mxilr2.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\wr_a7iufou\\m 0mxilr2.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\M 0Mxilr2.mp4.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\wr_a7iufou\\m 0mxilr2.mp4.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0106.343] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\M 0Mxilr2.mp4" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou") returned 1 [0106.343] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\") returned="" [0106.343] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\HOW_RECOVER.html" [0106.343] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\wr_a7iufou\\how_recover.html")) returned 0x20 [0106.343] GetProcessHeap () returned 0xd20000 [0106.343] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445b8 | out: hHeap=0xd20000) returned 1 [0106.343] FindNextFileW (in: hFindFile=0xd48de0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4209c80, ftCreationTime.dwHighDateTime=0x1d4d4cc, ftLastAccessTime.dwLowDateTime=0xc2a0bf0, ftLastAccessTime.dwHighDateTime=0x1d4d527, ftLastWriteTime.dwLowDateTime=0xc2a0bf0, ftLastWriteTime.dwHighDateTime=0x1d4d527, nFileSizeHigh=0x0, nFileSizeLow=0x14247, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rVOum.mp4", cAlternateFileName="")) returned 1 [0106.344] lstrcmpiW (lpString1="rVOum.mp4", lpString2=".") returned 1 [0106.344] lstrcmpiW (lpString1="rVOum.mp4", lpString2="..") returned 1 [0106.344] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\", lpString2="rVOum.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\rVOum.mp4") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\rVOum.mp4" [0106.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rVOum.mp4", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0106.344] GetProcessHeap () returned 0xd20000 [0106.344] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xa) returned 0xd44570 [0106.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="rVOum.mp4", cchWideChar=-1, lpMultiByteStr=0xd44570, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="rVOum.mp4", lpUsedDefaultChar=0x0) returned 10 [0106.344] lstrlenA (lpString="rVOum.mp4") returned 9 [0106.344] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0106.344] lstrlenA (lpString="rVOum.mp4") returned 9 [0106.344] lstrlenA (lpString=".dll") returned 4 [0106.344] lstrlenA (lpString=".dll") returned 4 [0106.344] lstrlenA (lpString="rVOum.mp4") returned 9 [0106.344] lstrcmpiA (lpString1=".mp4", lpString2=".dll") returned 1 [0106.344] lstrlenA (lpString="rVOum.mp4") returned 9 [0106.345] lstrlenA (lpString=".ini") returned 4 [0106.345] lstrlenA (lpString=".ini") returned 4 [0106.345] lstrlenA (lpString="rVOum.mp4") returned 9 [0106.345] lstrcmpiA (lpString1=".mp4", lpString2=".ini") returned 1 [0106.345] lstrlenA (lpString="rVOum.mp4") returned 9 [0106.345] lstrlenA (lpString=".inc") returned 4 [0106.345] lstrlenA (lpString=".inc") returned 4 [0106.345] lstrlenA (lpString="rVOum.mp4") returned 9 [0106.345] lstrcmpiA (lpString1=".mp4", lpString2=".inc") returned 1 [0106.345] lstrcmpiW (lpString1="rVOum.mp4", lpString2="HOW_RECOVER.html") returned 1 [0106.345] lstrcmpiW (lpString1="rVOum.mp4", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0106.345] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0106.345] lstrcmpiW (lpString1="rVOum.mp4", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0106.345] GetProcessHeap () returned 0xd20000 [0106.345] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42738 [0106.345] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\rVOum.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\wr_a7iufou\\rvoum.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0106.346] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=82503) returned 1 [0106.346] GetProcessHeap () returned 0xd20000 [0106.346] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c070 [0106.346] GetProcessHeap () returned 0xd20000 [0106.346] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0106.346] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\rVOum.mp4") returned 57 [0106.346] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0106.346] GetProcessHeap () returned 0xd20000 [0106.346] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0106.346] GetProcessHeap () returned 0xd20000 [0106.346] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x389) returned 0xd4ee40 [0106.347] lstrlenA (lpString="rsa_encrypt") returned 11 [0106.347] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0106.349] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0106.349] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0106.349] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0106.349] GetProcessHeap () returned 0xd20000 [0106.349] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0106.349] lstrlenA (lpString="010001") returned 6 [0106.349] GetProcessHeap () returned 0xd20000 [0106.349] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ce88 [0106.349] GetProcessHeap () returned 0xd20000 [0106.349] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0106.349] GetProcessHeap () returned 0xd20000 [0106.350] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b248 [0106.350] GetProcessHeap () returned 0xd20000 [0106.350] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0106.350] GetProcessHeap () returned 0xd20000 [0106.350] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4af78 [0106.350] GetProcessHeap () returned 0xd20000 [0106.350] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44fb0 [0106.350] GetProcessHeap () returned 0xd20000 [0106.350] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cf68 [0106.350] GetProcessHeap () returned 0xd20000 [0106.350] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0106.350] GetProcessHeap () returned 0xd20000 [0106.350] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.350] GetProcessHeap () returned 0xd20000 [0106.350] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0106.350] GetProcessHeap () returned 0xd20000 [0106.350] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0106.350] GetProcessHeap () returned 0xd20000 [0106.350] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44d80 [0106.350] GetProcessHeap () returned 0xd20000 [0106.351] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.351] GetProcessHeap () returned 0xd20000 [0106.351] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445d0 [0106.351] GetProcessHeap () returned 0xd20000 [0106.351] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ae58 [0106.351] GetProcessHeap () returned 0xd20000 [0106.351] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0106.351] GetProcessHeap () returned 0xd20000 [0106.351] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0106.351] GetProcessHeap () returned 0xd20000 [0106.351] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ae58 | out: hHeap=0xd20000) returned 1 [0106.351] GetProcessHeap () returned 0xd20000 [0106.351] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0106.351] GetProcessHeap () returned 0xd20000 [0106.351] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44408 [0106.351] GetProcessHeap () returned 0xd20000 [0106.351] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.351] GetProcessHeap () returned 0xd20000 [0106.351] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0106.351] GetProcessHeap () returned 0xd20000 [0106.352] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.352] GetProcessHeap () returned 0xd20000 [0106.352] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.352] GetProcessHeap () returned 0xd20000 [0106.352] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.352] GetProcessHeap () returned 0xd20000 [0106.352] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.352] GetProcessHeap () returned 0xd20000 [0106.352] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b518 [0106.352] GetProcessHeap () returned 0xd20000 [0106.352] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44408 | out: hHeap=0xd20000) returned 1 [0106.352] GetProcessHeap () returned 0xd20000 [0106.352] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0106.352] GetProcessHeap () returned 0xd20000 [0106.352] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0106.352] GetProcessHeap () returned 0xd20000 [0106.352] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0106.352] GetProcessHeap () returned 0xd20000 [0106.352] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0106.352] GetProcessHeap () returned 0xd20000 [0106.353] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.353] GetProcessHeap () returned 0xd20000 [0106.353] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.353] GetProcessHeap () returned 0xd20000 [0106.353] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0106.353] GetProcessHeap () returned 0xd20000 [0106.353] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0106.353] GetProcessHeap () returned 0xd20000 [0106.353] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.353] GetProcessHeap () returned 0xd20000 [0106.353] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.353] GetProcessHeap () returned 0xd20000 [0106.353] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.353] GetProcessHeap () returned 0xd20000 [0106.353] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.353] GetProcessHeap () returned 0xd20000 [0106.353] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0106.354] GetProcessHeap () returned 0xd20000 [0106.354] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0106.354] GetProcessHeap () returned 0xd20000 [0106.354] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.354] GetProcessHeap () returned 0xd20000 [0106.354] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.354] GetProcessHeap () returned 0xd20000 [0106.354] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.354] GetProcessHeap () returned 0xd20000 [0106.354] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.354] GetProcessHeap () returned 0xd20000 [0106.354] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0106.354] GetProcessHeap () returned 0xd20000 [0106.354] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0106.354] GetProcessHeap () returned 0xd20000 [0106.354] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0106.354] GetProcessHeap () returned 0xd20000 [0106.354] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0106.354] GetProcessHeap () returned 0xd20000 [0106.354] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0106.355] GetProcessHeap () returned 0xd20000 [0106.355] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0106.355] GetProcessHeap () returned 0xd20000 [0106.355] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.355] GetProcessHeap () returned 0xd20000 [0106.355] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.355] GetProcessHeap () returned 0xd20000 [0106.355] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0106.355] GetProcessHeap () returned 0xd20000 [0106.355] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0106.355] GetProcessHeap () returned 0xd20000 [0106.355] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.355] GetProcessHeap () returned 0xd20000 [0106.355] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.355] GetProcessHeap () returned 0xd20000 [0106.355] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0106.355] GetProcessHeap () returned 0xd20000 [0106.355] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0106.355] GetProcessHeap () returned 0xd20000 [0106.355] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0106.356] GetProcessHeap () returned 0xd20000 [0106.356] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.356] GetProcessHeap () returned 0xd20000 [0106.356] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0106.356] GetProcessHeap () returned 0xd20000 [0106.356] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0106.356] GetProcessHeap () returned 0xd20000 [0106.356] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0106.356] GetProcessHeap () returned 0xd20000 [0106.356] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0106.356] GetProcessHeap () returned 0xd20000 [0106.356] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0106.356] GetProcessHeap () returned 0xd20000 [0106.356] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0106.356] GetProcessHeap () returned 0xd20000 [0106.356] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0106.356] GetProcessHeap () returned 0xd20000 [0106.356] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0106.356] GetProcessHeap () returned 0xd20000 [0106.356] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.357] GetProcessHeap () returned 0xd20000 [0106.357] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.357] GetProcessHeap () returned 0xd20000 [0106.357] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0106.357] GetProcessHeap () returned 0xd20000 [0106.357] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.357] GetProcessHeap () returned 0xd20000 [0106.357] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0106.357] GetProcessHeap () returned 0xd20000 [0106.357] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0106.357] GetProcessHeap () returned 0xd20000 [0106.357] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0106.357] GetProcessHeap () returned 0xd20000 [0106.357] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.357] GetProcessHeap () returned 0xd20000 [0106.357] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0106.357] GetProcessHeap () returned 0xd20000 [0106.357] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0106.357] GetProcessHeap () returned 0xd20000 [0106.357] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0106.358] GetProcessHeap () returned 0xd20000 [0106.358] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0106.358] GetProcessHeap () returned 0xd20000 [0106.358] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0106.358] GetProcessHeap () returned 0xd20000 [0106.358] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.358] GetProcessHeap () returned 0xd20000 [0106.358] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.358] GetProcessHeap () returned 0xd20000 [0106.358] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.358] GetProcessHeap () returned 0xd20000 [0106.358] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0106.358] GetProcessHeap () returned 0xd20000 [0106.358] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0106.358] GetProcessHeap () returned 0xd20000 [0106.358] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0106.358] GetProcessHeap () returned 0xd20000 [0106.358] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.359] GetProcessHeap () returned 0xd20000 [0106.359] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0106.359] GetProcessHeap () returned 0xd20000 [0106.359] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0106.359] GetProcessHeap () returned 0xd20000 [0106.359] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0106.359] GetProcessHeap () returned 0xd20000 [0106.359] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.359] GetProcessHeap () returned 0xd20000 [0106.359] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.359] GetProcessHeap () returned 0xd20000 [0106.359] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.359] GetProcessHeap () returned 0xd20000 [0106.359] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.359] GetProcessHeap () returned 0xd20000 [0106.359] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.359] GetProcessHeap () returned 0xd20000 [0106.359] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.359] GetProcessHeap () returned 0xd20000 [0106.360] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.360] GetProcessHeap () returned 0xd20000 [0106.360] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.360] GetProcessHeap () returned 0xd20000 [0106.360] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.360] GetProcessHeap () returned 0xd20000 [0106.360] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.360] GetProcessHeap () returned 0xd20000 [0106.360] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.360] GetProcessHeap () returned 0xd20000 [0106.360] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0106.360] GetProcessHeap () returned 0xd20000 [0106.360] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0106.360] GetProcessHeap () returned 0xd20000 [0106.360] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.360] GetProcessHeap () returned 0xd20000 [0106.360] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.360] GetProcessHeap () returned 0xd20000 [0106.360] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.361] GetProcessHeap () returned 0xd20000 [0106.361] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.361] GetProcessHeap () returned 0xd20000 [0106.361] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.361] GetProcessHeap () returned 0xd20000 [0106.361] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.361] GetProcessHeap () returned 0xd20000 [0106.361] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0106.361] GetProcessHeap () returned 0xd20000 [0106.361] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0106.361] GetProcessHeap () returned 0xd20000 [0106.361] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0106.361] GetProcessHeap () returned 0xd20000 [0106.361] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0106.361] GetProcessHeap () returned 0xd20000 [0106.361] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.361] GetProcessHeap () returned 0xd20000 [0106.361] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.361] GetProcessHeap () returned 0xd20000 [0106.361] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0106.362] GetProcessHeap () returned 0xd20000 [0106.362] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0106.362] GetProcessHeap () returned 0xd20000 [0106.362] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0106.362] GetProcessHeap () returned 0xd20000 [0106.362] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0106.362] GetProcessHeap () returned 0xd20000 [0106.362] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0106.362] GetProcessHeap () returned 0xd20000 [0106.362] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0106.362] GetProcessHeap () returned 0xd20000 [0106.362] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.362] GetProcessHeap () returned 0xd20000 [0106.362] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.362] GetProcessHeap () returned 0xd20000 [0106.362] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0106.362] GetProcessHeap () returned 0xd20000 [0106.362] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0106.362] GetProcessHeap () returned 0xd20000 [0106.363] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0106.363] GetProcessHeap () returned 0xd20000 [0106.363] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.363] GetProcessHeap () returned 0xd20000 [0106.363] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.363] GetProcessHeap () returned 0xd20000 [0106.363] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.363] GetProcessHeap () returned 0xd20000 [0106.363] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.363] GetProcessHeap () returned 0xd20000 [0106.363] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.363] GetProcessHeap () returned 0xd20000 [0106.363] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.363] GetProcessHeap () returned 0xd20000 [0106.363] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.363] GetProcessHeap () returned 0xd20000 [0106.363] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0106.363] GetProcessHeap () returned 0xd20000 [0106.363] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0106.364] GetProcessHeap () returned 0xd20000 [0106.364] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.364] GetProcessHeap () returned 0xd20000 [0106.364] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.364] GetProcessHeap () returned 0xd20000 [0106.364] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0106.364] GetProcessHeap () returned 0xd20000 [0106.364] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0106.364] GetProcessHeap () returned 0xd20000 [0106.364] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0106.364] GetProcessHeap () returned 0xd20000 [0106.364] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0106.364] GetProcessHeap () returned 0xd20000 [0106.364] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.364] GetProcessHeap () returned 0xd20000 [0106.364] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.364] GetProcessHeap () returned 0xd20000 [0106.364] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0106.364] GetProcessHeap () returned 0xd20000 [0106.364] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0106.364] GetProcessHeap () returned 0xd20000 [0106.365] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0106.365] GetProcessHeap () returned 0xd20000 [0106.365] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0106.365] GetProcessHeap () returned 0xd20000 [0106.365] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.365] GetProcessHeap () returned 0xd20000 [0106.365] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.365] GetProcessHeap () returned 0xd20000 [0106.365] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.365] GetProcessHeap () returned 0xd20000 [0106.365] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.365] GetProcessHeap () returned 0xd20000 [0106.365] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.365] GetProcessHeap () returned 0xd20000 [0106.365] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.365] GetProcessHeap () returned 0xd20000 [0106.365] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0106.365] GetProcessHeap () returned 0xd20000 [0106.365] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.365] GetProcessHeap () returned 0xd20000 [0106.366] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0106.366] GetProcessHeap () returned 0xd20000 [0106.366] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0106.366] GetProcessHeap () returned 0xd20000 [0106.366] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.366] GetProcessHeap () returned 0xd20000 [0106.366] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.366] GetProcessHeap () returned 0xd20000 [0106.366] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.366] GetProcessHeap () returned 0xd20000 [0106.366] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.366] GetProcessHeap () returned 0xd20000 [0106.366] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.366] GetProcessHeap () returned 0xd20000 [0106.366] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.366] GetProcessHeap () returned 0xd20000 [0106.366] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0106.366] GetProcessHeap () returned 0xd20000 [0106.366] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0106.366] GetProcessHeap () returned 0xd20000 [0106.366] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.367] GetProcessHeap () returned 0xd20000 [0106.367] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.367] GetProcessHeap () returned 0xd20000 [0106.367] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0106.367] GetProcessHeap () returned 0xd20000 [0106.367] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0106.367] GetProcessHeap () returned 0xd20000 [0106.367] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.367] GetProcessHeap () returned 0xd20000 [0106.367] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.367] GetProcessHeap () returned 0xd20000 [0106.367] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0106.367] GetProcessHeap () returned 0xd20000 [0106.367] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0106.367] GetProcessHeap () returned 0xd20000 [0106.367] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0106.367] GetProcessHeap () returned 0xd20000 [0106.367] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0106.367] GetProcessHeap () returned 0xd20000 [0106.367] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.368] GetProcessHeap () returned 0xd20000 [0106.368] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.368] GetProcessHeap () returned 0xd20000 [0106.368] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0106.368] GetProcessHeap () returned 0xd20000 [0106.368] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0106.368] GetProcessHeap () returned 0xd20000 [0106.368] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.368] GetProcessHeap () returned 0xd20000 [0106.368] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.368] GetProcessHeap () returned 0xd20000 [0106.368] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.368] GetProcessHeap () returned 0xd20000 [0106.368] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.368] GetProcessHeap () returned 0xd20000 [0106.368] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0106.368] GetProcessHeap () returned 0xd20000 [0106.368] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0106.368] GetProcessHeap () returned 0xd20000 [0106.368] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.368] GetProcessHeap () returned 0xd20000 [0106.368] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.369] GetProcessHeap () returned 0xd20000 [0106.369] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.369] GetProcessHeap () returned 0xd20000 [0106.369] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.369] GetProcessHeap () returned 0xd20000 [0106.369] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.369] GetProcessHeap () returned 0xd20000 [0106.369] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.369] GetProcessHeap () returned 0xd20000 [0106.369] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.369] GetProcessHeap () returned 0xd20000 [0106.369] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.369] GetProcessHeap () returned 0xd20000 [0106.369] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.369] GetProcessHeap () returned 0xd20000 [0106.369] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.369] GetProcessHeap () returned 0xd20000 [0106.369] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0106.369] GetProcessHeap () returned 0xd20000 [0106.369] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0106.369] GetProcessHeap () returned 0xd20000 [0106.370] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0106.370] GetProcessHeap () returned 0xd20000 [0106.370] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0106.370] GetProcessHeap () returned 0xd20000 [0106.370] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0106.370] GetProcessHeap () returned 0xd20000 [0106.370] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0106.370] GetProcessHeap () returned 0xd20000 [0106.370] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445d0 | out: hHeap=0xd20000) returned 1 [0106.370] GetProcessHeap () returned 0xd20000 [0106.370] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4af78 | out: hHeap=0xd20000) returned 1 [0106.370] GetProcessHeap () returned 0xd20000 [0106.370] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0106.370] GetProcessHeap () returned 0xd20000 [0106.370] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b248 | out: hHeap=0xd20000) returned 1 [0106.370] GetProcessHeap () returned 0xd20000 [0106.370] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0106.370] GetProcessHeap () returned 0xd20000 [0106.371] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0106.371] GetProcessHeap () returned 0xd20000 [0106.371] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0106.371] WriteFile (in: hFile=0x230, lpBuffer=0xd4ee40*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ee40*, lpNumberOfBytesWritten=0x299d864*=0x389, lpOverlapped=0x0) returned 1 [0106.387] GetProcessHeap () returned 0xd20000 [0106.387] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4ee40, Size=0x30) returned 0xd4ee40 [0106.387] GetProcessHeap () returned 0xd20000 [0106.387] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0106.387] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0106.387] GetProcessHeap () returned 0xd20000 [0106.387] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x14250) returned 0xd4ee78 [0106.389] ReadFile (in: hFile=0x230, lpBuffer=0xd4ee78, nNumberOfBytesToRead=0x14250, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4ee78*, lpNumberOfBytesRead=0x299d7e8*=0x14250, lpOverlapped=0x0) returned 1 [0106.392] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0106.392] WriteFile (in: hFile=0x230, lpBuffer=0xd4ee78*, nNumberOfBytesToWrite=0x14250, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4ee78*, lpNumberOfBytesWritten=0x299d7e4*=0x14250, lpOverlapped=0x0) returned 1 [0106.394] GetProcessHeap () returned 0xd20000 [0106.394] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ee78 | out: hHeap=0xd20000) returned 1 [0106.394] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0106.395] WriteFile (in: hFile=0x230, lpBuffer=0xd4ee40*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ee40*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0106.396] CloseHandle (hObject=0x230) returned 1 [0106.402] GetProcessHeap () returned 0xd20000 [0106.402] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42738 | out: hHeap=0xd20000) returned 1 [0106.402] GetProcessHeap () returned 0xd20000 [0106.402] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c070 | out: hHeap=0xd20000) returned 1 [0106.402] GetProcessHeap () returned 0xd20000 [0106.402] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0106.402] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\rVOum.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\rVOum.mp4") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\rVOum.mp4" [0106.402] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\rVOum.mp4", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\rVOum.mp4.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\rVOum.mp4.[ponce.lorena@aol.com]" [0106.402] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\rVOum.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\wr_a7iufou\\rvoum.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\rVOum.mp4.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\wr_a7iufou\\rvoum.mp4.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0106.404] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\rVOum.mp4" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou") returned 1 [0106.404] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\") returned="" [0106.404] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\HOW_RECOVER.html" [0106.404] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\wr_a7iufou\\how_recover.html")) returned 0x20 [0106.404] GetProcessHeap () returned 0xd20000 [0106.404] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44570 | out: hHeap=0xd20000) returned 1 [0106.404] FindNextFileW (in: hFindFile=0xd48de0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d514680, ftCreationTime.dwHighDateTime=0x1d4d1a7, ftLastAccessTime.dwLowDateTime=0x7a96f180, ftLastAccessTime.dwHighDateTime=0x1d4c621, ftLastWriteTime.dwLowDateTime=0x7a96f180, ftLastWriteTime.dwHighDateTime=0x1d4c621, nFileSizeHigh=0x0, nFileSizeLow=0x9f85, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="srz2D2.swf", cAlternateFileName="")) returned 1 [0106.404] lstrcmpiW (lpString1="srz2D2.swf", lpString2=".") returned 1 [0106.404] lstrcmpiW (lpString1="srz2D2.swf", lpString2="..") returned 1 [0106.404] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\", lpString2="srz2D2.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\srz2D2.swf") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\srz2D2.swf" [0106.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="srz2D2.swf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0106.404] GetProcessHeap () returned 0xd20000 [0106.404] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xb) returned 0xd445a0 [0106.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="srz2D2.swf", cchWideChar=-1, lpMultiByteStr=0xd445a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="srz2D2.swf", lpUsedDefaultChar=0x0) returned 11 [0106.405] lstrlenA (lpString="srz2D2.swf") returned 10 [0106.405] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0106.405] lstrlenA (lpString="srz2D2.swf") returned 10 [0106.405] lstrlenA (lpString=".dll") returned 4 [0106.405] lstrlenA (lpString=".dll") returned 4 [0106.405] lstrlenA (lpString="srz2D2.swf") returned 10 [0106.405] lstrcmpiA (lpString1=".swf", lpString2=".dll") returned 1 [0106.405] lstrlenA (lpString="srz2D2.swf") returned 10 [0106.405] lstrlenA (lpString=".ini") returned 4 [0106.405] lstrlenA (lpString=".ini") returned 4 [0106.405] lstrlenA (lpString="srz2D2.swf") returned 10 [0106.405] lstrcmpiA (lpString1=".swf", lpString2=".ini") returned 1 [0106.405] lstrlenA (lpString="srz2D2.swf") returned 10 [0106.405] lstrlenA (lpString=".inc") returned 4 [0106.405] lstrlenA (lpString=".inc") returned 4 [0106.405] lstrlenA (lpString="srz2D2.swf") returned 10 [0106.405] lstrcmpiA (lpString1=".swf", lpString2=".inc") returned 1 [0106.405] lstrcmpiW (lpString1="srz2D2.swf", lpString2="HOW_RECOVER.html") returned 1 [0106.405] lstrcmpiW (lpString1="srz2D2.swf", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0106.406] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0106.406] lstrcmpiW (lpString1="srz2D2.swf", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0106.406] GetProcessHeap () returned 0xd20000 [0106.406] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42558 [0106.406] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\srz2D2.swf" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\wr_a7iufou\\srz2d2.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0106.406] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=40837) returned 1 [0106.406] GetProcessHeap () returned 0xd20000 [0106.406] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bf08 [0106.406] GetProcessHeap () returned 0xd20000 [0106.406] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0106.407] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\srz2D2.swf") returned 58 [0106.407] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0106.407] GetProcessHeap () returned 0xd20000 [0106.407] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0106.407] GetProcessHeap () returned 0xd20000 [0106.407] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x38b) returned 0xd4ee78 [0106.407] lstrlenA (lpString="rsa_encrypt") returned 11 [0106.407] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0106.409] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0106.409] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0106.409] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0106.409] GetProcessHeap () returned 0xd20000 [0106.409] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0106.409] lstrlenA (lpString="010001") returned 6 [0106.409] GetProcessHeap () returned 0xd20000 [0106.409] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cde8 [0106.410] GetProcessHeap () returned 0xd20000 [0106.410] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0106.410] GetProcessHeap () returned 0xd20000 [0106.410] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0106.410] GetProcessHeap () returned 0xd20000 [0106.410] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0106.410] GetProcessHeap () returned 0xd20000 [0106.410] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b368 [0106.410] GetProcessHeap () returned 0xd20000 [0106.410] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44d80 [0106.410] GetProcessHeap () returned 0xd20000 [0106.410] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ce18 [0106.410] GetProcessHeap () returned 0xd20000 [0106.410] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0106.410] GetProcessHeap () returned 0xd20000 [0106.410] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0106.410] GetProcessHeap () returned 0xd20000 [0106.410] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0106.410] GetProcessHeap () returned 0xd20000 [0106.410] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0106.410] GetProcessHeap () returned 0xd20000 [0106.411] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd451e0 [0106.411] GetProcessHeap () returned 0xd20000 [0106.411] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0106.411] GetProcessHeap () returned 0xd20000 [0106.411] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445d0 [0106.411] GetProcessHeap () returned 0xd20000 [0106.411] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b7e8 [0106.411] GetProcessHeap () returned 0xd20000 [0106.411] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0106.411] GetProcessHeap () returned 0xd20000 [0106.411] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0106.411] GetProcessHeap () returned 0xd20000 [0106.411] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0106.411] GetProcessHeap () returned 0xd20000 [0106.411] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0106.411] GetProcessHeap () returned 0xd20000 [0106.411] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446f0 [0106.411] GetProcessHeap () returned 0xd20000 [0106.411] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0106.411] GetProcessHeap () returned 0xd20000 [0106.411] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.412] GetProcessHeap () returned 0xd20000 [0106.412] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0106.412] GetProcessHeap () returned 0xd20000 [0106.412] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0106.412] GetProcessHeap () returned 0xd20000 [0106.412] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0106.412] GetProcessHeap () returned 0xd20000 [0106.412] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.412] GetProcessHeap () returned 0xd20000 [0106.412] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4a9d8 [0106.412] GetProcessHeap () returned 0xd20000 [0106.412] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446f0 | out: hHeap=0xd20000) returned 1 [0106.412] GetProcessHeap () returned 0xd20000 [0106.412] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0106.412] GetProcessHeap () returned 0xd20000 [0106.412] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a9d8 | out: hHeap=0xd20000) returned 1 [0106.412] GetProcessHeap () returned 0xd20000 [0106.412] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0106.412] GetProcessHeap () returned 0xd20000 [0106.412] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0106.412] GetProcessHeap () returned 0xd20000 [0106.412] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.413] GetProcessHeap () returned 0xd20000 [0106.413] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.413] GetProcessHeap () returned 0xd20000 [0106.413] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0106.413] GetProcessHeap () returned 0xd20000 [0106.413] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0106.413] GetProcessHeap () returned 0xd20000 [0106.413] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.413] GetProcessHeap () returned 0xd20000 [0106.413] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.413] GetProcessHeap () returned 0xd20000 [0106.413] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0106.413] GetProcessHeap () returned 0xd20000 [0106.413] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0106.413] GetProcessHeap () returned 0xd20000 [0106.413] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.413] GetProcessHeap () returned 0xd20000 [0106.413] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.413] GetProcessHeap () returned 0xd20000 [0106.413] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0106.413] GetProcessHeap () returned 0xd20000 [0106.414] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.414] GetProcessHeap () returned 0xd20000 [0106.414] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.414] GetProcessHeap () returned 0xd20000 [0106.414] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.414] GetProcessHeap () returned 0xd20000 [0106.414] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0106.414] GetProcessHeap () returned 0xd20000 [0106.414] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0106.414] GetProcessHeap () returned 0xd20000 [0106.414] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.414] GetProcessHeap () returned 0xd20000 [0106.414] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.414] GetProcessHeap () returned 0xd20000 [0106.414] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.414] GetProcessHeap () returned 0xd20000 [0106.414] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.414] GetProcessHeap () returned 0xd20000 [0106.414] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.414] GetProcessHeap () returned 0xd20000 [0106.414] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.415] GetProcessHeap () returned 0xd20000 [0106.415] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0106.415] GetProcessHeap () returned 0xd20000 [0106.415] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0106.415] GetProcessHeap () returned 0xd20000 [0106.415] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.415] GetProcessHeap () returned 0xd20000 [0106.415] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.415] GetProcessHeap () returned 0xd20000 [0106.415] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0106.415] GetProcessHeap () returned 0xd20000 [0106.415] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0106.415] GetProcessHeap () returned 0xd20000 [0106.415] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0106.415] GetProcessHeap () returned 0xd20000 [0106.415] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0106.415] GetProcessHeap () returned 0xd20000 [0106.415] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0106.415] GetProcessHeap () returned 0xd20000 [0106.415] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0106.415] GetProcessHeap () returned 0xd20000 [0106.416] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.416] GetProcessHeap () returned 0xd20000 [0106.416] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.416] GetProcessHeap () returned 0xd20000 [0106.416] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0106.416] GetProcessHeap () returned 0xd20000 [0106.416] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0106.417] GetProcessHeap () returned 0xd20000 [0106.417] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0106.417] GetProcessHeap () returned 0xd20000 [0106.417] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0106.417] GetProcessHeap () returned 0xd20000 [0106.417] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.417] GetProcessHeap () returned 0xd20000 [0106.417] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.417] GetProcessHeap () returned 0xd20000 [0106.417] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0106.417] GetProcessHeap () returned 0xd20000 [0106.417] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0106.417] GetProcessHeap () returned 0xd20000 [0106.417] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.417] GetProcessHeap () returned 0xd20000 [0106.417] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.417] GetProcessHeap () returned 0xd20000 [0106.417] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.417] GetProcessHeap () returned 0xd20000 [0106.417] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.417] GetProcessHeap () returned 0xd20000 [0106.417] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.418] GetProcessHeap () returned 0xd20000 [0106.418] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.418] GetProcessHeap () returned 0xd20000 [0106.418] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.418] GetProcessHeap () returned 0xd20000 [0106.418] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.418] GetProcessHeap () returned 0xd20000 [0106.418] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0106.418] GetProcessHeap () returned 0xd20000 [0106.418] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0106.418] GetProcessHeap () returned 0xd20000 [0106.418] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0106.418] GetProcessHeap () returned 0xd20000 [0106.418] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0106.418] GetProcessHeap () returned 0xd20000 [0106.418] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0106.418] GetProcessHeap () returned 0xd20000 [0106.418] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0106.418] GetProcessHeap () returned 0xd20000 [0106.418] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.419] GetProcessHeap () returned 0xd20000 [0106.419] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.419] GetProcessHeap () returned 0xd20000 [0106.419] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.419] GetProcessHeap () returned 0xd20000 [0106.419] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.419] GetProcessHeap () returned 0xd20000 [0106.419] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0106.419] GetProcessHeap () returned 0xd20000 [0106.419] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0106.419] GetProcessHeap () returned 0xd20000 [0106.419] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0106.419] GetProcessHeap () returned 0xd20000 [0106.419] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0106.419] GetProcessHeap () returned 0xd20000 [0106.419] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0106.419] GetProcessHeap () returned 0xd20000 [0106.419] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0106.419] GetProcessHeap () returned 0xd20000 [0106.419] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.420] GetProcessHeap () returned 0xd20000 [0106.420] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.420] GetProcessHeap () returned 0xd20000 [0106.420] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.420] GetProcessHeap () returned 0xd20000 [0106.420] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.420] GetProcessHeap () returned 0xd20000 [0106.420] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.420] GetProcessHeap () returned 0xd20000 [0106.420] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.420] GetProcessHeap () returned 0xd20000 [0106.420] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.420] GetProcessHeap () returned 0xd20000 [0106.420] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.420] GetProcessHeap () returned 0xd20000 [0106.420] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0106.420] GetProcessHeap () returned 0xd20000 [0106.420] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0106.420] GetProcessHeap () returned 0xd20000 [0106.420] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0106.420] GetProcessHeap () returned 0xd20000 [0106.420] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0106.420] GetProcessHeap () returned 0xd20000 [0106.421] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0106.421] GetProcessHeap () returned 0xd20000 [0106.421] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0106.421] GetProcessHeap () returned 0xd20000 [0106.421] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0106.421] GetProcessHeap () returned 0xd20000 [0106.421] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0106.421] GetProcessHeap () returned 0xd20000 [0106.421] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.421] GetProcessHeap () returned 0xd20000 [0106.421] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.421] GetProcessHeap () returned 0xd20000 [0106.421] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.421] GetProcessHeap () returned 0xd20000 [0106.421] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.421] GetProcessHeap () returned 0xd20000 [0106.421] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.421] GetProcessHeap () returned 0xd20000 [0106.421] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.421] GetProcessHeap () returned 0xd20000 [0106.421] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0106.421] GetProcessHeap () returned 0xd20000 [0106.421] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0106.421] GetProcessHeap () returned 0xd20000 [0106.421] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0106.421] GetProcessHeap () returned 0xd20000 [0106.422] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0106.422] GetProcessHeap () returned 0xd20000 [0106.422] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.422] GetProcessHeap () returned 0xd20000 [0106.422] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.422] GetProcessHeap () returned 0xd20000 [0106.422] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0106.422] GetProcessHeap () returned 0xd20000 [0106.422] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0106.422] GetProcessHeap () returned 0xd20000 [0106.422] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.422] GetProcessHeap () returned 0xd20000 [0106.422] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.422] GetProcessHeap () returned 0xd20000 [0106.422] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.422] GetProcessHeap () returned 0xd20000 [0106.422] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.422] GetProcessHeap () returned 0xd20000 [0106.422] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0106.422] GetProcessHeap () returned 0xd20000 [0106.422] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0106.422] GetProcessHeap () returned 0xd20000 [0106.422] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0106.422] GetProcessHeap () returned 0xd20000 [0106.422] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0106.422] GetProcessHeap () returned 0xd20000 [0106.422] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0106.423] GetProcessHeap () returned 0xd20000 [0106.423] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0106.423] GetProcessHeap () returned 0xd20000 [0106.423] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0106.423] GetProcessHeap () returned 0xd20000 [0106.423] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0106.423] GetProcessHeap () returned 0xd20000 [0106.423] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.423] GetProcessHeap () returned 0xd20000 [0106.423] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.423] GetProcessHeap () returned 0xd20000 [0106.423] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0106.423] GetProcessHeap () returned 0xd20000 [0106.423] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0106.423] GetProcessHeap () returned 0xd20000 [0106.423] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.423] GetProcessHeap () returned 0xd20000 [0106.423] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.423] GetProcessHeap () returned 0xd20000 [0106.423] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0106.423] GetProcessHeap () returned 0xd20000 [0106.423] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0106.423] GetProcessHeap () returned 0xd20000 [0106.423] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0106.423] GetProcessHeap () returned 0xd20000 [0106.423] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.424] GetProcessHeap () returned 0xd20000 [0106.424] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.424] GetProcessHeap () returned 0xd20000 [0106.424] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.424] GetProcessHeap () returned 0xd20000 [0106.424] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0106.424] GetProcessHeap () returned 0xd20000 [0106.424] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0106.424] GetProcessHeap () returned 0xd20000 [0106.424] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.424] GetProcessHeap () returned 0xd20000 [0106.424] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.424] GetProcessHeap () returned 0xd20000 [0106.424] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0106.424] GetProcessHeap () returned 0xd20000 [0106.424] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0106.424] GetProcessHeap () returned 0xd20000 [0106.424] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.424] GetProcessHeap () returned 0xd20000 [0106.424] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.424] GetProcessHeap () returned 0xd20000 [0106.424] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0106.424] GetProcessHeap () returned 0xd20000 [0106.425] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0106.425] GetProcessHeap () returned 0xd20000 [0106.425] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.425] GetProcessHeap () returned 0xd20000 [0106.425] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.425] GetProcessHeap () returned 0xd20000 [0106.425] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0106.425] GetProcessHeap () returned 0xd20000 [0106.425] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0106.425] GetProcessHeap () returned 0xd20000 [0106.425] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.425] GetProcessHeap () returned 0xd20000 [0106.425] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.425] GetProcessHeap () returned 0xd20000 [0106.425] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.425] GetProcessHeap () returned 0xd20000 [0106.425] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.425] GetProcessHeap () returned 0xd20000 [0106.425] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.425] GetProcessHeap () returned 0xd20000 [0106.425] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.425] GetProcessHeap () returned 0xd20000 [0106.425] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.426] GetProcessHeap () returned 0xd20000 [0106.426] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.426] GetProcessHeap () returned 0xd20000 [0106.426] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.426] GetProcessHeap () returned 0xd20000 [0106.426] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.426] GetProcessHeap () returned 0xd20000 [0106.426] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0106.426] GetProcessHeap () returned 0xd20000 [0106.426] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0106.426] GetProcessHeap () returned 0xd20000 [0106.426] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.426] GetProcessHeap () returned 0xd20000 [0106.426] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.426] GetProcessHeap () returned 0xd20000 [0106.426] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0106.426] GetProcessHeap () returned 0xd20000 [0106.426] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0106.426] GetProcessHeap () returned 0xd20000 [0106.426] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0106.426] GetProcessHeap () returned 0xd20000 [0106.426] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0106.426] GetProcessHeap () returned 0xd20000 [0106.426] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0106.426] GetProcessHeap () returned 0xd20000 [0106.426] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0106.427] GetProcessHeap () returned 0xd20000 [0106.427] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0106.427] GetProcessHeap () returned 0xd20000 [0106.427] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0106.427] GetProcessHeap () returned 0xd20000 [0106.427] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0106.427] GetProcessHeap () returned 0xd20000 [0106.427] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0106.427] GetProcessHeap () returned 0xd20000 [0106.427] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0106.427] GetProcessHeap () returned 0xd20000 [0106.427] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0106.427] GetProcessHeap () returned 0xd20000 [0106.427] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0106.427] GetProcessHeap () returned 0xd20000 [0106.427] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0106.427] GetProcessHeap () returned 0xd20000 [0106.427] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0106.427] GetProcessHeap () returned 0xd20000 [0106.427] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0106.427] GetProcessHeap () returned 0xd20000 [0106.427] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.427] GetProcessHeap () returned 0xd20000 [0106.427] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.428] GetProcessHeap () returned 0xd20000 [0106.428] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0106.428] GetProcessHeap () returned 0xd20000 [0106.428] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0106.428] GetProcessHeap () returned 0xd20000 [0106.428] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0106.428] GetProcessHeap () returned 0xd20000 [0106.428] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0106.428] GetProcessHeap () returned 0xd20000 [0106.428] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0106.428] GetProcessHeap () returned 0xd20000 [0106.428] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0106.428] GetProcessHeap () returned 0xd20000 [0106.428] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445d0 | out: hHeap=0xd20000) returned 1 [0106.428] GetProcessHeap () returned 0xd20000 [0106.428] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b368 | out: hHeap=0xd20000) returned 1 [0106.428] GetProcessHeap () returned 0xd20000 [0106.428] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0106.428] GetProcessHeap () returned 0xd20000 [0106.428] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0106.428] GetProcessHeap () returned 0xd20000 [0106.428] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0106.428] GetProcessHeap () returned 0xd20000 [0106.429] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0106.429] GetProcessHeap () returned 0xd20000 [0106.429] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0106.429] WriteFile (in: hFile=0x230, lpBuffer=0xd4ee78*, nNumberOfBytesToWrite=0x38b, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ee78*, lpNumberOfBytesWritten=0x299d864*=0x38b, lpOverlapped=0x0) returned 1 [0106.434] GetProcessHeap () returned 0xd20000 [0106.434] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4ee78, Size=0x30) returned 0xd4ee78 [0106.434] GetProcessHeap () returned 0xd20000 [0106.434] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0106.434] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0106.434] GetProcessHeap () returned 0xd20000 [0106.434] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x9f90) returned 0xd4eeb0 [0106.435] ReadFile (in: hFile=0x230, lpBuffer=0xd4eeb0, nNumberOfBytesToRead=0x9f90, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4eeb0*, lpNumberOfBytesRead=0x299d7e8*=0x9f90, lpOverlapped=0x0) returned 1 [0106.436] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0106.436] WriteFile (in: hFile=0x230, lpBuffer=0xd4eeb0*, nNumberOfBytesToWrite=0x9f90, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4eeb0*, lpNumberOfBytesWritten=0x299d7e4*=0x9f90, lpOverlapped=0x0) returned 1 [0106.437] GetProcessHeap () returned 0xd20000 [0106.437] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4eeb0 | out: hHeap=0xd20000) returned 1 [0106.437] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0106.438] WriteFile (in: hFile=0x230, lpBuffer=0xd4ee78*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ee78*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0106.438] CloseHandle (hObject=0x230) returned 1 [0106.449] GetProcessHeap () returned 0xd20000 [0106.449] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42558 | out: hHeap=0xd20000) returned 1 [0106.449] GetProcessHeap () returned 0xd20000 [0106.449] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bf08 | out: hHeap=0xd20000) returned 1 [0106.449] GetProcessHeap () returned 0xd20000 [0106.450] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0106.450] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\srz2D2.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\srz2D2.swf") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\srz2D2.swf" [0106.450] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\srz2D2.swf", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\srz2D2.swf.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\srz2D2.swf.[ponce.lorena@aol.com]" [0106.450] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\srz2D2.swf" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\wr_a7iufou\\srz2d2.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\srz2D2.swf.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\wr_a7iufou\\srz2d2.swf.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0106.451] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\srz2D2.swf" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou") returned 1 [0106.451] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\") returned="" [0106.451] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\HOW_RECOVER.html" [0106.451] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\wr_a7iufou\\how_recover.html")) returned 0x20 [0106.451] GetProcessHeap () returned 0xd20000 [0106.451] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445a0 | out: hHeap=0xd20000) returned 1 [0106.451] FindNextFileW (in: hFindFile=0xd48de0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20d6da80, ftCreationTime.dwHighDateTime=0x1d4cb2f, ftLastAccessTime.dwLowDateTime=0x2b8aacb0, ftLastAccessTime.dwHighDateTime=0x1d4ca06, ftLastWriteTime.dwLowDateTime=0x2b8aacb0, ftLastWriteTime.dwHighDateTime=0x1d4ca06, nFileSizeHigh=0x0, nFileSizeLow=0x3118, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xOJh.flv", cAlternateFileName="")) returned 1 [0106.451] lstrcmpiW (lpString1="xOJh.flv", lpString2=".") returned 1 [0106.451] lstrcmpiW (lpString1="xOJh.flv", lpString2="..") returned 1 [0106.451] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\", lpString2="xOJh.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\xOJh.flv") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\xOJh.flv" [0106.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="xOJh.flv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0106.451] GetProcessHeap () returned 0xd20000 [0106.451] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x9) returned 0xd44630 [0106.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="xOJh.flv", cchWideChar=-1, lpMultiByteStr=0xd44630, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="xOJh.flv", lpUsedDefaultChar=0x0) returned 9 [0106.451] lstrlenA (lpString="xOJh.flv") returned 8 [0106.452] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0106.452] lstrlenA (lpString="xOJh.flv") returned 8 [0106.452] lstrlenA (lpString=".dll") returned 4 [0106.452] lstrlenA (lpString=".dll") returned 4 [0106.452] lstrlenA (lpString="xOJh.flv") returned 8 [0106.452] lstrcmpiA (lpString1=".flv", lpString2=".dll") returned 1 [0106.452] lstrlenA (lpString="xOJh.flv") returned 8 [0106.452] lstrlenA (lpString=".ini") returned 4 [0106.452] lstrlenA (lpString=".ini") returned 4 [0106.452] lstrlenA (lpString="xOJh.flv") returned 8 [0106.452] lstrcmpiA (lpString1=".flv", lpString2=".ini") returned -1 [0106.452] lstrlenA (lpString="xOJh.flv") returned 8 [0106.452] lstrlenA (lpString=".inc") returned 4 [0106.452] lstrlenA (lpString=".inc") returned 4 [0106.452] lstrlenA (lpString="xOJh.flv") returned 8 [0106.452] lstrcmpiA (lpString1=".flv", lpString2=".inc") returned -1 [0106.452] lstrcmpiW (lpString1="xOJh.flv", lpString2="HOW_RECOVER.html") returned 1 [0106.452] lstrcmpiW (lpString1="xOJh.flv", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0106.452] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0106.452] lstrcmpiW (lpString1="xOJh.flv", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0106.452] GetProcessHeap () returned 0xd20000 [0106.453] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42530 [0106.453] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\xOJh.flv" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\wr_a7iufou\\xojh.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0106.453] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=12568) returned 1 [0106.453] GetProcessHeap () returned 0xd20000 [0106.453] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bf08 [0106.453] GetProcessHeap () returned 0xd20000 [0106.453] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0106.453] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\xOJh.flv") returned 56 [0106.453] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0106.453] GetProcessHeap () returned 0xd20000 [0106.453] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0106.453] GetProcessHeap () returned 0xd20000 [0106.453] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4eeb0 [0106.454] lstrlenA (lpString="rsa_encrypt") returned 11 [0106.454] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0106.456] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0106.456] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0106.456] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0106.456] GetProcessHeap () returned 0xd20000 [0106.456] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0106.456] lstrlenA (lpString="010001") returned 6 [0106.456] GetProcessHeap () returned 0xd20000 [0106.456] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ce58 [0106.456] GetProcessHeap () returned 0xd20000 [0106.456] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0106.456] GetProcessHeap () returned 0xd20000 [0106.456] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b128 [0106.456] GetProcessHeap () returned 0xd20000 [0106.456] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0106.456] GetProcessHeap () returned 0xd20000 [0106.457] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4af78 [0106.457] GetProcessHeap () returned 0xd20000 [0106.457] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44808 [0106.457] GetProcessHeap () returned 0xd20000 [0106.457] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cf48 [0106.457] GetProcessHeap () returned 0xd20000 [0106.457] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0106.457] GetProcessHeap () returned 0xd20000 [0106.457] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.457] GetProcessHeap () returned 0xd20000 [0106.457] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0106.457] GetProcessHeap () returned 0xd20000 [0106.457] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0106.457] GetProcessHeap () returned 0xd20000 [0106.457] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44920 [0106.457] GetProcessHeap () returned 0xd20000 [0106.457] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0106.457] GetProcessHeap () returned 0xd20000 [0106.457] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44528 [0106.457] GetProcessHeap () returned 0xd20000 [0106.457] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b6c8 [0106.457] GetProcessHeap () returned 0xd20000 [0106.457] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0106.457] GetProcessHeap () returned 0xd20000 [0106.458] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0106.458] GetProcessHeap () returned 0xd20000 [0106.458] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b6c8 | out: hHeap=0xd20000) returned 1 [0106.458] GetProcessHeap () returned 0xd20000 [0106.458] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.458] GetProcessHeap () returned 0xd20000 [0106.458] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44588 [0106.458] GetProcessHeap () returned 0xd20000 [0106.458] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0106.458] GetProcessHeap () returned 0xd20000 [0106.458] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.458] GetProcessHeap () returned 0xd20000 [0106.458] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.458] GetProcessHeap () returned 0xd20000 [0106.458] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.458] GetProcessHeap () returned 0xd20000 [0106.458] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.458] GetProcessHeap () returned 0xd20000 [0106.458] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.458] GetProcessHeap () returned 0xd20000 [0106.458] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b6c8 [0106.458] GetProcessHeap () returned 0xd20000 [0106.458] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44588 | out: hHeap=0xd20000) returned 1 [0106.459] GetProcessHeap () returned 0xd20000 [0106.459] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0106.459] GetProcessHeap () returned 0xd20000 [0106.459] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b6c8 | out: hHeap=0xd20000) returned 1 [0106.459] GetProcessHeap () returned 0xd20000 [0106.459] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0106.459] GetProcessHeap () returned 0xd20000 [0106.459] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0106.459] GetProcessHeap () returned 0xd20000 [0106.459] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.459] GetProcessHeap () returned 0xd20000 [0106.459] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.459] GetProcessHeap () returned 0xd20000 [0106.459] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0106.459] GetProcessHeap () returned 0xd20000 [0106.459] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0106.459] GetProcessHeap () returned 0xd20000 [0106.459] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.459] GetProcessHeap () returned 0xd20000 [0106.459] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.459] GetProcessHeap () returned 0xd20000 [0106.459] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0106.459] GetProcessHeap () returned 0xd20000 [0106.459] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0106.459] GetProcessHeap () returned 0xd20000 [0106.459] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0106.459] GetProcessHeap () returned 0xd20000 [0106.459] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.459] GetProcessHeap () returned 0xd20000 [0106.460] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0106.460] GetProcessHeap () returned 0xd20000 [0106.460] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0106.460] GetProcessHeap () returned 0xd20000 [0106.460] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0106.460] GetProcessHeap () returned 0xd20000 [0106.460] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0106.460] GetProcessHeap () returned 0xd20000 [0106.460] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0106.460] GetProcessHeap () returned 0xd20000 [0106.460] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0106.460] GetProcessHeap () returned 0xd20000 [0106.460] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0106.460] GetProcessHeap () returned 0xd20000 [0106.460] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0106.460] GetProcessHeap () returned 0xd20000 [0106.460] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.460] GetProcessHeap () returned 0xd20000 [0106.460] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.460] GetProcessHeap () returned 0xd20000 [0106.460] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0106.460] GetProcessHeap () returned 0xd20000 [0106.460] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.460] GetProcessHeap () returned 0xd20000 [0106.460] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0106.460] GetProcessHeap () returned 0xd20000 [0106.461] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0106.461] GetProcessHeap () returned 0xd20000 [0106.461] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0106.461] GetProcessHeap () returned 0xd20000 [0106.461] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.461] GetProcessHeap () returned 0xd20000 [0106.461] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0106.461] GetProcessHeap () returned 0xd20000 [0106.461] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0106.461] GetProcessHeap () returned 0xd20000 [0106.461] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0106.461] GetProcessHeap () returned 0xd20000 [0106.461] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0106.461] GetProcessHeap () returned 0xd20000 [0106.461] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0106.461] GetProcessHeap () returned 0xd20000 [0106.461] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.461] GetProcessHeap () returned 0xd20000 [0106.461] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.461] GetProcessHeap () returned 0xd20000 [0106.461] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.461] GetProcessHeap () returned 0xd20000 [0106.461] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0106.461] GetProcessHeap () returned 0xd20000 [0106.461] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0106.461] GetProcessHeap () returned 0xd20000 [0106.461] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0106.461] GetProcessHeap () returned 0xd20000 [0106.462] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.462] GetProcessHeap () returned 0xd20000 [0106.462] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0106.462] GetProcessHeap () returned 0xd20000 [0106.462] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0106.462] GetProcessHeap () returned 0xd20000 [0106.462] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0106.462] GetProcessHeap () returned 0xd20000 [0106.462] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.462] GetProcessHeap () returned 0xd20000 [0106.462] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.462] GetProcessHeap () returned 0xd20000 [0106.462] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.462] GetProcessHeap () returned 0xd20000 [0106.462] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.462] GetProcessHeap () returned 0xd20000 [0106.462] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.462] GetProcessHeap () returned 0xd20000 [0106.462] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.462] GetProcessHeap () returned 0xd20000 [0106.462] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.462] GetProcessHeap () returned 0xd20000 [0106.463] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.463] GetProcessHeap () returned 0xd20000 [0106.463] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.463] GetProcessHeap () returned 0xd20000 [0106.463] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.463] GetProcessHeap () returned 0xd20000 [0106.463] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.463] GetProcessHeap () returned 0xd20000 [0106.463] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0106.463] GetProcessHeap () returned 0xd20000 [0106.463] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0106.463] GetProcessHeap () returned 0xd20000 [0106.463] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.463] GetProcessHeap () returned 0xd20000 [0106.463] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.463] GetProcessHeap () returned 0xd20000 [0106.463] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.463] GetProcessHeap () returned 0xd20000 [0106.463] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.463] GetProcessHeap () returned 0xd20000 [0106.464] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.464] GetProcessHeap () returned 0xd20000 [0106.464] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.464] GetProcessHeap () returned 0xd20000 [0106.464] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0106.464] GetProcessHeap () returned 0xd20000 [0106.464] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0106.464] GetProcessHeap () returned 0xd20000 [0106.464] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0106.464] GetProcessHeap () returned 0xd20000 [0106.464] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0106.464] GetProcessHeap () returned 0xd20000 [0106.464] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.464] GetProcessHeap () returned 0xd20000 [0106.464] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.464] GetProcessHeap () returned 0xd20000 [0106.464] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0106.464] GetProcessHeap () returned 0xd20000 [0106.464] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0106.464] GetProcessHeap () returned 0xd20000 [0106.464] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0106.464] GetProcessHeap () returned 0xd20000 [0106.464] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0106.465] GetProcessHeap () returned 0xd20000 [0106.465] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0106.465] GetProcessHeap () returned 0xd20000 [0106.465] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0106.465] GetProcessHeap () returned 0xd20000 [0106.465] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.465] GetProcessHeap () returned 0xd20000 [0106.465] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.465] GetProcessHeap () returned 0xd20000 [0106.465] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0106.465] GetProcessHeap () returned 0xd20000 [0106.465] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0106.465] GetProcessHeap () returned 0xd20000 [0106.465] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0106.465] GetProcessHeap () returned 0xd20000 [0106.465] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.465] GetProcessHeap () returned 0xd20000 [0106.465] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.465] GetProcessHeap () returned 0xd20000 [0106.465] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.465] GetProcessHeap () returned 0xd20000 [0106.465] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.465] GetProcessHeap () returned 0xd20000 [0106.465] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.466] GetProcessHeap () returned 0xd20000 [0106.466] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.466] GetProcessHeap () returned 0xd20000 [0106.466] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.466] GetProcessHeap () returned 0xd20000 [0106.466] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0106.466] GetProcessHeap () returned 0xd20000 [0106.466] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0106.466] GetProcessHeap () returned 0xd20000 [0106.466] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.466] GetProcessHeap () returned 0xd20000 [0106.466] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.466] GetProcessHeap () returned 0xd20000 [0106.466] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0106.466] GetProcessHeap () returned 0xd20000 [0106.466] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0106.466] GetProcessHeap () returned 0xd20000 [0106.466] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0106.466] GetProcessHeap () returned 0xd20000 [0106.466] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0106.466] GetProcessHeap () returned 0xd20000 [0106.466] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.466] GetProcessHeap () returned 0xd20000 [0106.466] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.467] GetProcessHeap () returned 0xd20000 [0106.467] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0106.467] GetProcessHeap () returned 0xd20000 [0106.467] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0106.467] GetProcessHeap () returned 0xd20000 [0106.467] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0106.467] GetProcessHeap () returned 0xd20000 [0106.467] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0106.467] GetProcessHeap () returned 0xd20000 [0106.467] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.467] GetProcessHeap () returned 0xd20000 [0106.467] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.467] GetProcessHeap () returned 0xd20000 [0106.467] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.467] GetProcessHeap () returned 0xd20000 [0106.467] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.467] GetProcessHeap () returned 0xd20000 [0106.467] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.467] GetProcessHeap () returned 0xd20000 [0106.467] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.467] GetProcessHeap () returned 0xd20000 [0106.468] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0106.468] GetProcessHeap () returned 0xd20000 [0106.468] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.468] GetProcessHeap () returned 0xd20000 [0106.468] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0106.468] GetProcessHeap () returned 0xd20000 [0106.468] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0106.468] GetProcessHeap () returned 0xd20000 [0106.468] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.468] GetProcessHeap () returned 0xd20000 [0106.468] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.468] GetProcessHeap () returned 0xd20000 [0106.468] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.468] GetProcessHeap () returned 0xd20000 [0106.468] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.468] GetProcessHeap () returned 0xd20000 [0106.468] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.468] GetProcessHeap () returned 0xd20000 [0106.468] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.468] GetProcessHeap () returned 0xd20000 [0106.468] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0106.468] GetProcessHeap () returned 0xd20000 [0106.469] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0106.469] GetProcessHeap () returned 0xd20000 [0106.469] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.469] GetProcessHeap () returned 0xd20000 [0106.469] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.469] GetProcessHeap () returned 0xd20000 [0106.469] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0106.469] GetProcessHeap () returned 0xd20000 [0106.469] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0106.469] GetProcessHeap () returned 0xd20000 [0106.469] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.469] GetProcessHeap () returned 0xd20000 [0106.469] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.469] GetProcessHeap () returned 0xd20000 [0106.469] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0106.469] GetProcessHeap () returned 0xd20000 [0106.469] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0106.469] GetProcessHeap () returned 0xd20000 [0106.469] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0106.469] GetProcessHeap () returned 0xd20000 [0106.469] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0106.469] GetProcessHeap () returned 0xd20000 [0106.470] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.470] GetProcessHeap () returned 0xd20000 [0106.470] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.470] GetProcessHeap () returned 0xd20000 [0106.470] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0106.470] GetProcessHeap () returned 0xd20000 [0106.470] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0106.470] GetProcessHeap () returned 0xd20000 [0106.470] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.470] GetProcessHeap () returned 0xd20000 [0106.470] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.470] GetProcessHeap () returned 0xd20000 [0106.470] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.470] GetProcessHeap () returned 0xd20000 [0106.470] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.470] GetProcessHeap () returned 0xd20000 [0106.470] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0106.470] GetProcessHeap () returned 0xd20000 [0106.470] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0106.470] GetProcessHeap () returned 0xd20000 [0106.470] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.470] GetProcessHeap () returned 0xd20000 [0106.470] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.471] GetProcessHeap () returned 0xd20000 [0106.471] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.471] GetProcessHeap () returned 0xd20000 [0106.471] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.471] GetProcessHeap () returned 0xd20000 [0106.471] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.471] GetProcessHeap () returned 0xd20000 [0106.471] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.471] GetProcessHeap () returned 0xd20000 [0106.471] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.471] GetProcessHeap () returned 0xd20000 [0106.471] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.471] GetProcessHeap () returned 0xd20000 [0106.471] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.471] GetProcessHeap () returned 0xd20000 [0106.471] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.471] GetProcessHeap () returned 0xd20000 [0106.471] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0106.471] GetProcessHeap () returned 0xd20000 [0106.471] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0106.471] GetProcessHeap () returned 0xd20000 [0106.471] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.471] GetProcessHeap () returned 0xd20000 [0106.472] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.472] GetProcessHeap () returned 0xd20000 [0106.472] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.472] GetProcessHeap () returned 0xd20000 [0106.472] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.472] GetProcessHeap () returned 0xd20000 [0106.472] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.472] GetProcessHeap () returned 0xd20000 [0106.472] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.472] GetProcessHeap () returned 0xd20000 [0106.472] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0106.472] GetProcessHeap () returned 0xd20000 [0106.472] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0106.472] GetProcessHeap () returned 0xd20000 [0106.472] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.472] GetProcessHeap () returned 0xd20000 [0106.472] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.472] GetProcessHeap () returned 0xd20000 [0106.472] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0106.472] GetProcessHeap () returned 0xd20000 [0106.472] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0106.472] GetProcessHeap () returned 0xd20000 [0106.472] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0106.472] GetProcessHeap () returned 0xd20000 [0106.472] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0106.472] GetProcessHeap () returned 0xd20000 [0106.473] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.473] GetProcessHeap () returned 0xd20000 [0106.473] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.473] GetProcessHeap () returned 0xd20000 [0106.473] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0106.473] GetProcessHeap () returned 0xd20000 [0106.473] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0106.473] GetProcessHeap () returned 0xd20000 [0106.473] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0106.473] GetProcessHeap () returned 0xd20000 [0106.473] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0106.473] GetProcessHeap () returned 0xd20000 [0106.473] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0106.473] GetProcessHeap () returned 0xd20000 [0106.473] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0106.473] GetProcessHeap () returned 0xd20000 [0106.473] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0106.473] GetProcessHeap () returned 0xd20000 [0106.473] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0106.473] GetProcessHeap () returned 0xd20000 [0106.473] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44528 | out: hHeap=0xd20000) returned 1 [0106.473] GetProcessHeap () returned 0xd20000 [0106.473] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4af78 | out: hHeap=0xd20000) returned 1 [0106.474] GetProcessHeap () returned 0xd20000 [0106.474] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0106.474] GetProcessHeap () returned 0xd20000 [0106.474] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b128 | out: hHeap=0xd20000) returned 1 [0106.474] GetProcessHeap () returned 0xd20000 [0106.474] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0106.474] GetProcessHeap () returned 0xd20000 [0106.474] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.474] GetProcessHeap () returned 0xd20000 [0106.474] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0106.474] WriteFile (in: hFile=0x230, lpBuffer=0xd4eeb0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4eeb0*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0106.477] GetProcessHeap () returned 0xd20000 [0106.477] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4eeb0, Size=0x30) returned 0xd4eeb0 [0106.477] GetProcessHeap () returned 0xd20000 [0106.477] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0106.477] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0106.477] GetProcessHeap () returned 0xd20000 [0106.477] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x3118) returned 0xd4eee8 [0106.477] ReadFile (in: hFile=0x230, lpBuffer=0xd4eee8, nNumberOfBytesToRead=0x3118, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4eee8*, lpNumberOfBytesRead=0x299d7e8*=0x3118, lpOverlapped=0x0) returned 1 [0106.478] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0106.478] WriteFile (in: hFile=0x230, lpBuffer=0xd4eee8*, nNumberOfBytesToWrite=0x3118, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4eee8*, lpNumberOfBytesWritten=0x299d7e4*=0x3118, lpOverlapped=0x0) returned 1 [0106.479] GetProcessHeap () returned 0xd20000 [0106.479] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4eee8 | out: hHeap=0xd20000) returned 1 [0106.479] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0106.480] WriteFile (in: hFile=0x230, lpBuffer=0xd4eeb0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4eeb0*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0106.481] CloseHandle (hObject=0x230) returned 1 [0106.485] GetProcessHeap () returned 0xd20000 [0106.485] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42530 | out: hHeap=0xd20000) returned 1 [0106.485] GetProcessHeap () returned 0xd20000 [0106.485] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bf08 | out: hHeap=0xd20000) returned 1 [0106.485] GetProcessHeap () returned 0xd20000 [0106.485] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0106.485] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\xOJh.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\xOJh.flv") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\xOJh.flv" [0106.485] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\xOJh.flv", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\xOJh.flv.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\xOJh.flv.[ponce.lorena@aol.com]" [0106.485] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\xOJh.flv" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\wr_a7iufou\\xojh.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\xOJh.flv.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\wr_a7iufou\\xojh.flv.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0106.486] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\xOJh.flv" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou") returned 1 [0106.486] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\") returned="" [0106.486] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\HOW_RECOVER.html" [0106.486] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\wr_a7iufou\\how_recover.html")) returned 0x20 [0106.486] GetProcessHeap () returned 0xd20000 [0106.486] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44630 | out: hHeap=0xd20000) returned 1 [0106.486] FindNextFileW (in: hFindFile=0xd48de0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18b55a20, ftCreationTime.dwHighDateTime=0x1d4d5a7, ftLastAccessTime.dwLowDateTime=0xc2f2b680, ftLastAccessTime.dwHighDateTime=0x1d4d0a3, ftLastWriteTime.dwLowDateTime=0xc2f2b680, ftLastWriteTime.dwHighDateTime=0x1d4d0a3, nFileSizeHigh=0x0, nFileSizeLow=0xd09e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Y6TH35ES6dnwU.avi", cAlternateFileName="Y6TH35~1.AVI")) returned 1 [0106.486] lstrcmpiW (lpString1="Y6TH35ES6dnwU.avi", lpString2=".") returned 1 [0106.487] lstrcmpiW (lpString1="Y6TH35ES6dnwU.avi", lpString2="..") returned 1 [0106.487] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\", lpString2="Y6TH35ES6dnwU.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\Y6TH35ES6dnwU.avi") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\Y6TH35ES6dnwU.avi" [0106.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Y6TH35ES6dnwU.avi", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0106.487] GetProcessHeap () returned 0xd20000 [0106.487] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x12) returned 0xd36688 [0106.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Y6TH35ES6dnwU.avi", cchWideChar=-1, lpMultiByteStr=0xd36688, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Y6TH35ES6dnwU.avi", lpUsedDefaultChar=0x0) returned 18 [0106.487] lstrlenA (lpString="Y6TH35ES6dnwU.avi") returned 17 [0106.487] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0106.487] lstrlenA (lpString="Y6TH35ES6dnwU.avi") returned 17 [0106.487] lstrlenA (lpString=".dll") returned 4 [0106.487] lstrlenA (lpString=".dll") returned 4 [0106.487] lstrlenA (lpString="Y6TH35ES6dnwU.avi") returned 17 [0106.487] lstrcmpiA (lpString1=".avi", lpString2=".dll") returned -1 [0106.487] lstrlenA (lpString="Y6TH35ES6dnwU.avi") returned 17 [0106.487] lstrlenA (lpString=".ini") returned 4 [0106.487] lstrlenA (lpString=".ini") returned 4 [0106.487] lstrlenA (lpString="Y6TH35ES6dnwU.avi") returned 17 [0106.487] lstrcmpiA (lpString1=".avi", lpString2=".ini") returned -1 [0106.487] lstrlenA (lpString="Y6TH35ES6dnwU.avi") returned 17 [0106.487] lstrlenA (lpString=".inc") returned 4 [0106.487] lstrlenA (lpString=".inc") returned 4 [0106.487] lstrlenA (lpString="Y6TH35ES6dnwU.avi") returned 17 [0106.488] lstrcmpiA (lpString1=".avi", lpString2=".inc") returned -1 [0106.488] lstrcmpiW (lpString1="Y6TH35ES6dnwU.avi", lpString2="HOW_RECOVER.html") returned 1 [0106.488] lstrcmpiW (lpString1="Y6TH35ES6dnwU.avi", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0106.488] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0106.488] lstrcmpiW (lpString1="Y6TH35ES6dnwU.avi", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0106.488] GetProcessHeap () returned 0xd20000 [0106.488] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42828 [0106.488] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\Y6TH35ES6dnwU.avi" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\wr_a7iufou\\y6th35es6dnwu.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0106.488] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=53406) returned 1 [0106.488] GetProcessHeap () returned 0xd20000 [0106.488] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c0e8 [0106.488] GetProcessHeap () returned 0xd20000 [0106.488] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0106.488] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\Y6TH35ES6dnwU.avi") returned 65 [0106.488] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0106.489] GetProcessHeap () returned 0xd20000 [0106.489] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0106.489] GetProcessHeap () returned 0xd20000 [0106.489] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x382) returned 0xd4eee8 [0106.489] lstrlenA (lpString="rsa_encrypt") returned 11 [0106.489] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0106.491] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0106.491] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0106.491] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0106.491] GetProcessHeap () returned 0xd20000 [0106.491] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0106.491] lstrlenA (lpString="010001") returned 6 [0106.491] GetProcessHeap () returned 0xd20000 [0106.491] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cf68 [0106.491] GetProcessHeap () returned 0xd20000 [0106.491] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0106.491] GetProcessHeap () returned 0xd20000 [0106.491] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b878 [0106.492] GetProcessHeap () returned 0xd20000 [0106.492] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0106.492] GetProcessHeap () returned 0xd20000 [0106.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0106.492] GetProcessHeap () returned 0xd20000 [0106.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45528 [0106.492] GetProcessHeap () returned 0xd20000 [0106.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cde8 [0106.492] GetProcessHeap () returned 0xd20000 [0106.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0106.492] GetProcessHeap () returned 0xd20000 [0106.492] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0106.492] GetProcessHeap () returned 0xd20000 [0106.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0106.492] GetProcessHeap () returned 0xd20000 [0106.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0106.492] GetProcessHeap () returned 0xd20000 [0106.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd45640 [0106.492] GetProcessHeap () returned 0xd20000 [0106.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0106.492] GetProcessHeap () returned 0xd20000 [0106.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44648 [0106.492] GetProcessHeap () returned 0xd20000 [0106.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ab88 [0106.492] GetProcessHeap () returned 0xd20000 [0106.492] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0106.492] GetProcessHeap () returned 0xd20000 [0106.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0106.493] GetProcessHeap () returned 0xd20000 [0106.493] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ab88 | out: hHeap=0xd20000) returned 1 [0106.493] GetProcessHeap () returned 0xd20000 [0106.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.493] GetProcessHeap () returned 0xd20000 [0106.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444f8 [0106.493] GetProcessHeap () returned 0xd20000 [0106.493] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0106.493] GetProcessHeap () returned 0xd20000 [0106.493] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.493] GetProcessHeap () returned 0xd20000 [0106.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0106.493] GetProcessHeap () returned 0xd20000 [0106.493] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0106.493] GetProcessHeap () returned 0xd20000 [0106.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.493] GetProcessHeap () returned 0xd20000 [0106.493] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.493] GetProcessHeap () returned 0xd20000 [0106.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b7e8 [0106.493] GetProcessHeap () returned 0xd20000 [0106.493] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444f8 | out: hHeap=0xd20000) returned 1 [0106.493] GetProcessHeap () returned 0xd20000 [0106.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0106.493] GetProcessHeap () returned 0xd20000 [0106.493] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0106.493] GetProcessHeap () returned 0xd20000 [0106.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0106.494] GetProcessHeap () returned 0xd20000 [0106.494] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0106.494] GetProcessHeap () returned 0xd20000 [0106.494] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.494] GetProcessHeap () returned 0xd20000 [0106.494] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.494] GetProcessHeap () returned 0xd20000 [0106.494] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0106.494] GetProcessHeap () returned 0xd20000 [0106.494] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0106.494] GetProcessHeap () returned 0xd20000 [0106.494] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0106.494] GetProcessHeap () returned 0xd20000 [0106.495] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0106.495] GetProcessHeap () returned 0xd20000 [0106.495] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0106.495] GetProcessHeap () returned 0xd20000 [0106.495] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0106.495] GetProcessHeap () returned 0xd20000 [0106.495] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.495] GetProcessHeap () returned 0xd20000 [0106.495] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.495] GetProcessHeap () returned 0xd20000 [0106.495] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0106.495] GetProcessHeap () returned 0xd20000 [0106.495] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0106.495] GetProcessHeap () returned 0xd20000 [0106.495] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0106.495] GetProcessHeap () returned 0xd20000 [0106.495] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0106.495] GetProcessHeap () returned 0xd20000 [0106.495] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.495] GetProcessHeap () returned 0xd20000 [0106.495] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.495] GetProcessHeap () returned 0xd20000 [0106.495] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0106.495] GetProcessHeap () returned 0xd20000 [0106.496] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0106.496] GetProcessHeap () returned 0xd20000 [0106.496] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.496] GetProcessHeap () returned 0xd20000 [0106.496] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.496] GetProcessHeap () returned 0xd20000 [0106.496] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.496] GetProcessHeap () returned 0xd20000 [0106.496] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.496] GetProcessHeap () returned 0xd20000 [0106.496] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.496] GetProcessHeap () returned 0xd20000 [0106.496] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.496] GetProcessHeap () returned 0xd20000 [0106.496] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.496] GetProcessHeap () returned 0xd20000 [0106.496] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.496] GetProcessHeap () returned 0xd20000 [0106.496] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0106.496] GetProcessHeap () returned 0xd20000 [0106.496] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0106.496] GetProcessHeap () returned 0xd20000 [0106.496] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0106.496] GetProcessHeap () returned 0xd20000 [0106.496] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0106.496] GetProcessHeap () returned 0xd20000 [0106.496] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0106.497] GetProcessHeap () returned 0xd20000 [0106.497] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0106.497] GetProcessHeap () returned 0xd20000 [0106.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.497] GetProcessHeap () returned 0xd20000 [0106.497] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.497] GetProcessHeap () returned 0xd20000 [0106.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.497] GetProcessHeap () returned 0xd20000 [0106.497] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.497] GetProcessHeap () returned 0xd20000 [0106.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0106.497] GetProcessHeap () returned 0xd20000 [0106.497] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0106.497] GetProcessHeap () returned 0xd20000 [0106.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0106.497] GetProcessHeap () returned 0xd20000 [0106.497] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0106.497] GetProcessHeap () returned 0xd20000 [0106.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0106.497] GetProcessHeap () returned 0xd20000 [0106.497] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0106.497] GetProcessHeap () returned 0xd20000 [0106.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.498] GetProcessHeap () returned 0xd20000 [0106.498] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.498] GetProcessHeap () returned 0xd20000 [0106.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.498] GetProcessHeap () returned 0xd20000 [0106.498] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.498] GetProcessHeap () returned 0xd20000 [0106.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.498] GetProcessHeap () returned 0xd20000 [0106.498] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.498] GetProcessHeap () returned 0xd20000 [0106.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.498] GetProcessHeap () returned 0xd20000 [0106.498] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.498] GetProcessHeap () returned 0xd20000 [0106.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0106.498] GetProcessHeap () returned 0xd20000 [0106.498] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0106.498] GetProcessHeap () returned 0xd20000 [0106.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0106.498] GetProcessHeap () returned 0xd20000 [0106.498] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0106.498] GetProcessHeap () returned 0xd20000 [0106.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0106.499] GetProcessHeap () returned 0xd20000 [0106.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0106.499] GetProcessHeap () returned 0xd20000 [0106.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0106.499] GetProcessHeap () returned 0xd20000 [0106.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0106.499] GetProcessHeap () returned 0xd20000 [0106.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.499] GetProcessHeap () returned 0xd20000 [0106.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.499] GetProcessHeap () returned 0xd20000 [0106.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.499] GetProcessHeap () returned 0xd20000 [0106.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.499] GetProcessHeap () returned 0xd20000 [0106.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.499] GetProcessHeap () returned 0xd20000 [0106.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.499] GetProcessHeap () returned 0xd20000 [0106.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0106.499] GetProcessHeap () returned 0xd20000 [0106.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0106.499] GetProcessHeap () returned 0xd20000 [0106.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0106.499] GetProcessHeap () returned 0xd20000 [0106.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0106.500] GetProcessHeap () returned 0xd20000 [0106.500] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.500] GetProcessHeap () returned 0xd20000 [0106.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.500] GetProcessHeap () returned 0xd20000 [0106.500] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0106.500] GetProcessHeap () returned 0xd20000 [0106.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0106.500] GetProcessHeap () returned 0xd20000 [0106.500] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.500] GetProcessHeap () returned 0xd20000 [0106.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.500] GetProcessHeap () returned 0xd20000 [0106.500] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.500] GetProcessHeap () returned 0xd20000 [0106.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.500] GetProcessHeap () returned 0xd20000 [0106.500] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0106.500] GetProcessHeap () returned 0xd20000 [0106.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0106.500] GetProcessHeap () returned 0xd20000 [0106.500] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0106.500] GetProcessHeap () returned 0xd20000 [0106.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0106.500] GetProcessHeap () returned 0xd20000 [0106.500] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0106.500] GetProcessHeap () returned 0xd20000 [0106.501] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0106.501] GetProcessHeap () returned 0xd20000 [0106.501] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0106.501] GetProcessHeap () returned 0xd20000 [0106.501] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0106.501] GetProcessHeap () returned 0xd20000 [0106.501] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.501] GetProcessHeap () returned 0xd20000 [0106.501] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.501] GetProcessHeap () returned 0xd20000 [0106.501] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0106.501] GetProcessHeap () returned 0xd20000 [0106.501] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0106.501] GetProcessHeap () returned 0xd20000 [0106.501] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.501] GetProcessHeap () returned 0xd20000 [0106.501] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.501] GetProcessHeap () returned 0xd20000 [0106.501] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0106.501] GetProcessHeap () returned 0xd20000 [0106.501] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0106.501] GetProcessHeap () returned 0xd20000 [0106.501] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.501] GetProcessHeap () returned 0xd20000 [0106.501] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.501] GetProcessHeap () returned 0xd20000 [0106.501] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.501] GetProcessHeap () returned 0xd20000 [0106.502] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.502] GetProcessHeap () returned 0xd20000 [0106.502] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0106.502] GetProcessHeap () returned 0xd20000 [0106.502] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0106.502] GetProcessHeap () returned 0xd20000 [0106.502] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.502] GetProcessHeap () returned 0xd20000 [0106.502] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.502] GetProcessHeap () returned 0xd20000 [0106.502] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0106.502] GetProcessHeap () returned 0xd20000 [0106.502] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0106.502] GetProcessHeap () returned 0xd20000 [0106.502] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.502] GetProcessHeap () returned 0xd20000 [0106.502] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.502] GetProcessHeap () returned 0xd20000 [0106.502] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0106.502] GetProcessHeap () returned 0xd20000 [0106.502] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0106.502] GetProcessHeap () returned 0xd20000 [0106.502] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.502] GetProcessHeap () returned 0xd20000 [0106.502] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.503] GetProcessHeap () returned 0xd20000 [0106.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0106.503] GetProcessHeap () returned 0xd20000 [0106.503] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0106.503] GetProcessHeap () returned 0xd20000 [0106.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.503] GetProcessHeap () returned 0xd20000 [0106.503] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.503] GetProcessHeap () returned 0xd20000 [0106.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.503] GetProcessHeap () returned 0xd20000 [0106.503] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.503] GetProcessHeap () returned 0xd20000 [0106.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.503] GetProcessHeap () returned 0xd20000 [0106.503] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.503] GetProcessHeap () returned 0xd20000 [0106.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.503] GetProcessHeap () returned 0xd20000 [0106.503] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.503] GetProcessHeap () returned 0xd20000 [0106.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.503] GetProcessHeap () returned 0xd20000 [0106.503] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.503] GetProcessHeap () returned 0xd20000 [0106.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0106.504] GetProcessHeap () returned 0xd20000 [0106.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0106.504] GetProcessHeap () returned 0xd20000 [0106.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.504] GetProcessHeap () returned 0xd20000 [0106.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.504] GetProcessHeap () returned 0xd20000 [0106.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0106.504] GetProcessHeap () returned 0xd20000 [0106.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0106.504] GetProcessHeap () returned 0xd20000 [0106.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0106.504] GetProcessHeap () returned 0xd20000 [0106.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0106.504] GetProcessHeap () returned 0xd20000 [0106.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0106.504] GetProcessHeap () returned 0xd20000 [0106.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0106.504] GetProcessHeap () returned 0xd20000 [0106.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0106.504] GetProcessHeap () returned 0xd20000 [0106.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0106.504] GetProcessHeap () returned 0xd20000 [0106.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0106.504] GetProcessHeap () returned 0xd20000 [0106.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0106.505] GetProcessHeap () returned 0xd20000 [0106.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0106.505] GetProcessHeap () returned 0xd20000 [0106.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0106.505] GetProcessHeap () returned 0xd20000 [0106.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0106.505] GetProcessHeap () returned 0xd20000 [0106.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0106.505] GetProcessHeap () returned 0xd20000 [0106.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0106.505] GetProcessHeap () returned 0xd20000 [0106.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0106.505] GetProcessHeap () returned 0xd20000 [0106.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.505] GetProcessHeap () returned 0xd20000 [0106.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.505] GetProcessHeap () returned 0xd20000 [0106.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0106.505] GetProcessHeap () returned 0xd20000 [0106.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0106.505] GetProcessHeap () returned 0xd20000 [0106.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.505] GetProcessHeap () returned 0xd20000 [0106.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.505] GetProcessHeap () returned 0xd20000 [0106.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0106.506] GetProcessHeap () returned 0xd20000 [0106.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0106.506] GetProcessHeap () returned 0xd20000 [0106.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0106.506] GetProcessHeap () returned 0xd20000 [0106.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0106.506] GetProcessHeap () returned 0xd20000 [0106.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0106.506] GetProcessHeap () returned 0xd20000 [0106.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0106.506] GetProcessHeap () returned 0xd20000 [0106.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.506] GetProcessHeap () returned 0xd20000 [0106.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.506] GetProcessHeap () returned 0xd20000 [0106.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.506] GetProcessHeap () returned 0xd20000 [0106.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.506] GetProcessHeap () returned 0xd20000 [0106.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0106.506] GetProcessHeap () returned 0xd20000 [0106.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0106.507] GetProcessHeap () returned 0xd20000 [0106.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0106.507] GetProcessHeap () returned 0xd20000 [0106.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0106.507] GetProcessHeap () returned 0xd20000 [0106.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.507] GetProcessHeap () returned 0xd20000 [0106.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.507] GetProcessHeap () returned 0xd20000 [0106.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0106.507] GetProcessHeap () returned 0xd20000 [0106.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0106.507] GetProcessHeap () returned 0xd20000 [0106.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0106.507] GetProcessHeap () returned 0xd20000 [0106.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0106.507] GetProcessHeap () returned 0xd20000 [0106.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.507] GetProcessHeap () returned 0xd20000 [0106.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.507] GetProcessHeap () returned 0xd20000 [0106.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0106.507] GetProcessHeap () returned 0xd20000 [0106.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0106.507] GetProcessHeap () returned 0xd20000 [0106.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0106.508] GetProcessHeap () returned 0xd20000 [0106.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0106.508] GetProcessHeap () returned 0xd20000 [0106.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44648 | out: hHeap=0xd20000) returned 1 [0106.508] GetProcessHeap () returned 0xd20000 [0106.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0106.508] GetProcessHeap () returned 0xd20000 [0106.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0106.508] GetProcessHeap () returned 0xd20000 [0106.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b878 | out: hHeap=0xd20000) returned 1 [0106.508] GetProcessHeap () returned 0xd20000 [0106.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0106.508] GetProcessHeap () returned 0xd20000 [0106.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.508] GetProcessHeap () returned 0xd20000 [0106.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0106.508] WriteFile (in: hFile=0x230, lpBuffer=0xd4eee8*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4eee8*, lpNumberOfBytesWritten=0x299d864*=0x382, lpOverlapped=0x0) returned 1 [0106.789] GetProcessHeap () returned 0xd20000 [0106.789] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4eee8, Size=0x30) returned 0xd4eee8 [0106.789] GetProcessHeap () returned 0xd20000 [0106.789] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0106.789] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0106.789] GetProcessHeap () returned 0xd20000 [0106.789] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xd0a0) returned 0xd4ef20 [0106.790] ReadFile (in: hFile=0x230, lpBuffer=0xd4ef20, nNumberOfBytesToRead=0xd0a0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4ef20*, lpNumberOfBytesRead=0x299d7e8*=0xd0a0, lpOverlapped=0x0) returned 1 [0106.792] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0106.792] WriteFile (in: hFile=0x230, lpBuffer=0xd4ef20*, nNumberOfBytesToWrite=0xd0a0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4ef20*, lpNumberOfBytesWritten=0x299d7e4*=0xd0a0, lpOverlapped=0x0) returned 1 [0106.794] GetProcessHeap () returned 0xd20000 [0106.794] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ef20 | out: hHeap=0xd20000) returned 1 [0106.794] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0106.794] WriteFile (in: hFile=0x230, lpBuffer=0xd4eee8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4eee8*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0106.796] CloseHandle (hObject=0x230) returned 1 [0106.801] GetProcessHeap () returned 0xd20000 [0106.801] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42828 | out: hHeap=0xd20000) returned 1 [0106.801] GetProcessHeap () returned 0xd20000 [0106.801] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c0e8 | out: hHeap=0xd20000) returned 1 [0106.801] GetProcessHeap () returned 0xd20000 [0106.801] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0106.801] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\Y6TH35ES6dnwU.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\Y6TH35ES6dnwU.avi") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\Y6TH35ES6dnwU.avi" [0106.801] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\Y6TH35ES6dnwU.avi", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\Y6TH35ES6dnwU.avi.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\Y6TH35ES6dnwU.avi.[ponce.lorena@aol.com]" [0106.801] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\Y6TH35ES6dnwU.avi" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\wr_a7iufou\\y6th35es6dnwu.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\Y6TH35ES6dnwU.avi.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\wr_a7iufou\\y6th35es6dnwu.avi.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0106.802] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\Y6TH35ES6dnwU.avi" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou") returned 1 [0106.802] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\") returned="" [0106.803] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\HOW_RECOVER.html" [0106.803] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\WR_a7iufou\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\wr_a7iufou\\how_recover.html")) returned 0x20 [0106.803] GetProcessHeap () returned 0xd20000 [0106.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36688 | out: hHeap=0xd20000) returned 1 [0106.803] FindNextFileW (in: hFindFile=0xd48de0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18b55a20, ftCreationTime.dwHighDateTime=0x1d4d5a7, ftLastAccessTime.dwLowDateTime=0xc2f2b680, ftLastAccessTime.dwHighDateTime=0x1d4d0a3, ftLastWriteTime.dwLowDateTime=0xc2f2b680, ftLastWriteTime.dwHighDateTime=0x1d4d0a3, nFileSizeHigh=0x0, nFileSizeLow=0xd09e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Y6TH35ES6dnwU.avi", cAlternateFileName="Y6TH35~1.AVI")) returned 0 [0106.803] FindClose (in: hFindFile=0xd48de0 | out: hFindFile=0xd48de0) returned 1 [0106.803] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\" [0106.803] GetProcessHeap () returned 0xd20000 [0106.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4d518 | out: hHeap=0xd20000) returned 1 [0106.803] GetProcessHeap () returned 0xd20000 [0106.803] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0106.803] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\") returned 57 [0106.803] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\*") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\*" [0106.804] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebba1cd0, ftCreationTime.dwHighDateTime=0x1d4c616, ftLastAccessTime.dwLowDateTime=0x8a6c7bb0, ftLastAccessTime.dwHighDateTime=0x1d4cc12, ftLastWriteTime.dwLowDateTime=0x8a6c7bb0, ftLastWriteTime.dwHighDateTime=0x1d4cc12, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd48ca0 [0106.804] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0106.804] FindNextFileW (in: hFindFile=0xd48ca0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebba1cd0, ftCreationTime.dwHighDateTime=0x1d4c616, ftLastAccessTime.dwLowDateTime=0x8a6c7bb0, ftLastAccessTime.dwHighDateTime=0x1d4cc12, ftLastWriteTime.dwLowDateTime=0x8a6c7bb0, ftLastWriteTime.dwHighDateTime=0x1d4cc12, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.804] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0106.804] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0106.804] FindNextFileW (in: hFindFile=0xd48ca0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12f4e970, ftCreationTime.dwHighDateTime=0x1d4d264, ftLastAccessTime.dwLowDateTime=0x334f1d80, ftLastAccessTime.dwHighDateTime=0x1d4d5ca, ftLastWriteTime.dwLowDateTime=0x334f1d80, ftLastWriteTime.dwHighDateTime=0x1d4d5ca, nFileSizeHigh=0x0, nFileSizeLow=0x34e1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4KKaWl7G8.flv", cAlternateFileName="4KKAWL~1.FLV")) returned 1 [0106.804] lstrcmpiW (lpString1="4KKaWl7G8.flv", lpString2=".") returned 1 [0106.804] lstrcmpiW (lpString1="4KKaWl7G8.flv", lpString2="..") returned 1 [0106.804] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\", lpString2="4KKaWl7G8.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\4KKaWl7G8.flv") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\4KKaWl7G8.flv" [0106.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4KKaWl7G8.flv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0106.804] GetProcessHeap () returned 0xd20000 [0106.804] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xe) returned 0xd44678 [0106.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="4KKaWl7G8.flv", cchWideChar=-1, lpMultiByteStr=0xd44678, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4KKaWl7G8.flv", lpUsedDefaultChar=0x0) returned 14 [0106.804] lstrlenA (lpString="4KKaWl7G8.flv") returned 13 [0106.804] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0106.805] lstrlenA (lpString="4KKaWl7G8.flv") returned 13 [0106.805] lstrlenA (lpString=".dll") returned 4 [0106.805] lstrlenA (lpString=".dll") returned 4 [0106.805] lstrlenA (lpString="4KKaWl7G8.flv") returned 13 [0106.805] lstrcmpiA (lpString1=".flv", lpString2=".dll") returned 1 [0106.805] lstrlenA (lpString="4KKaWl7G8.flv") returned 13 [0106.805] lstrlenA (lpString=".ini") returned 4 [0106.805] lstrlenA (lpString=".ini") returned 4 [0106.805] lstrlenA (lpString="4KKaWl7G8.flv") returned 13 [0106.805] lstrcmpiA (lpString1=".flv", lpString2=".ini") returned -1 [0106.805] lstrlenA (lpString="4KKaWl7G8.flv") returned 13 [0106.805] lstrlenA (lpString=".inc") returned 4 [0106.805] lstrlenA (lpString=".inc") returned 4 [0106.805] lstrlenA (lpString="4KKaWl7G8.flv") returned 13 [0106.805] lstrcmpiA (lpString1=".flv", lpString2=".inc") returned -1 [0106.805] lstrcmpiW (lpString1="4KKaWl7G8.flv", lpString2="HOW_RECOVER.html") returned -1 [0106.805] lstrcmpiW (lpString1="4KKaWl7G8.flv", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0106.805] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0106.805] lstrcmpiW (lpString1="4KKaWl7G8.flv", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0106.805] GetProcessHeap () returned 0xd20000 [0106.805] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42558 [0106.806] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\4KKaWl7G8.flv" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\uobad49auemcjxvufdb\\4kkawl7g8.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0106.806] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=13537) returned 1 [0106.806] GetProcessHeap () returned 0xd20000 [0106.806] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c160 [0106.806] GetProcessHeap () returned 0xd20000 [0106.806] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0106.806] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\4KKaWl7G8.flv") returned 70 [0106.806] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0106.806] GetProcessHeap () returned 0xd20000 [0106.806] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0106.807] GetProcessHeap () returned 0xd20000 [0106.807] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4ef20 [0106.809] lstrlenA (lpString="rsa_encrypt") returned 11 [0106.809] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0106.811] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0106.811] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0106.811] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0106.811] GetProcessHeap () returned 0xd20000 [0106.811] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0106.811] lstrlenA (lpString="010001") returned 6 [0106.811] GetProcessHeap () returned 0xd20000 [0106.811] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cf38 [0106.811] GetProcessHeap () returned 0xd20000 [0106.811] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0106.812] GetProcessHeap () returned 0xd20000 [0106.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aca8 [0106.812] GetProcessHeap () returned 0xd20000 [0106.812] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0106.812] GetProcessHeap () returned 0xd20000 [0106.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b6c8 [0106.812] GetProcessHeap () returned 0xd20000 [0106.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44b50 [0106.812] GetProcessHeap () returned 0xd20000 [0106.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cf08 [0106.812] GetProcessHeap () returned 0xd20000 [0106.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44c68 [0106.812] GetProcessHeap () returned 0xd20000 [0106.812] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0106.812] GetProcessHeap () returned 0xd20000 [0106.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0106.812] GetProcessHeap () returned 0xd20000 [0106.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0106.812] GetProcessHeap () returned 0xd20000 [0106.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd45410 [0106.812] GetProcessHeap () returned 0xd20000 [0106.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0106.812] GetProcessHeap () returned 0xd20000 [0106.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446c0 [0106.813] GetProcessHeap () returned 0xd20000 [0106.813] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0106.813] GetProcessHeap () returned 0xd20000 [0106.813] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0106.813] GetProcessHeap () returned 0xd20000 [0106.813] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0106.813] GetProcessHeap () returned 0xd20000 [0106.813] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0106.813] GetProcessHeap () returned 0xd20000 [0106.813] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0106.813] GetProcessHeap () returned 0xd20000 [0106.813] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44630 [0106.813] GetProcessHeap () returned 0xd20000 [0106.813] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0106.813] GetProcessHeap () returned 0xd20000 [0106.813] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0106.813] GetProcessHeap () returned 0xd20000 [0106.813] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.813] GetProcessHeap () returned 0xd20000 [0106.813] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.813] GetProcessHeap () returned 0xd20000 [0106.813] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0106.814] GetProcessHeap () returned 0xd20000 [0106.814] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.814] GetProcessHeap () returned 0xd20000 [0106.814] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b3f8 [0106.814] GetProcessHeap () returned 0xd20000 [0106.814] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44630 | out: hHeap=0xd20000) returned 1 [0106.814] GetProcessHeap () returned 0xd20000 [0106.814] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0106.814] GetProcessHeap () returned 0xd20000 [0106.814] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b3f8 | out: hHeap=0xd20000) returned 1 [0106.814] GetProcessHeap () returned 0xd20000 [0106.814] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0106.814] GetProcessHeap () returned 0xd20000 [0106.814] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0106.814] GetProcessHeap () returned 0xd20000 [0106.814] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0106.814] GetProcessHeap () returned 0xd20000 [0106.814] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0106.814] GetProcessHeap () returned 0xd20000 [0106.814] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0106.814] GetProcessHeap () returned 0xd20000 [0106.814] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.814] GetProcessHeap () returned 0xd20000 [0106.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.815] GetProcessHeap () returned 0xd20000 [0106.815] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.815] GetProcessHeap () returned 0xd20000 [0106.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0106.815] GetProcessHeap () returned 0xd20000 [0106.815] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0106.815] GetProcessHeap () returned 0xd20000 [0106.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0106.815] GetProcessHeap () returned 0xd20000 [0106.815] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.815] GetProcessHeap () returned 0xd20000 [0106.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0106.815] GetProcessHeap () returned 0xd20000 [0106.815] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0106.815] GetProcessHeap () returned 0xd20000 [0106.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0106.815] GetProcessHeap () returned 0xd20000 [0106.815] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.815] GetProcessHeap () returned 0xd20000 [0106.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.815] GetProcessHeap () returned 0xd20000 [0106.815] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.815] GetProcessHeap () returned 0xd20000 [0106.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.816] GetProcessHeap () returned 0xd20000 [0106.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.816] GetProcessHeap () returned 0xd20000 [0106.816] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.816] GetProcessHeap () returned 0xd20000 [0106.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.816] GetProcessHeap () returned 0xd20000 [0106.816] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.816] GetProcessHeap () returned 0xd20000 [0106.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.816] GetProcessHeap () returned 0xd20000 [0106.816] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.816] GetProcessHeap () returned 0xd20000 [0106.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.816] GetProcessHeap () returned 0xd20000 [0106.816] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0106.816] GetProcessHeap () returned 0xd20000 [0106.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0106.817] GetProcessHeap () returned 0xd20000 [0106.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.817] GetProcessHeap () returned 0xd20000 [0106.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.817] GetProcessHeap () returned 0xd20000 [0106.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.817] GetProcessHeap () returned 0xd20000 [0106.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.817] GetProcessHeap () returned 0xd20000 [0106.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.817] GetProcessHeap () returned 0xd20000 [0106.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.817] GetProcessHeap () returned 0xd20000 [0106.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0106.817] GetProcessHeap () returned 0xd20000 [0106.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0106.817] GetProcessHeap () returned 0xd20000 [0106.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0106.817] GetProcessHeap () returned 0xd20000 [0106.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0106.817] GetProcessHeap () returned 0xd20000 [0106.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.817] GetProcessHeap () returned 0xd20000 [0106.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.818] GetProcessHeap () returned 0xd20000 [0106.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0106.818] GetProcessHeap () returned 0xd20000 [0106.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0106.818] GetProcessHeap () returned 0xd20000 [0106.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0106.818] GetProcessHeap () returned 0xd20000 [0106.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0106.818] GetProcessHeap () returned 0xd20000 [0106.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0106.818] GetProcessHeap () returned 0xd20000 [0106.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0106.818] GetProcessHeap () returned 0xd20000 [0106.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.818] GetProcessHeap () returned 0xd20000 [0106.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.818] GetProcessHeap () returned 0xd20000 [0106.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0106.818] GetProcessHeap () returned 0xd20000 [0106.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0106.818] GetProcessHeap () returned 0xd20000 [0106.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0106.818] GetProcessHeap () returned 0xd20000 [0106.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.819] GetProcessHeap () returned 0xd20000 [0106.819] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.819] GetProcessHeap () returned 0xd20000 [0106.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.819] GetProcessHeap () returned 0xd20000 [0106.819] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.819] GetProcessHeap () returned 0xd20000 [0106.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.819] GetProcessHeap () returned 0xd20000 [0106.819] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.819] GetProcessHeap () returned 0xd20000 [0106.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.819] GetProcessHeap () returned 0xd20000 [0106.819] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0106.819] GetProcessHeap () returned 0xd20000 [0106.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0106.819] GetProcessHeap () returned 0xd20000 [0106.819] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.819] GetProcessHeap () returned 0xd20000 [0106.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.819] GetProcessHeap () returned 0xd20000 [0106.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0106.820] GetProcessHeap () returned 0xd20000 [0106.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0106.820] GetProcessHeap () returned 0xd20000 [0106.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0106.820] GetProcessHeap () returned 0xd20000 [0106.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0106.820] GetProcessHeap () returned 0xd20000 [0106.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.820] GetProcessHeap () returned 0xd20000 [0106.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.820] GetProcessHeap () returned 0xd20000 [0106.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0106.820] GetProcessHeap () returned 0xd20000 [0106.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0106.820] GetProcessHeap () returned 0xd20000 [0106.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0106.820] GetProcessHeap () returned 0xd20000 [0106.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0106.820] GetProcessHeap () returned 0xd20000 [0106.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.820] GetProcessHeap () returned 0xd20000 [0106.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.821] GetProcessHeap () returned 0xd20000 [0106.821] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.821] GetProcessHeap () returned 0xd20000 [0106.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.821] GetProcessHeap () returned 0xd20000 [0106.821] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.821] GetProcessHeap () returned 0xd20000 [0106.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.821] GetProcessHeap () returned 0xd20000 [0106.821] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0106.821] GetProcessHeap () returned 0xd20000 [0106.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0106.821] GetProcessHeap () returned 0xd20000 [0106.821] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0106.821] GetProcessHeap () returned 0xd20000 [0106.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0106.821] GetProcessHeap () returned 0xd20000 [0106.821] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.821] GetProcessHeap () returned 0xd20000 [0106.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.821] GetProcessHeap () returned 0xd20000 [0106.821] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.821] GetProcessHeap () returned 0xd20000 [0106.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.822] GetProcessHeap () returned 0xd20000 [0106.822] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.822] GetProcessHeap () returned 0xd20000 [0106.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.822] GetProcessHeap () returned 0xd20000 [0106.822] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0106.822] GetProcessHeap () returned 0xd20000 [0106.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0106.822] GetProcessHeap () returned 0xd20000 [0106.822] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.822] GetProcessHeap () returned 0xd20000 [0106.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.856] GetProcessHeap () returned 0xd20000 [0106.856] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0106.856] GetProcessHeap () returned 0xd20000 [0106.856] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0106.856] GetProcessHeap () returned 0xd20000 [0106.856] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.856] GetProcessHeap () returned 0xd20000 [0106.856] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.856] GetProcessHeap () returned 0xd20000 [0106.856] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0106.857] GetProcessHeap () returned 0xd20000 [0106.857] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0106.857] GetProcessHeap () returned 0xd20000 [0106.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0106.857] GetProcessHeap () returned 0xd20000 [0106.857] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0106.857] GetProcessHeap () returned 0xd20000 [0106.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.857] GetProcessHeap () returned 0xd20000 [0106.857] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.857] GetProcessHeap () returned 0xd20000 [0106.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0106.857] GetProcessHeap () returned 0xd20000 [0106.857] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0106.857] GetProcessHeap () returned 0xd20000 [0106.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.857] GetProcessHeap () returned 0xd20000 [0106.857] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.858] GetProcessHeap () returned 0xd20000 [0106.858] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.858] GetProcessHeap () returned 0xd20000 [0106.858] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.858] GetProcessHeap () returned 0xd20000 [0106.858] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0106.858] GetProcessHeap () returned 0xd20000 [0106.858] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0106.858] GetProcessHeap () returned 0xd20000 [0106.858] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.858] GetProcessHeap () returned 0xd20000 [0106.858] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.858] GetProcessHeap () returned 0xd20000 [0106.858] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.858] GetProcessHeap () returned 0xd20000 [0106.858] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.858] GetProcessHeap () returned 0xd20000 [0106.858] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.858] GetProcessHeap () returned 0xd20000 [0106.859] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.859] GetProcessHeap () returned 0xd20000 [0106.859] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.859] GetProcessHeap () returned 0xd20000 [0106.859] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.859] GetProcessHeap () returned 0xd20000 [0106.859] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.859] GetProcessHeap () returned 0xd20000 [0106.859] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.859] GetProcessHeap () returned 0xd20000 [0106.859] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0106.859] GetProcessHeap () returned 0xd20000 [0106.859] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0106.869] GetProcessHeap () returned 0xd20000 [0106.869] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.869] GetProcessHeap () returned 0xd20000 [0106.869] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.869] GetProcessHeap () returned 0xd20000 [0106.869] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0106.869] GetProcessHeap () returned 0xd20000 [0106.869] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0106.869] GetProcessHeap () returned 0xd20000 [0106.870] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.870] GetProcessHeap () returned 0xd20000 [0106.870] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.870] GetProcessHeap () returned 0xd20000 [0106.870] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0106.870] GetProcessHeap () returned 0xd20000 [0106.870] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0106.870] GetProcessHeap () returned 0xd20000 [0106.870] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.870] GetProcessHeap () returned 0xd20000 [0106.870] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.870] GetProcessHeap () returned 0xd20000 [0106.870] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0106.870] GetProcessHeap () returned 0xd20000 [0106.870] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0106.870] GetProcessHeap () returned 0xd20000 [0106.870] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0106.870] GetProcessHeap () returned 0xd20000 [0106.870] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0106.871] GetProcessHeap () returned 0xd20000 [0106.871] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.871] GetProcessHeap () returned 0xd20000 [0106.871] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.871] GetProcessHeap () returned 0xd20000 [0106.871] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0106.871] GetProcessHeap () returned 0xd20000 [0106.871] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0106.871] GetProcessHeap () returned 0xd20000 [0106.871] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0106.871] GetProcessHeap () returned 0xd20000 [0106.871] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0106.871] GetProcessHeap () returned 0xd20000 [0106.871] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.871] GetProcessHeap () returned 0xd20000 [0106.871] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.871] GetProcessHeap () returned 0xd20000 [0106.871] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0106.871] GetProcessHeap () returned 0xd20000 [0106.872] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0106.872] GetProcessHeap () returned 0xd20000 [0106.872] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0106.872] GetProcessHeap () returned 0xd20000 [0106.872] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0106.872] GetProcessHeap () returned 0xd20000 [0106.872] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.872] GetProcessHeap () returned 0xd20000 [0106.872] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.872] GetProcessHeap () returned 0xd20000 [0106.872] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0106.872] GetProcessHeap () returned 0xd20000 [0106.872] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0106.872] GetProcessHeap () returned 0xd20000 [0106.872] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0106.872] GetProcessHeap () returned 0xd20000 [0106.872] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0106.872] GetProcessHeap () returned 0xd20000 [0106.873] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0106.873] GetProcessHeap () returned 0xd20000 [0106.873] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0106.873] GetProcessHeap () returned 0xd20000 [0106.873] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0106.873] GetProcessHeap () returned 0xd20000 [0106.873] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0106.873] GetProcessHeap () returned 0xd20000 [0106.873] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0106.873] GetProcessHeap () returned 0xd20000 [0106.873] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0106.873] GetProcessHeap () returned 0xd20000 [0106.873] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0106.873] GetProcessHeap () returned 0xd20000 [0106.873] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0106.873] GetProcessHeap () returned 0xd20000 [0106.873] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0106.873] GetProcessHeap () returned 0xd20000 [0106.874] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0106.874] GetProcessHeap () returned 0xd20000 [0106.874] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0106.874] GetProcessHeap () returned 0xd20000 [0106.874] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0106.874] GetProcessHeap () returned 0xd20000 [0106.874] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0106.874] GetProcessHeap () returned 0xd20000 [0106.874] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0106.874] GetProcessHeap () returned 0xd20000 [0106.874] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0106.874] GetProcessHeap () returned 0xd20000 [0106.874] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0106.874] GetProcessHeap () returned 0xd20000 [0106.874] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0106.874] GetProcessHeap () returned 0xd20000 [0106.874] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0106.874] GetProcessHeap () returned 0xd20000 [0106.874] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0106.875] GetProcessHeap () returned 0xd20000 [0106.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0106.875] GetProcessHeap () returned 0xd20000 [0106.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446c0 | out: hHeap=0xd20000) returned 1 [0106.875] GetProcessHeap () returned 0xd20000 [0106.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b6c8 | out: hHeap=0xd20000) returned 1 [0106.875] GetProcessHeap () returned 0xd20000 [0106.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0106.875] GetProcessHeap () returned 0xd20000 [0106.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aca8 | out: hHeap=0xd20000) returned 1 [0106.875] GetProcessHeap () returned 0xd20000 [0106.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0106.875] GetProcessHeap () returned 0xd20000 [0106.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0106.875] GetProcessHeap () returned 0xd20000 [0106.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0106.876] WriteFile (in: hFile=0x230, lpBuffer=0xd4ef20*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ef20*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0106.877] GetProcessHeap () returned 0xd20000 [0106.877] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4ef20, Size=0x30) returned 0xd4ef20 [0106.877] GetProcessHeap () returned 0xd20000 [0106.878] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0106.878] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0106.878] GetProcessHeap () returned 0xd20000 [0106.878] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x34e1) returned 0xd4ef58 [0106.878] ReadFile (in: hFile=0x230, lpBuffer=0xd4ef58, nNumberOfBytesToRead=0x34e1, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4ef58*, lpNumberOfBytesRead=0x299d7e8*=0x34e1, lpOverlapped=0x0) returned 1 [0106.878] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0106.879] WriteFile (in: hFile=0x230, lpBuffer=0xd4ef58*, nNumberOfBytesToWrite=0x34e1, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4ef58*, lpNumberOfBytesWritten=0x299d7e4*=0x34e1, lpOverlapped=0x0) returned 1 [0106.880] GetProcessHeap () returned 0xd20000 [0106.880] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ef58 | out: hHeap=0xd20000) returned 1 [0106.880] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0106.880] WriteFile (in: hFile=0x230, lpBuffer=0xd4ef20*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ef20*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0106.881] CloseHandle (hObject=0x230) returned 1 [0106.905] GetProcessHeap () returned 0xd20000 [0106.905] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42558 | out: hHeap=0xd20000) returned 1 [0106.905] GetProcessHeap () returned 0xd20000 [0106.905] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c160 | out: hHeap=0xd20000) returned 1 [0106.905] GetProcessHeap () returned 0xd20000 [0106.905] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0106.906] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\4KKaWl7G8.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\4KKaWl7G8.flv") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\4KKaWl7G8.flv" [0106.906] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\4KKaWl7G8.flv", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\4KKaWl7G8.flv.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\4KKaWl7G8.flv.[ponce.lorena@aol.com]" [0106.906] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\4KKaWl7G8.flv" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\uobad49auemcjxvufdb\\4kkawl7g8.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\4KKaWl7G8.flv.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\uobad49auemcjxvufdb\\4kkawl7g8.flv.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0106.906] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\4KKaWl7G8.flv" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb") returned 1 [0106.907] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\") returned="" [0106.907] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\HOW_RECOVER.html" [0106.907] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\uobad49auemcjxvufdb\\how_recover.html")) returned 0xffffffff [0106.907] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\uobad49auemcjxvufdb\\how_recover.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0106.908] GetProcessHeap () returned 0xd20000 [0106.908] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c0e8 [0106.908] GetProcessHeap () returned 0xd20000 [0106.908] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0106.919] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.921] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.921] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.921] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.921] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.922] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.922] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.922] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.922] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.922] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.922] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.929] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.929] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.929] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.929] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.929] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.929] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.929] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.930] GetProcessHeap () returned 0xd20000 [0106.930] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c0e8 | out: hHeap=0xd20000) returned 1 [0106.930] GetProcessHeap () returned 0xd20000 [0106.930] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0106.930] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x299d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x299d9d0*=0x300, lpOverlapped=0x0) returned 1 [0106.931] GetProcessHeap () returned 0xd20000 [0106.931] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bf08 [0106.931] GetProcessHeap () returned 0xd20000 [0106.931] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0106.945] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.946] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.946] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.946] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.946] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.946] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.946] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.946] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.947] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.947] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.947] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.947] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.996] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.996] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.996] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.996] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.997] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.997] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.997] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.997] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.997] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.997] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.997] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.997] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.998] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.998] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.998] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.998] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.998] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.998] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.998] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.999] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.999] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.999] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.999] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.999] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.999] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0106.999] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.000] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.000] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.000] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.000] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.000] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.000] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.000] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.000] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.001] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.001] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.001] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.001] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.001] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.001] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.001] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.002] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.002] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.002] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.002] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.002] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.002] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.002] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.003] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.003] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.003] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.003] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.003] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.003] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.003] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.003] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.004] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.004] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.004] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.004] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.004] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.004] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.004] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.005] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.005] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.005] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.005] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.005] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.005] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.005] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.006] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.006] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.006] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.006] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.006] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.006] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.006] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.006] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.007] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.007] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.007] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.007] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.007] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.007] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.007] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.007] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.008] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.008] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.008] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.008] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.008] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.008] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.008] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.009] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.009] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.009] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.009] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.009] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.009] GetProcessHeap () returned 0xd20000 [0107.009] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bf08 | out: hHeap=0xd20000) returned 1 [0107.009] GetProcessHeap () returned 0xd20000 [0107.010] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0107.010] CloseHandle (hObject=0x230) returned 1 [0107.011] GetProcessHeap () returned 0xd20000 [0107.011] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44678 | out: hHeap=0xd20000) returned 1 [0107.011] FindNextFileW (in: hFindFile=0xd48ca0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44179870, ftCreationTime.dwHighDateTime=0x1d4c75d, ftLastAccessTime.dwLowDateTime=0x76bb9a10, ftLastAccessTime.dwHighDateTime=0x1d4c587, ftLastWriteTime.dwLowDateTime=0x76bb9a10, ftLastWriteTime.dwHighDateTime=0x1d4c587, nFileSizeHigh=0x0, nFileSizeLow=0x280e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="9e23KEsr9szh66CxZiX.flv", cAlternateFileName="9E23KE~1.FLV")) returned 1 [0107.011] lstrcmpiW (lpString1="9e23KEsr9szh66CxZiX.flv", lpString2=".") returned 1 [0107.011] lstrcmpiW (lpString1="9e23KEsr9szh66CxZiX.flv", lpString2="..") returned 1 [0107.011] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\", lpString2="9e23KEsr9szh66CxZiX.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\9e23KEsr9szh66CxZiX.flv") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\9e23KEsr9szh66CxZiX.flv" [0107.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="9e23KEsr9szh66CxZiX.flv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0107.011] GetProcessHeap () returned 0xd20000 [0107.011] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x18) returned 0xd366c8 [0107.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="9e23KEsr9szh66CxZiX.flv", cchWideChar=-1, lpMultiByteStr=0xd366c8, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9e23KEsr9szh66CxZiX.flv", lpUsedDefaultChar=0x0) returned 24 [0107.011] lstrlenA (lpString="9e23KEsr9szh66CxZiX.flv") returned 23 [0107.011] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0107.011] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0107.011] lstrlenA (lpString="9e23KEsr9szh66CxZiX.flv") returned 23 [0107.011] lstrcmpiA (lpString1="9e23KEsr9szh66CxZiX.flv", lpString2=".[ponce.lorena@aol.com]") returned 1 [0107.011] lstrlenA (lpString="9e23KEsr9szh66CxZiX.flv") returned 23 [0107.011] lstrlenA (lpString=".dll") returned 4 [0107.011] lstrlenA (lpString=".dll") returned 4 [0107.012] lstrlenA (lpString="9e23KEsr9szh66CxZiX.flv") returned 23 [0107.012] lstrcmpiA (lpString1=".flv", lpString2=".dll") returned 1 [0107.012] lstrlenA (lpString="9e23KEsr9szh66CxZiX.flv") returned 23 [0107.012] lstrlenA (lpString=".ini") returned 4 [0107.012] lstrlenA (lpString=".ini") returned 4 [0107.012] lstrlenA (lpString="9e23KEsr9szh66CxZiX.flv") returned 23 [0107.012] lstrcmpiA (lpString1=".flv", lpString2=".ini") returned -1 [0107.012] lstrlenA (lpString="9e23KEsr9szh66CxZiX.flv") returned 23 [0107.012] lstrlenA (lpString=".inc") returned 4 [0107.012] lstrlenA (lpString=".inc") returned 4 [0107.012] lstrlenA (lpString="9e23KEsr9szh66CxZiX.flv") returned 23 [0107.012] lstrcmpiA (lpString1=".flv", lpString2=".inc") returned -1 [0107.012] lstrcmpiW (lpString1="9e23KEsr9szh66CxZiX.flv", lpString2="HOW_RECOVER.html") returned -1 [0107.012] lstrcmpiW (lpString1="9e23KEsr9szh66CxZiX.flv", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0107.012] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0107.012] lstrcmpiW (lpString1="9e23KEsr9szh66CxZiX.flv", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0107.012] GetProcessHeap () returned 0xd20000 [0107.012] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42738 [0107.012] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\9e23KEsr9szh66CxZiX.flv" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\uobad49auemcjxvufdb\\9e23kesr9szh66cxzix.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0107.013] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=10254) returned 1 [0107.013] GetProcessHeap () returned 0xd20000 [0107.013] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bb48 [0107.013] GetProcessHeap () returned 0xd20000 [0107.013] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0107.013] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\9e23KEsr9szh66CxZiX.flv") returned 80 [0107.013] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0107.013] GetProcessHeap () returned 0xd20000 [0107.013] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0107.013] GetProcessHeap () returned 0xd20000 [0107.013] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4ef58 [0107.013] lstrlenA (lpString="rsa_encrypt") returned 11 [0107.013] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0107.015] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0107.015] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0107.015] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0107.015] GetProcessHeap () returned 0xd20000 [0107.015] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0107.015] lstrlenA (lpString="010001") returned 6 [0107.015] GetProcessHeap () returned 0xd20000 [0107.016] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ce58 [0107.016] GetProcessHeap () returned 0xd20000 [0107.016] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0107.016] GetProcessHeap () returned 0xd20000 [0107.016] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4a948 [0107.016] GetProcessHeap () returned 0xd20000 [0107.016] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0107.016] GetProcessHeap () returned 0xd20000 [0107.016] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ad38 [0107.016] GetProcessHeap () returned 0xd20000 [0107.016] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45640 [0107.016] GetProcessHeap () returned 0xd20000 [0107.016] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cec8 [0107.016] GetProcessHeap () returned 0xd20000 [0107.016] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0107.016] GetProcessHeap () returned 0xd20000 [0107.016] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.016] GetProcessHeap () returned 0xd20000 [0107.016] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44c68 [0107.016] GetProcessHeap () returned 0xd20000 [0107.016] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0107.016] GetProcessHeap () returned 0xd20000 [0107.016] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44a38 [0107.016] GetProcessHeap () returned 0xd20000 [0107.016] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0107.016] GetProcessHeap () returned 0xd20000 [0107.017] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44408 [0107.017] GetProcessHeap () returned 0xd20000 [0107.017] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b6c8 [0107.017] GetProcessHeap () returned 0xd20000 [0107.017] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0107.017] GetProcessHeap () returned 0xd20000 [0107.017] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0107.017] GetProcessHeap () returned 0xd20000 [0107.017] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b6c8 | out: hHeap=0xd20000) returned 1 [0107.017] GetProcessHeap () returned 0xd20000 [0107.017] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.017] GetProcessHeap () returned 0xd20000 [0107.017] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445a0 [0107.017] GetProcessHeap () returned 0xd20000 [0107.017] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0107.017] GetProcessHeap () returned 0xd20000 [0107.017] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.017] GetProcessHeap () returned 0xd20000 [0107.017] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.017] GetProcessHeap () returned 0xd20000 [0107.017] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.017] GetProcessHeap () returned 0xd20000 [0107.017] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.017] GetProcessHeap () returned 0xd20000 [0107.017] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.017] GetProcessHeap () returned 0xd20000 [0107.017] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b878 [0107.018] GetProcessHeap () returned 0xd20000 [0107.018] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445a0 | out: hHeap=0xd20000) returned 1 [0107.018] GetProcessHeap () returned 0xd20000 [0107.018] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0107.018] GetProcessHeap () returned 0xd20000 [0107.018] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b878 | out: hHeap=0xd20000) returned 1 [0107.018] GetProcessHeap () returned 0xd20000 [0107.018] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.018] GetProcessHeap () returned 0xd20000 [0107.018] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.018] GetProcessHeap () returned 0xd20000 [0107.018] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0107.018] GetProcessHeap () returned 0xd20000 [0107.018] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0107.018] GetProcessHeap () returned 0xd20000 [0107.018] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.018] GetProcessHeap () returned 0xd20000 [0107.018] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.018] GetProcessHeap () returned 0xd20000 [0107.018] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.018] GetProcessHeap () returned 0xd20000 [0107.018] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.018] GetProcessHeap () returned 0xd20000 [0107.018] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.018] GetProcessHeap () returned 0xd20000 [0107.018] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.018] GetProcessHeap () returned 0xd20000 [0107.018] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.019] GetProcessHeap () returned 0xd20000 [0107.019] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.019] GetProcessHeap () returned 0xd20000 [0107.019] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.019] GetProcessHeap () returned 0xd20000 [0107.019] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.019] GetProcessHeap () returned 0xd20000 [0107.019] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.019] GetProcessHeap () returned 0xd20000 [0107.019] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.019] GetProcessHeap () returned 0xd20000 [0107.019] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.019] GetProcessHeap () returned 0xd20000 [0107.019] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.019] GetProcessHeap () returned 0xd20000 [0107.019] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.019] GetProcessHeap () returned 0xd20000 [0107.019] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.019] GetProcessHeap () returned 0xd20000 [0107.019] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.019] GetProcessHeap () returned 0xd20000 [0107.019] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.019] GetProcessHeap () returned 0xd20000 [0107.019] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.020] GetProcessHeap () returned 0xd20000 [0107.020] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.020] GetProcessHeap () returned 0xd20000 [0107.020] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.020] GetProcessHeap () returned 0xd20000 [0107.020] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.020] GetProcessHeap () returned 0xd20000 [0107.020] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.020] GetProcessHeap () returned 0xd20000 [0107.020] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.020] GetProcessHeap () returned 0xd20000 [0107.020] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.020] GetProcessHeap () returned 0xd20000 [0107.020] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.020] GetProcessHeap () returned 0xd20000 [0107.020] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.020] GetProcessHeap () returned 0xd20000 [0107.020] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.020] GetProcessHeap () returned 0xd20000 [0107.020] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.020] GetProcessHeap () returned 0xd20000 [0107.020] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.020] GetProcessHeap () returned 0xd20000 [0107.020] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.020] GetProcessHeap () returned 0xd20000 [0107.021] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.021] GetProcessHeap () returned 0xd20000 [0107.021] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.021] GetProcessHeap () returned 0xd20000 [0107.021] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.021] GetProcessHeap () returned 0xd20000 [0107.021] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.021] GetProcessHeap () returned 0xd20000 [0107.021] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.021] GetProcessHeap () returned 0xd20000 [0107.021] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.021] GetProcessHeap () returned 0xd20000 [0107.021] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.021] GetProcessHeap () returned 0xd20000 [0107.021] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.021] GetProcessHeap () returned 0xd20000 [0107.021] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.021] GetProcessHeap () returned 0xd20000 [0107.021] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.021] GetProcessHeap () returned 0xd20000 [0107.021] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.021] GetProcessHeap () returned 0xd20000 [0107.021] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.021] GetProcessHeap () returned 0xd20000 [0107.021] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.021] GetProcessHeap () returned 0xd20000 [0107.021] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.022] GetProcessHeap () returned 0xd20000 [0107.022] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.022] GetProcessHeap () returned 0xd20000 [0107.022] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.022] GetProcessHeap () returned 0xd20000 [0107.022] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.022] GetProcessHeap () returned 0xd20000 [0107.022] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.022] GetProcessHeap () returned 0xd20000 [0107.022] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.022] GetProcessHeap () returned 0xd20000 [0107.022] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.022] GetProcessHeap () returned 0xd20000 [0107.022] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.022] GetProcessHeap () returned 0xd20000 [0107.022] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.022] GetProcessHeap () returned 0xd20000 [0107.022] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.022] GetProcessHeap () returned 0xd20000 [0107.022] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0107.022] GetProcessHeap () returned 0xd20000 [0107.022] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0107.022] GetProcessHeap () returned 0xd20000 [0107.022] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.022] GetProcessHeap () returned 0xd20000 [0107.022] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.023] GetProcessHeap () returned 0xd20000 [0107.023] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0107.023] GetProcessHeap () returned 0xd20000 [0107.023] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0107.023] GetProcessHeap () returned 0xd20000 [0107.023] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.023] GetProcessHeap () returned 0xd20000 [0107.023] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.023] GetProcessHeap () returned 0xd20000 [0107.023] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0107.023] GetProcessHeap () returned 0xd20000 [0107.023] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0107.023] GetProcessHeap () returned 0xd20000 [0107.023] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.023] GetProcessHeap () returned 0xd20000 [0107.023] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.023] GetProcessHeap () returned 0xd20000 [0107.023] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.023] GetProcessHeap () returned 0xd20000 [0107.023] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.023] GetProcessHeap () returned 0xd20000 [0107.023] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0107.023] GetProcessHeap () returned 0xd20000 [0107.023] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0107.023] GetProcessHeap () returned 0xd20000 [0107.023] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.024] GetProcessHeap () returned 0xd20000 [0107.024] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.024] GetProcessHeap () returned 0xd20000 [0107.024] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.024] GetProcessHeap () returned 0xd20000 [0107.024] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.024] GetProcessHeap () returned 0xd20000 [0107.024] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.024] GetProcessHeap () returned 0xd20000 [0107.024] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.024] GetProcessHeap () returned 0xd20000 [0107.024] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.024] GetProcessHeap () returned 0xd20000 [0107.024] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.024] GetProcessHeap () returned 0xd20000 [0107.024] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.024] GetProcessHeap () returned 0xd20000 [0107.024] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.024] GetProcessHeap () returned 0xd20000 [0107.024] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.024] GetProcessHeap () returned 0xd20000 [0107.024] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.024] GetProcessHeap () returned 0xd20000 [0107.024] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.024] GetProcessHeap () returned 0xd20000 [0107.025] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.025] GetProcessHeap () returned 0xd20000 [0107.025] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.025] GetProcessHeap () returned 0xd20000 [0107.025] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.025] GetProcessHeap () returned 0xd20000 [0107.025] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.025] GetProcessHeap () returned 0xd20000 [0107.025] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.025] GetProcessHeap () returned 0xd20000 [0107.025] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.025] GetProcessHeap () returned 0xd20000 [0107.025] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.025] GetProcessHeap () returned 0xd20000 [0107.025] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.025] GetProcessHeap () returned 0xd20000 [0107.025] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.025] GetProcessHeap () returned 0xd20000 [0107.025] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.025] GetProcessHeap () returned 0xd20000 [0107.025] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.025] GetProcessHeap () returned 0xd20000 [0107.025] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.026] GetProcessHeap () returned 0xd20000 [0107.026] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.026] GetProcessHeap () returned 0xd20000 [0107.026] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.026] GetProcessHeap () returned 0xd20000 [0107.026] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.026] GetProcessHeap () returned 0xd20000 [0107.026] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.026] GetProcessHeap () returned 0xd20000 [0107.026] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.026] GetProcessHeap () returned 0xd20000 [0107.026] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.026] GetProcessHeap () returned 0xd20000 [0107.026] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.026] GetProcessHeap () returned 0xd20000 [0107.026] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0107.026] GetProcessHeap () returned 0xd20000 [0107.026] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0107.026] GetProcessHeap () returned 0xd20000 [0107.026] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.026] GetProcessHeap () returned 0xd20000 [0107.026] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.026] GetProcessHeap () returned 0xd20000 [0107.026] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.026] GetProcessHeap () returned 0xd20000 [0107.027] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.027] GetProcessHeap () returned 0xd20000 [0107.027] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.027] GetProcessHeap () returned 0xd20000 [0107.027] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.027] GetProcessHeap () returned 0xd20000 [0107.027] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.027] GetProcessHeap () returned 0xd20000 [0107.027] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.027] GetProcessHeap () returned 0xd20000 [0107.027] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.027] GetProcessHeap () returned 0xd20000 [0107.027] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.027] GetProcessHeap () returned 0xd20000 [0107.027] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0107.027] GetProcessHeap () returned 0xd20000 [0107.027] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0107.027] GetProcessHeap () returned 0xd20000 [0107.027] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.027] GetProcessHeap () returned 0xd20000 [0107.027] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.027] GetProcessHeap () returned 0xd20000 [0107.027] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.027] GetProcessHeap () returned 0xd20000 [0107.027] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.027] GetProcessHeap () returned 0xd20000 [0107.027] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.027] GetProcessHeap () returned 0xd20000 [0107.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.028] GetProcessHeap () returned 0xd20000 [0107.028] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.028] GetProcessHeap () returned 0xd20000 [0107.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.028] GetProcessHeap () returned 0xd20000 [0107.028] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.028] GetProcessHeap () returned 0xd20000 [0107.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.028] GetProcessHeap () returned 0xd20000 [0107.028] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.028] GetProcessHeap () returned 0xd20000 [0107.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.028] GetProcessHeap () returned 0xd20000 [0107.028] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.028] GetProcessHeap () returned 0xd20000 [0107.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.028] GetProcessHeap () returned 0xd20000 [0107.028] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0107.028] GetProcessHeap () returned 0xd20000 [0107.028] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0107.028] GetProcessHeap () returned 0xd20000 [0107.029] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.029] GetProcessHeap () returned 0xd20000 [0107.029] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.029] GetProcessHeap () returned 0xd20000 [0107.029] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.029] GetProcessHeap () returned 0xd20000 [0107.029] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.029] GetProcessHeap () returned 0xd20000 [0107.029] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.029] GetProcessHeap () returned 0xd20000 [0107.029] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.029] GetProcessHeap () returned 0xd20000 [0107.029] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.029] GetProcessHeap () returned 0xd20000 [0107.029] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.029] GetProcessHeap () returned 0xd20000 [0107.029] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.029] GetProcessHeap () returned 0xd20000 [0107.029] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.029] GetProcessHeap () returned 0xd20000 [0107.029] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.029] GetProcessHeap () returned 0xd20000 [0107.029] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.029] GetProcessHeap () returned 0xd20000 [0107.029] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.029] GetProcessHeap () returned 0xd20000 [0107.030] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.030] GetProcessHeap () returned 0xd20000 [0107.030] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.030] GetProcessHeap () returned 0xd20000 [0107.030] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.030] GetProcessHeap () returned 0xd20000 [0107.030] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.030] GetProcessHeap () returned 0xd20000 [0107.030] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.030] GetProcessHeap () returned 0xd20000 [0107.030] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.030] GetProcessHeap () returned 0xd20000 [0107.030] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.030] GetProcessHeap () returned 0xd20000 [0107.030] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.030] GetProcessHeap () returned 0xd20000 [0107.030] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.030] GetProcessHeap () returned 0xd20000 [0107.030] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.030] GetProcessHeap () returned 0xd20000 [0107.030] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.030] GetProcessHeap () returned 0xd20000 [0107.030] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.030] GetProcessHeap () returned 0xd20000 [0107.030] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.030] GetProcessHeap () returned 0xd20000 [0107.030] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.031] GetProcessHeap () returned 0xd20000 [0107.031] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.031] GetProcessHeap () returned 0xd20000 [0107.031] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.031] GetProcessHeap () returned 0xd20000 [0107.031] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.031] GetProcessHeap () returned 0xd20000 [0107.031] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.031] GetProcessHeap () returned 0xd20000 [0107.031] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.031] GetProcessHeap () returned 0xd20000 [0107.031] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.031] GetProcessHeap () returned 0xd20000 [0107.031] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.031] GetProcessHeap () returned 0xd20000 [0107.031] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0107.031] GetProcessHeap () returned 0xd20000 [0107.031] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0107.031] GetProcessHeap () returned 0xd20000 [0107.031] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0107.031] GetProcessHeap () returned 0xd20000 [0107.031] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0107.031] GetProcessHeap () returned 0xd20000 [0107.031] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44408 | out: hHeap=0xd20000) returned 1 [0107.031] GetProcessHeap () returned 0xd20000 [0107.032] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ad38 | out: hHeap=0xd20000) returned 1 [0107.032] GetProcessHeap () returned 0xd20000 [0107.032] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0107.032] GetProcessHeap () returned 0xd20000 [0107.032] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a948 | out: hHeap=0xd20000) returned 1 [0107.032] GetProcessHeap () returned 0xd20000 [0107.032] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0107.032] GetProcessHeap () returned 0xd20000 [0107.032] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.032] GetProcessHeap () returned 0xd20000 [0107.032] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0107.032] WriteFile (in: hFile=0x230, lpBuffer=0xd4ef58*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ef58*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0107.039] GetProcessHeap () returned 0xd20000 [0107.039] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4ef58, Size=0x30) returned 0xd4ef58 [0107.039] GetProcessHeap () returned 0xd20000 [0107.039] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0107.039] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0107.039] GetProcessHeap () returned 0xd20000 [0107.039] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x280e) returned 0xd4ef90 [0107.040] ReadFile (in: hFile=0x230, lpBuffer=0xd4ef90, nNumberOfBytesToRead=0x280e, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4ef90*, lpNumberOfBytesRead=0x299d7e8*=0x280e, lpOverlapped=0x0) returned 1 [0107.040] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0107.040] WriteFile (in: hFile=0x230, lpBuffer=0xd4ef90*, nNumberOfBytesToWrite=0x280e, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4ef90*, lpNumberOfBytesWritten=0x299d7e4*=0x280e, lpOverlapped=0x0) returned 1 [0107.042] GetProcessHeap () returned 0xd20000 [0107.042] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ef90 | out: hHeap=0xd20000) returned 1 [0107.042] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0107.042] WriteFile (in: hFile=0x230, lpBuffer=0xd4ef58*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ef58*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0107.043] CloseHandle (hObject=0x230) returned 1 [0107.049] GetProcessHeap () returned 0xd20000 [0107.049] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42738 | out: hHeap=0xd20000) returned 1 [0107.049] GetProcessHeap () returned 0xd20000 [0107.049] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bb48 | out: hHeap=0xd20000) returned 1 [0107.049] GetProcessHeap () returned 0xd20000 [0107.049] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0107.049] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\9e23KEsr9szh66CxZiX.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\9e23KEsr9szh66CxZiX.flv") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\9e23KEsr9szh66CxZiX.flv" [0107.049] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\9e23KEsr9szh66CxZiX.flv", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\9e23KEsr9szh66CxZiX.flv.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\9e23KEsr9szh66CxZiX.flv.[ponce.lorena@aol.com]" [0107.049] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\9e23KEsr9szh66CxZiX.flv" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\uobad49auemcjxvufdb\\9e23kesr9szh66cxzix.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\9e23KEsr9szh66CxZiX.flv.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\uobad49auemcjxvufdb\\9e23kesr9szh66cxzix.flv.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0107.050] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\9e23KEsr9szh66CxZiX.flv" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb") returned 1 [0107.050] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\") returned="" [0107.050] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\HOW_RECOVER.html" [0107.050] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\uobad49auemcjxvufdb\\how_recover.html")) returned 0x20 [0107.050] GetProcessHeap () returned 0xd20000 [0107.050] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd366c8 | out: hHeap=0xd20000) returned 1 [0107.050] FindNextFileW (in: hFindFile=0xd48ca0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b29a720, ftCreationTime.dwHighDateTime=0x1d4c83b, ftLastAccessTime.dwLowDateTime=0x89ab28b0, ftLastAccessTime.dwHighDateTime=0x1d4d10e, ftLastWriteTime.dwLowDateTime=0x89ab28b0, ftLastWriteTime.dwHighDateTime=0x1d4d10e, nFileSizeHigh=0x0, nFileSizeLow=0xcfc6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ARJCa5AvhV.avi", cAlternateFileName="ARJCA5~1.AVI")) returned 1 [0107.050] lstrcmpiW (lpString1="ARJCa5AvhV.avi", lpString2=".") returned 1 [0107.050] lstrcmpiW (lpString1="ARJCa5AvhV.avi", lpString2="..") returned 1 [0107.050] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\", lpString2="ARJCa5AvhV.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\ARJCa5AvhV.avi") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\ARJCa5AvhV.avi" [0107.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ARJCa5AvhV.avi", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0107.051] GetProcessHeap () returned 0xd20000 [0107.051] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd445d0 [0107.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ARJCa5AvhV.avi", cchWideChar=-1, lpMultiByteStr=0xd445d0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ARJCa5AvhV.avi", lpUsedDefaultChar=0x0) returned 15 [0107.051] lstrlenA (lpString="ARJCa5AvhV.avi") returned 14 [0107.051] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0107.051] lstrlenA (lpString="ARJCa5AvhV.avi") returned 14 [0107.051] lstrlenA (lpString=".dll") returned 4 [0107.051] lstrlenA (lpString=".dll") returned 4 [0107.051] lstrlenA (lpString="ARJCa5AvhV.avi") returned 14 [0107.051] lstrcmpiA (lpString1=".avi", lpString2=".dll") returned -1 [0107.051] lstrlenA (lpString="ARJCa5AvhV.avi") returned 14 [0107.051] lstrlenA (lpString=".ini") returned 4 [0107.051] lstrlenA (lpString=".ini") returned 4 [0107.051] lstrlenA (lpString="ARJCa5AvhV.avi") returned 14 [0107.051] lstrcmpiA (lpString1=".avi", lpString2=".ini") returned -1 [0107.051] lstrlenA (lpString="ARJCa5AvhV.avi") returned 14 [0107.051] lstrlenA (lpString=".inc") returned 4 [0107.051] lstrlenA (lpString=".inc") returned 4 [0107.051] lstrlenA (lpString="ARJCa5AvhV.avi") returned 14 [0107.051] lstrcmpiA (lpString1=".avi", lpString2=".inc") returned -1 [0107.051] lstrcmpiW (lpString1="ARJCa5AvhV.avi", lpString2="HOW_RECOVER.html") returned -1 [0107.051] lstrcmpiW (lpString1="ARJCa5AvhV.avi", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0107.052] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0107.052] lstrcmpiW (lpString1="ARJCa5AvhV.avi", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0107.052] GetProcessHeap () returned 0xd20000 [0107.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42490 [0107.052] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\ARJCa5AvhV.avi" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\uobad49auemcjxvufdb\\arjca5avhv.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0107.052] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=53190) returned 1 [0107.052] GetProcessHeap () returned 0xd20000 [0107.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bda0 [0107.052] GetProcessHeap () returned 0xd20000 [0107.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0107.052] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\ARJCa5AvhV.avi") returned 71 [0107.052] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0107.052] GetProcessHeap () returned 0xd20000 [0107.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0107.052] GetProcessHeap () returned 0xd20000 [0107.052] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x38a) returned 0xd4ef90 [0107.053] lstrlenA (lpString="rsa_encrypt") returned 11 [0107.053] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0107.055] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0107.055] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0107.055] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0107.055] GetProcessHeap () returned 0xd20000 [0107.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0107.055] lstrlenA (lpString="010001") returned 6 [0107.055] GetProcessHeap () returned 0xd20000 [0107.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cf18 [0107.055] GetProcessHeap () returned 0xd20000 [0107.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0107.055] GetProcessHeap () returned 0xd20000 [0107.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b098 [0107.055] GetProcessHeap () returned 0xd20000 [0107.055] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0107.055] GetProcessHeap () returned 0xd20000 [0107.055] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b2d8 [0107.055] GetProcessHeap () returned 0xd20000 [0107.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd452f8 [0107.056] GetProcessHeap () returned 0xd20000 [0107.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ce78 [0107.056] GetProcessHeap () returned 0xd20000 [0107.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0107.056] GetProcessHeap () returned 0xd20000 [0107.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.056] GetProcessHeap () returned 0xd20000 [0107.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0107.056] GetProcessHeap () returned 0xd20000 [0107.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0107.056] GetProcessHeap () returned 0xd20000 [0107.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd45640 [0107.056] GetProcessHeap () returned 0xd20000 [0107.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.056] GetProcessHeap () returned 0xd20000 [0107.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44588 [0107.056] GetProcessHeap () returned 0xd20000 [0107.056] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b7e8 [0107.056] GetProcessHeap () returned 0xd20000 [0107.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0107.057] GetProcessHeap () returned 0xd20000 [0107.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0107.057] GetProcessHeap () returned 0xd20000 [0107.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0107.057] GetProcessHeap () returned 0xd20000 [0107.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.057] GetProcessHeap () returned 0xd20000 [0107.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446c0 [0107.057] GetProcessHeap () returned 0xd20000 [0107.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.057] GetProcessHeap () returned 0xd20000 [0107.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.057] GetProcessHeap () returned 0xd20000 [0107.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.057] GetProcessHeap () returned 0xd20000 [0107.057] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.057] GetProcessHeap () returned 0xd20000 [0107.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.058] GetProcessHeap () returned 0xd20000 [0107.058] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.058] GetProcessHeap () returned 0xd20000 [0107.058] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4adc8 [0107.058] GetProcessHeap () returned 0xd20000 [0107.058] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446c0 | out: hHeap=0xd20000) returned 1 [0107.058] GetProcessHeap () returned 0xd20000 [0107.058] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0107.058] GetProcessHeap () returned 0xd20000 [0107.058] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4adc8 | out: hHeap=0xd20000) returned 1 [0107.058] GetProcessHeap () returned 0xd20000 [0107.058] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.058] GetProcessHeap () returned 0xd20000 [0107.058] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.058] GetProcessHeap () returned 0xd20000 [0107.058] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.058] GetProcessHeap () returned 0xd20000 [0107.058] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.058] GetProcessHeap () returned 0xd20000 [0107.058] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.058] GetProcessHeap () returned 0xd20000 [0107.058] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.059] GetProcessHeap () returned 0xd20000 [0107.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.059] GetProcessHeap () returned 0xd20000 [0107.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.059] GetProcessHeap () returned 0xd20000 [0107.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.059] GetProcessHeap () returned 0xd20000 [0107.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.059] GetProcessHeap () returned 0xd20000 [0107.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.059] GetProcessHeap () returned 0xd20000 [0107.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.059] GetProcessHeap () returned 0xd20000 [0107.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.059] GetProcessHeap () returned 0xd20000 [0107.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.059] GetProcessHeap () returned 0xd20000 [0107.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.059] GetProcessHeap () returned 0xd20000 [0107.059] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.059] GetProcessHeap () returned 0xd20000 [0107.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.060] GetProcessHeap () returned 0xd20000 [0107.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.060] GetProcessHeap () returned 0xd20000 [0107.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.060] GetProcessHeap () returned 0xd20000 [0107.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.060] GetProcessHeap () returned 0xd20000 [0107.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.060] GetProcessHeap () returned 0xd20000 [0107.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.060] GetProcessHeap () returned 0xd20000 [0107.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0107.060] GetProcessHeap () returned 0xd20000 [0107.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0107.060] GetProcessHeap () returned 0xd20000 [0107.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.060] GetProcessHeap () returned 0xd20000 [0107.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.060] GetProcessHeap () returned 0xd20000 [0107.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.060] GetProcessHeap () returned 0xd20000 [0107.060] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.060] GetProcessHeap () returned 0xd20000 [0107.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0107.061] GetProcessHeap () returned 0xd20000 [0107.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0107.061] GetProcessHeap () returned 0xd20000 [0107.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.061] GetProcessHeap () returned 0xd20000 [0107.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.061] GetProcessHeap () returned 0xd20000 [0107.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.061] GetProcessHeap () returned 0xd20000 [0107.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.061] GetProcessHeap () returned 0xd20000 [0107.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.061] GetProcessHeap () returned 0xd20000 [0107.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.061] GetProcessHeap () returned 0xd20000 [0107.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.061] GetProcessHeap () returned 0xd20000 [0107.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.061] GetProcessHeap () returned 0xd20000 [0107.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.061] GetProcessHeap () returned 0xd20000 [0107.061] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.061] GetProcessHeap () returned 0xd20000 [0107.061] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.062] GetProcessHeap () returned 0xd20000 [0107.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.062] GetProcessHeap () returned 0xd20000 [0107.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.062] GetProcessHeap () returned 0xd20000 [0107.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.062] GetProcessHeap () returned 0xd20000 [0107.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.062] GetProcessHeap () returned 0xd20000 [0107.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.062] GetProcessHeap () returned 0xd20000 [0107.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.062] GetProcessHeap () returned 0xd20000 [0107.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.062] GetProcessHeap () returned 0xd20000 [0107.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.062] GetProcessHeap () returned 0xd20000 [0107.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.062] GetProcessHeap () returned 0xd20000 [0107.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.062] GetProcessHeap () returned 0xd20000 [0107.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.062] GetProcessHeap () returned 0xd20000 [0107.062] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.062] GetProcessHeap () returned 0xd20000 [0107.062] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.063] GetProcessHeap () returned 0xd20000 [0107.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.063] GetProcessHeap () returned 0xd20000 [0107.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.063] GetProcessHeap () returned 0xd20000 [0107.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.063] GetProcessHeap () returned 0xd20000 [0107.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.063] GetProcessHeap () returned 0xd20000 [0107.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.063] GetProcessHeap () returned 0xd20000 [0107.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.063] GetProcessHeap () returned 0xd20000 [0107.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.063] GetProcessHeap () returned 0xd20000 [0107.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.063] GetProcessHeap () returned 0xd20000 [0107.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.063] GetProcessHeap () returned 0xd20000 [0107.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.064] GetProcessHeap () returned 0xd20000 [0107.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.064] GetProcessHeap () returned 0xd20000 [0107.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.064] GetProcessHeap () returned 0xd20000 [0107.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.064] GetProcessHeap () returned 0xd20000 [0107.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.064] GetProcessHeap () returned 0xd20000 [0107.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.078] GetProcessHeap () returned 0xd20000 [0107.078] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.078] GetProcessHeap () returned 0xd20000 [0107.078] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.078] GetProcessHeap () returned 0xd20000 [0107.078] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.078] GetProcessHeap () returned 0xd20000 [0107.078] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.078] GetProcessHeap () returned 0xd20000 [0107.078] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.078] GetProcessHeap () returned 0xd20000 [0107.078] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.078] GetProcessHeap () returned 0xd20000 [0107.078] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.078] GetProcessHeap () returned 0xd20000 [0107.078] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.078] GetProcessHeap () returned 0xd20000 [0107.078] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.078] GetProcessHeap () returned 0xd20000 [0107.078] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.079] GetProcessHeap () returned 0xd20000 [0107.079] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.079] GetProcessHeap () returned 0xd20000 [0107.079] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.079] GetProcessHeap () returned 0xd20000 [0107.079] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.079] GetProcessHeap () returned 0xd20000 [0107.079] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.079] GetProcessHeap () returned 0xd20000 [0107.079] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.079] GetProcessHeap () returned 0xd20000 [0107.079] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.079] GetProcessHeap () returned 0xd20000 [0107.079] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.079] GetProcessHeap () returned 0xd20000 [0107.079] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.079] GetProcessHeap () returned 0xd20000 [0107.079] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.079] GetProcessHeap () returned 0xd20000 [0107.079] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.080] GetProcessHeap () returned 0xd20000 [0107.080] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.080] GetProcessHeap () returned 0xd20000 [0107.080] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.080] GetProcessHeap () returned 0xd20000 [0107.080] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.080] GetProcessHeap () returned 0xd20000 [0107.080] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.080] GetProcessHeap () returned 0xd20000 [0107.080] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.080] GetProcessHeap () returned 0xd20000 [0107.080] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.080] GetProcessHeap () returned 0xd20000 [0107.080] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.080] GetProcessHeap () returned 0xd20000 [0107.080] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.080] GetProcessHeap () returned 0xd20000 [0107.080] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.080] GetProcessHeap () returned 0xd20000 [0107.080] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.081] GetProcessHeap () returned 0xd20000 [0107.081] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.081] GetProcessHeap () returned 0xd20000 [0107.081] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.081] GetProcessHeap () returned 0xd20000 [0107.081] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.081] GetProcessHeap () returned 0xd20000 [0107.081] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.081] GetProcessHeap () returned 0xd20000 [0107.081] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.081] GetProcessHeap () returned 0xd20000 [0107.081] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.081] GetProcessHeap () returned 0xd20000 [0107.081] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.081] GetProcessHeap () returned 0xd20000 [0107.081] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.081] GetProcessHeap () returned 0xd20000 [0107.081] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.081] GetProcessHeap () returned 0xd20000 [0107.081] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.082] GetProcessHeap () returned 0xd20000 [0107.082] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.082] GetProcessHeap () returned 0xd20000 [0107.082] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.082] GetProcessHeap () returned 0xd20000 [0107.082] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.082] GetProcessHeap () returned 0xd20000 [0107.082] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.082] GetProcessHeap () returned 0xd20000 [0107.082] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.082] GetProcessHeap () returned 0xd20000 [0107.082] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.082] GetProcessHeap () returned 0xd20000 [0107.082] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.082] GetProcessHeap () returned 0xd20000 [0107.082] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.082] GetProcessHeap () returned 0xd20000 [0107.082] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.082] GetProcessHeap () returned 0xd20000 [0107.082] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.082] GetProcessHeap () returned 0xd20000 [0107.082] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.083] GetProcessHeap () returned 0xd20000 [0107.083] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.083] GetProcessHeap () returned 0xd20000 [0107.083] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.083] GetProcessHeap () returned 0xd20000 [0107.083] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.083] GetProcessHeap () returned 0xd20000 [0107.083] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.083] GetProcessHeap () returned 0xd20000 [0107.083] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.083] GetProcessHeap () returned 0xd20000 [0107.083] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.083] GetProcessHeap () returned 0xd20000 [0107.083] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.083] GetProcessHeap () returned 0xd20000 [0107.083] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.083] GetProcessHeap () returned 0xd20000 [0107.083] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.083] GetProcessHeap () returned 0xd20000 [0107.083] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.083] GetProcessHeap () returned 0xd20000 [0107.083] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0107.084] GetProcessHeap () returned 0xd20000 [0107.084] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0107.084] GetProcessHeap () returned 0xd20000 [0107.084] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.084] GetProcessHeap () returned 0xd20000 [0107.084] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.084] GetProcessHeap () returned 0xd20000 [0107.084] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.084] GetProcessHeap () returned 0xd20000 [0107.084] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.084] GetProcessHeap () returned 0xd20000 [0107.084] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.084] GetProcessHeap () returned 0xd20000 [0107.084] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.084] GetProcessHeap () returned 0xd20000 [0107.084] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.084] GetProcessHeap () returned 0xd20000 [0107.084] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.084] GetProcessHeap () returned 0xd20000 [0107.084] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.084] GetProcessHeap () returned 0xd20000 [0107.084] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.085] GetProcessHeap () returned 0xd20000 [0107.085] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.085] GetProcessHeap () returned 0xd20000 [0107.085] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.085] GetProcessHeap () returned 0xd20000 [0107.085] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.085] GetProcessHeap () returned 0xd20000 [0107.085] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.085] GetProcessHeap () returned 0xd20000 [0107.085] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.085] GetProcessHeap () returned 0xd20000 [0107.085] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.085] GetProcessHeap () returned 0xd20000 [0107.085] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.085] GetProcessHeap () returned 0xd20000 [0107.085] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.085] GetProcessHeap () returned 0xd20000 [0107.085] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.085] GetProcessHeap () returned 0xd20000 [0107.085] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.086] GetProcessHeap () returned 0xd20000 [0107.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.086] GetProcessHeap () returned 0xd20000 [0107.086] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.086] GetProcessHeap () returned 0xd20000 [0107.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.086] GetProcessHeap () returned 0xd20000 [0107.086] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.086] GetProcessHeap () returned 0xd20000 [0107.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.086] GetProcessHeap () returned 0xd20000 [0107.086] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.086] GetProcessHeap () returned 0xd20000 [0107.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.086] GetProcessHeap () returned 0xd20000 [0107.086] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.086] GetProcessHeap () returned 0xd20000 [0107.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.086] GetProcessHeap () returned 0xd20000 [0107.086] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.086] GetProcessHeap () returned 0xd20000 [0107.086] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.087] GetProcessHeap () returned 0xd20000 [0107.087] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.087] GetProcessHeap () returned 0xd20000 [0107.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.087] GetProcessHeap () returned 0xd20000 [0107.087] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.087] GetProcessHeap () returned 0xd20000 [0107.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.087] GetProcessHeap () returned 0xd20000 [0107.087] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.087] GetProcessHeap () returned 0xd20000 [0107.087] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.087] GetProcessHeap () returned 0xd20000 [0107.087] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.087] GetProcessHeap () returned 0xd20000 [0107.087] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0107.087] GetProcessHeap () returned 0xd20000 [0107.087] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0107.087] GetProcessHeap () returned 0xd20000 [0107.087] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0107.087] GetProcessHeap () returned 0xd20000 [0107.087] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0107.088] GetProcessHeap () returned 0xd20000 [0107.088] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44588 | out: hHeap=0xd20000) returned 1 [0107.103] GetProcessHeap () returned 0xd20000 [0107.103] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b2d8 | out: hHeap=0xd20000) returned 1 [0107.103] GetProcessHeap () returned 0xd20000 [0107.103] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0107.103] GetProcessHeap () returned 0xd20000 [0107.103] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b098 | out: hHeap=0xd20000) returned 1 [0107.103] GetProcessHeap () returned 0xd20000 [0107.103] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0107.103] GetProcessHeap () returned 0xd20000 [0107.103] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.103] GetProcessHeap () returned 0xd20000 [0107.103] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0107.103] WriteFile (in: hFile=0x230, lpBuffer=0xd4ef90*, nNumberOfBytesToWrite=0x38a, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ef90*, lpNumberOfBytesWritten=0x299d864*=0x38a, lpOverlapped=0x0) returned 1 [0107.106] GetProcessHeap () returned 0xd20000 [0107.106] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4ef90, Size=0x30) returned 0xd4ef90 [0107.106] GetProcessHeap () returned 0xd20000 [0107.106] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0107.106] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0107.106] GetProcessHeap () returned 0xd20000 [0107.106] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xcfd0) returned 0xd4efc8 [0107.107] ReadFile (in: hFile=0x230, lpBuffer=0xd4efc8, nNumberOfBytesToRead=0xcfd0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4efc8*, lpNumberOfBytesRead=0x299d7e8*=0xcfd0, lpOverlapped=0x0) returned 1 [0107.108] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0107.108] WriteFile (in: hFile=0x230, lpBuffer=0xd4efc8*, nNumberOfBytesToWrite=0xcfd0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4efc8*, lpNumberOfBytesWritten=0x299d7e4*=0xcfd0, lpOverlapped=0x0) returned 1 [0107.109] GetProcessHeap () returned 0xd20000 [0107.109] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4efc8 | out: hHeap=0xd20000) returned 1 [0107.109] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0107.109] WriteFile (in: hFile=0x230, lpBuffer=0xd4ef90*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4ef90*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0107.110] CloseHandle (hObject=0x230) returned 1 [0107.118] GetProcessHeap () returned 0xd20000 [0107.119] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42490 | out: hHeap=0xd20000) returned 1 [0107.119] GetProcessHeap () returned 0xd20000 [0107.119] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bda0 | out: hHeap=0xd20000) returned 1 [0107.119] GetProcessHeap () returned 0xd20000 [0107.119] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0107.119] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\ARJCa5AvhV.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\ARJCa5AvhV.avi") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\ARJCa5AvhV.avi" [0107.119] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\ARJCa5AvhV.avi", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\ARJCa5AvhV.avi.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\ARJCa5AvhV.avi.[ponce.lorena@aol.com]" [0107.119] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\ARJCa5AvhV.avi" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\uobad49auemcjxvufdb\\arjca5avhv.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\ARJCa5AvhV.avi.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\uobad49auemcjxvufdb\\arjca5avhv.avi.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0107.120] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\ARJCa5AvhV.avi" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb") returned 1 [0107.120] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\") returned="" [0107.120] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\HOW_RECOVER.html" [0107.120] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\uobad49auemcjxvufdb\\how_recover.html")) returned 0x20 [0107.120] GetProcessHeap () returned 0xd20000 [0107.120] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445d0 | out: hHeap=0xd20000) returned 1 [0107.120] FindNextFileW (in: hFindFile=0xd48ca0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x996d0a00, ftCreationTime.dwHighDateTime=0x1d4caad, ftLastAccessTime.dwLowDateTime=0xc16030d0, ftLastAccessTime.dwHighDateTime=0x1d4cbdb, ftLastWriteTime.dwLowDateTime=0xc16030d0, ftLastWriteTime.dwHighDateTime=0x1d4cbdb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Enj84Qz4GK6xOoZ", cAlternateFileName="ENJ84Q~1")) returned 1 [0107.120] lstrcmpiW (lpString1="Enj84Qz4GK6xOoZ", lpString2=".") returned 1 [0107.121] lstrcmpiW (lpString1="Enj84Qz4GK6xOoZ", lpString2="..") returned 1 [0107.121] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\", lpString2="Enj84Qz4GK6xOoZ" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ" [0107.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Enj84Qz4GK6xOoZ", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0107.121] GetProcessHeap () returned 0xd20000 [0107.121] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd44498 [0107.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Enj84Qz4GK6xOoZ", cchWideChar=-1, lpMultiByteStr=0xd44498, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Enj84Qz4GK6xOoZ", lpUsedDefaultChar=0x0) returned 16 [0107.121] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0107.121] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0107.121] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0107.121] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0107.121] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0107.121] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0107.121] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 3 [0107.121] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0107.121] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0107.121] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0107.121] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0107.121] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0107.121] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0107.121] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0107.121] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0107.121] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0107.121] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0107.121] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0107.121] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0107.122] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0107.122] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0107.122] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0107.122] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0107.122] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0107.122] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0107.122] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0107.122] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0107.122] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 3 [0107.122] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0107.122] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0107.122] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0107.122] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0107.122] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0107.122] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 3 [0107.122] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0107.122] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0107.122] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 3 [0107.122] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0107.122] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0107.122] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0107.122] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0107.122] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0107.122] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Enj84Qz4GK6xOoZ", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0107.123] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\" [0107.123] GetProcessHeap () returned 0xd20000 [0107.123] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cf18 [0107.123] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\") returned 73 [0107.123] GetProcessHeap () returned 0xd20000 [0107.123] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x94) returned 0xd2f820 [0107.123] lstrcpyW (in: lpString1=0xd2f820, lpString2="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\" [0107.123] GetProcessHeap () returned 0xd20000 [0107.123] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44498 | out: hHeap=0xd20000) returned 1 [0107.123] FindNextFileW (in: hFindFile=0xd48ca0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239a070, ftCreationTime.dwHighDateTime=0x1d4c810, ftLastAccessTime.dwLowDateTime=0x42406e90, ftLastAccessTime.dwHighDateTime=0x1d4cf4c, ftLastWriteTime.dwLowDateTime=0x42406e90, ftLastWriteTime.dwHighDateTime=0x1d4cf4c, nFileSizeHigh=0x0, nFileSizeLow=0x441, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="guPzm0OzOJ_1T5U.mp4", cAlternateFileName="GUPZM0~1.MP4")) returned 1 [0107.123] lstrcmpiW (lpString1="guPzm0OzOJ_1T5U.mp4", lpString2=".") returned 1 [0107.123] lstrcmpiW (lpString1="guPzm0OzOJ_1T5U.mp4", lpString2="..") returned 1 [0107.123] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\", lpString2="guPzm0OzOJ_1T5U.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\guPzm0OzOJ_1T5U.mp4") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\guPzm0OzOJ_1T5U.mp4" [0107.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="guPzm0OzOJ_1T5U.mp4", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0107.123] GetProcessHeap () returned 0xd20000 [0107.123] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x14) returned 0xd36568 [0107.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="guPzm0OzOJ_1T5U.mp4", cchWideChar=-1, lpMultiByteStr=0xd36568, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="guPzm0OzOJ_1T5U.mp4", lpUsedDefaultChar=0x0) returned 20 [0107.123] lstrlenA (lpString="guPzm0OzOJ_1T5U.mp4") returned 19 [0107.123] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0107.123] lstrlenA (lpString="guPzm0OzOJ_1T5U.mp4") returned 19 [0107.123] lstrlenA (lpString=".dll") returned 4 [0107.123] lstrlenA (lpString=".dll") returned 4 [0107.123] lstrlenA (lpString="guPzm0OzOJ_1T5U.mp4") returned 19 [0107.123] lstrcmpiA (lpString1=".mp4", lpString2=".dll") returned 1 [0107.123] lstrlenA (lpString="guPzm0OzOJ_1T5U.mp4") returned 19 [0107.123] lstrlenA (lpString=".ini") returned 4 [0107.124] lstrlenA (lpString=".ini") returned 4 [0107.124] lstrlenA (lpString="guPzm0OzOJ_1T5U.mp4") returned 19 [0107.124] lstrcmpiA (lpString1=".mp4", lpString2=".ini") returned 1 [0107.124] lstrlenA (lpString="guPzm0OzOJ_1T5U.mp4") returned 19 [0107.124] lstrlenA (lpString=".inc") returned 4 [0107.124] lstrlenA (lpString=".inc") returned 4 [0107.124] lstrlenA (lpString="guPzm0OzOJ_1T5U.mp4") returned 19 [0107.124] lstrcmpiA (lpString1=".mp4", lpString2=".inc") returned 1 [0107.124] lstrcmpiW (lpString1="guPzm0OzOJ_1T5U.mp4", lpString2="HOW_RECOVER.html") returned -1 [0107.124] lstrcmpiW (lpString1="guPzm0OzOJ_1T5U.mp4", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0107.124] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0107.124] lstrcmpiW (lpString1="guPzm0OzOJ_1T5U.mp4", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0107.124] GetProcessHeap () returned 0xd20000 [0107.124] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42738 [0107.124] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\guPzm0OzOJ_1T5U.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\uobad49auemcjxvufdb\\gupzm0ozoj_1t5u.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0107.124] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=1089) returned 1 [0107.124] GetProcessHeap () returned 0xd20000 [0107.124] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bf80 [0107.124] GetProcessHeap () returned 0xd20000 [0107.124] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0107.124] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\guPzm0OzOJ_1T5U.mp4") returned 76 [0107.124] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0107.125] GetProcessHeap () returned 0xd20000 [0107.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0107.125] GetProcessHeap () returned 0xd20000 [0107.125] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x38f) returned 0xd4efc8 [0107.125] lstrlenA (lpString="rsa_encrypt") returned 11 [0107.125] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0107.127] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0107.127] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0107.127] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0107.127] GetProcessHeap () returned 0xd20000 [0107.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0107.128] lstrlenA (lpString="010001") returned 6 [0107.128] GetProcessHeap () returned 0xd20000 [0107.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ce88 [0107.128] GetProcessHeap () returned 0xd20000 [0107.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd30f70 [0107.128] GetProcessHeap () returned 0xd20000 [0107.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aa68 [0107.128] GetProcessHeap () returned 0xd20000 [0107.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd30f70 | out: hHeap=0xd20000) returned 1 [0107.128] GetProcessHeap () returned 0xd20000 [0107.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b1b8 [0107.128] GetProcessHeap () returned 0xd20000 [0107.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44e98 [0107.128] GetProcessHeap () returned 0xd20000 [0107.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cec8 [0107.128] GetProcessHeap () returned 0xd20000 [0107.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0107.128] GetProcessHeap () returned 0xd20000 [0107.128] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.128] GetProcessHeap () returned 0xd20000 [0107.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44c68 [0107.128] GetProcessHeap () returned 0xd20000 [0107.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd30f70 [0107.128] GetProcessHeap () returned 0xd20000 [0107.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd45410 [0107.128] GetProcessHeap () returned 0xd20000 [0107.128] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0107.129] GetProcessHeap () returned 0xd20000 [0107.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44468 [0107.129] GetProcessHeap () returned 0xd20000 [0107.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aca8 [0107.129] GetProcessHeap () returned 0xd20000 [0107.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd30f70 | out: hHeap=0xd20000) returned 1 [0107.129] GetProcessHeap () returned 0xd20000 [0107.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0107.129] GetProcessHeap () returned 0xd20000 [0107.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aca8 | out: hHeap=0xd20000) returned 1 [0107.129] GetProcessHeap () returned 0xd20000 [0107.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.129] GetProcessHeap () returned 0xd20000 [0107.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44408 [0107.129] GetProcessHeap () returned 0xd20000 [0107.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0107.129] GetProcessHeap () returned 0xd20000 [0107.129] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.129] GetProcessHeap () returned 0xd20000 [0107.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.130] GetProcessHeap () returned 0xd20000 [0107.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.130] GetProcessHeap () returned 0xd20000 [0107.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0107.130] GetProcessHeap () returned 0xd20000 [0107.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0107.130] GetProcessHeap () returned 0xd20000 [0107.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4adc8 [0107.130] GetProcessHeap () returned 0xd20000 [0107.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44408 | out: hHeap=0xd20000) returned 1 [0107.130] GetProcessHeap () returned 0xd20000 [0107.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0107.130] GetProcessHeap () returned 0xd20000 [0107.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4adc8 | out: hHeap=0xd20000) returned 1 [0107.130] GetProcessHeap () returned 0xd20000 [0107.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.130] GetProcessHeap () returned 0xd20000 [0107.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.130] GetProcessHeap () returned 0xd20000 [0107.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.130] GetProcessHeap () returned 0xd20000 [0107.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.130] GetProcessHeap () returned 0xd20000 [0107.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.130] GetProcessHeap () returned 0xd20000 [0107.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.131] GetProcessHeap () returned 0xd20000 [0107.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.131] GetProcessHeap () returned 0xd20000 [0107.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.131] GetProcessHeap () returned 0xd20000 [0107.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0107.131] GetProcessHeap () returned 0xd20000 [0107.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0107.131] GetProcessHeap () returned 0xd20000 [0107.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.131] GetProcessHeap () returned 0xd20000 [0107.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.131] GetProcessHeap () returned 0xd20000 [0107.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.131] GetProcessHeap () returned 0xd20000 [0107.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.131] GetProcessHeap () returned 0xd20000 [0107.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.131] GetProcessHeap () returned 0xd20000 [0107.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.131] GetProcessHeap () returned 0xd20000 [0107.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.131] GetProcessHeap () returned 0xd20000 [0107.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.132] GetProcessHeap () returned 0xd20000 [0107.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.132] GetProcessHeap () returned 0xd20000 [0107.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.132] GetProcessHeap () returned 0xd20000 [0107.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.132] GetProcessHeap () returned 0xd20000 [0107.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.132] GetProcessHeap () returned 0xd20000 [0107.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.132] GetProcessHeap () returned 0xd20000 [0107.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.132] GetProcessHeap () returned 0xd20000 [0107.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.132] GetProcessHeap () returned 0xd20000 [0107.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.132] GetProcessHeap () returned 0xd20000 [0107.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.132] GetProcessHeap () returned 0xd20000 [0107.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.133] GetProcessHeap () returned 0xd20000 [0107.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.133] GetProcessHeap () returned 0xd20000 [0107.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.133] GetProcessHeap () returned 0xd20000 [0107.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.133] GetProcessHeap () returned 0xd20000 [0107.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.133] GetProcessHeap () returned 0xd20000 [0107.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.133] GetProcessHeap () returned 0xd20000 [0107.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.133] GetProcessHeap () returned 0xd20000 [0107.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.133] GetProcessHeap () returned 0xd20000 [0107.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.133] GetProcessHeap () returned 0xd20000 [0107.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0107.133] GetProcessHeap () returned 0xd20000 [0107.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0107.133] GetProcessHeap () returned 0xd20000 [0107.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.134] GetProcessHeap () returned 0xd20000 [0107.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.134] GetProcessHeap () returned 0xd20000 [0107.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0107.134] GetProcessHeap () returned 0xd20000 [0107.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0107.134] GetProcessHeap () returned 0xd20000 [0107.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.134] GetProcessHeap () returned 0xd20000 [0107.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.134] GetProcessHeap () returned 0xd20000 [0107.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0107.134] GetProcessHeap () returned 0xd20000 [0107.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0107.134] GetProcessHeap () returned 0xd20000 [0107.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.134] GetProcessHeap () returned 0xd20000 [0107.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.134] GetProcessHeap () returned 0xd20000 [0107.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.134] GetProcessHeap () returned 0xd20000 [0107.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.134] GetProcessHeap () returned 0xd20000 [0107.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0107.135] GetProcessHeap () returned 0xd20000 [0107.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0107.135] GetProcessHeap () returned 0xd20000 [0107.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.135] GetProcessHeap () returned 0xd20000 [0107.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.135] GetProcessHeap () returned 0xd20000 [0107.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.135] GetProcessHeap () returned 0xd20000 [0107.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.135] GetProcessHeap () returned 0xd20000 [0107.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.135] GetProcessHeap () returned 0xd20000 [0107.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.135] GetProcessHeap () returned 0xd20000 [0107.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.135] GetProcessHeap () returned 0xd20000 [0107.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.136] GetProcessHeap () returned 0xd20000 [0107.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.136] GetProcessHeap () returned 0xd20000 [0107.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.136] GetProcessHeap () returned 0xd20000 [0107.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.136] GetProcessHeap () returned 0xd20000 [0107.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.136] GetProcessHeap () returned 0xd20000 [0107.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.136] GetProcessHeap () returned 0xd20000 [0107.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.136] GetProcessHeap () returned 0xd20000 [0107.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.136] GetProcessHeap () returned 0xd20000 [0107.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.136] GetProcessHeap () returned 0xd20000 [0107.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.136] GetProcessHeap () returned 0xd20000 [0107.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.136] GetProcessHeap () returned 0xd20000 [0107.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.137] GetProcessHeap () returned 0xd20000 [0107.137] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.137] GetProcessHeap () returned 0xd20000 [0107.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.137] GetProcessHeap () returned 0xd20000 [0107.137] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.137] GetProcessHeap () returned 0xd20000 [0107.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.137] GetProcessHeap () returned 0xd20000 [0107.137] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.137] GetProcessHeap () returned 0xd20000 [0107.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.137] GetProcessHeap () returned 0xd20000 [0107.137] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.137] GetProcessHeap () returned 0xd20000 [0107.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.137] GetProcessHeap () returned 0xd20000 [0107.137] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.137] GetProcessHeap () returned 0xd20000 [0107.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.138] GetProcessHeap () returned 0xd20000 [0107.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.138] GetProcessHeap () returned 0xd20000 [0107.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.138] GetProcessHeap () returned 0xd20000 [0107.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.138] GetProcessHeap () returned 0xd20000 [0107.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0107.138] GetProcessHeap () returned 0xd20000 [0107.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0107.138] GetProcessHeap () returned 0xd20000 [0107.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.138] GetProcessHeap () returned 0xd20000 [0107.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.138] GetProcessHeap () returned 0xd20000 [0107.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.138] GetProcessHeap () returned 0xd20000 [0107.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.138] GetProcessHeap () returned 0xd20000 [0107.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.138] GetProcessHeap () returned 0xd20000 [0107.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.138] GetProcessHeap () returned 0xd20000 [0107.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.139] GetProcessHeap () returned 0xd20000 [0107.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.139] GetProcessHeap () returned 0xd20000 [0107.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.139] GetProcessHeap () returned 0xd20000 [0107.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.139] GetProcessHeap () returned 0xd20000 [0107.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0107.139] GetProcessHeap () returned 0xd20000 [0107.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0107.139] GetProcessHeap () returned 0xd20000 [0107.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.139] GetProcessHeap () returned 0xd20000 [0107.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.139] GetProcessHeap () returned 0xd20000 [0107.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.139] GetProcessHeap () returned 0xd20000 [0107.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.139] GetProcessHeap () returned 0xd20000 [0107.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.139] GetProcessHeap () returned 0xd20000 [0107.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.139] GetProcessHeap () returned 0xd20000 [0107.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.140] GetProcessHeap () returned 0xd20000 [0107.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.140] GetProcessHeap () returned 0xd20000 [0107.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.140] GetProcessHeap () returned 0xd20000 [0107.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.140] GetProcessHeap () returned 0xd20000 [0107.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.140] GetProcessHeap () returned 0xd20000 [0107.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.140] GetProcessHeap () returned 0xd20000 [0107.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.140] GetProcessHeap () returned 0xd20000 [0107.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.140] GetProcessHeap () returned 0xd20000 [0107.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0107.140] GetProcessHeap () returned 0xd20000 [0107.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0107.140] GetProcessHeap () returned 0xd20000 [0107.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.140] GetProcessHeap () returned 0xd20000 [0107.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.140] GetProcessHeap () returned 0xd20000 [0107.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.140] GetProcessHeap () returned 0xd20000 [0107.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.140] GetProcessHeap () returned 0xd20000 [0107.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0107.141] GetProcessHeap () returned 0xd20000 [0107.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0107.141] GetProcessHeap () returned 0xd20000 [0107.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.141] GetProcessHeap () returned 0xd20000 [0107.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.141] GetProcessHeap () returned 0xd20000 [0107.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.141] GetProcessHeap () returned 0xd20000 [0107.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.141] GetProcessHeap () returned 0xd20000 [0107.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.141] GetProcessHeap () returned 0xd20000 [0107.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.141] GetProcessHeap () returned 0xd20000 [0107.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.141] GetProcessHeap () returned 0xd20000 [0107.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.141] GetProcessHeap () returned 0xd20000 [0107.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.141] GetProcessHeap () returned 0xd20000 [0107.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.141] GetProcessHeap () returned 0xd20000 [0107.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.142] GetProcessHeap () returned 0xd20000 [0107.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.142] GetProcessHeap () returned 0xd20000 [0107.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.142] GetProcessHeap () returned 0xd20000 [0107.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.142] GetProcessHeap () returned 0xd20000 [0107.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.142] GetProcessHeap () returned 0xd20000 [0107.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.142] GetProcessHeap () returned 0xd20000 [0107.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.142] GetProcessHeap () returned 0xd20000 [0107.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.142] GetProcessHeap () returned 0xd20000 [0107.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0107.142] GetProcessHeap () returned 0xd20000 [0107.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0107.142] GetProcessHeap () returned 0xd20000 [0107.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.142] GetProcessHeap () returned 0xd20000 [0107.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.142] GetProcessHeap () returned 0xd20000 [0107.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0107.142] GetProcessHeap () returned 0xd20000 [0107.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0107.143] GetProcessHeap () returned 0xd20000 [0107.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.143] GetProcessHeap () returned 0xd20000 [0107.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.143] GetProcessHeap () returned 0xd20000 [0107.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.143] GetProcessHeap () returned 0xd20000 [0107.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.143] GetProcessHeap () returned 0xd20000 [0107.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.143] GetProcessHeap () returned 0xd20000 [0107.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.143] GetProcessHeap () returned 0xd20000 [0107.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.143] GetProcessHeap () returned 0xd20000 [0107.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.143] GetProcessHeap () returned 0xd20000 [0107.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.143] GetProcessHeap () returned 0xd20000 [0107.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.143] GetProcessHeap () returned 0xd20000 [0107.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.144] GetProcessHeap () returned 0xd20000 [0107.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.144] GetProcessHeap () returned 0xd20000 [0107.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.144] GetProcessHeap () returned 0xd20000 [0107.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.144] GetProcessHeap () returned 0xd20000 [0107.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.144] GetProcessHeap () returned 0xd20000 [0107.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.144] GetProcessHeap () returned 0xd20000 [0107.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.144] GetProcessHeap () returned 0xd20000 [0107.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.144] GetProcessHeap () returned 0xd20000 [0107.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0107.144] GetProcessHeap () returned 0xd20000 [0107.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0107.144] GetProcessHeap () returned 0xd20000 [0107.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.144] GetProcessHeap () returned 0xd20000 [0107.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.145] GetProcessHeap () returned 0xd20000 [0107.145] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.145] GetProcessHeap () returned 0xd20000 [0107.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.145] GetProcessHeap () returned 0xd20000 [0107.145] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.145] GetProcessHeap () returned 0xd20000 [0107.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.145] GetProcessHeap () returned 0xd20000 [0107.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0107.145] GetProcessHeap () returned 0xd20000 [0107.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0107.145] GetProcessHeap () returned 0xd20000 [0107.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0107.145] GetProcessHeap () returned 0xd20000 [0107.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0107.145] GetProcessHeap () returned 0xd20000 [0107.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44468 | out: hHeap=0xd20000) returned 1 [0107.145] GetProcessHeap () returned 0xd20000 [0107.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b1b8 | out: hHeap=0xd20000) returned 1 [0107.146] GetProcessHeap () returned 0xd20000 [0107.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0107.146] GetProcessHeap () returned 0xd20000 [0107.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aa68 | out: hHeap=0xd20000) returned 1 [0107.146] GetProcessHeap () returned 0xd20000 [0107.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0107.146] GetProcessHeap () returned 0xd20000 [0107.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.146] GetProcessHeap () returned 0xd20000 [0107.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0107.146] WriteFile (in: hFile=0x230, lpBuffer=0xd4efc8*, nNumberOfBytesToWrite=0x38f, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4efc8*, lpNumberOfBytesWritten=0x299d864*=0x38f, lpOverlapped=0x0) returned 1 [0107.148] GetProcessHeap () returned 0xd20000 [0107.148] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4efc8, Size=0x30) returned 0xd4efc8 [0107.148] GetProcessHeap () returned 0xd20000 [0107.148] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0107.148] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0107.149] GetProcessHeap () returned 0xd20000 [0107.149] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x450) returned 0xd4f000 [0107.149] ReadFile (in: hFile=0x230, lpBuffer=0xd4f000, nNumberOfBytesToRead=0x450, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4f000*, lpNumberOfBytesRead=0x299d7e8*=0x450, lpOverlapped=0x0) returned 1 [0107.149] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0107.149] WriteFile (in: hFile=0x230, lpBuffer=0xd4f000*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4f000*, lpNumberOfBytesWritten=0x299d7e4*=0x450, lpOverlapped=0x0) returned 1 [0107.150] GetProcessHeap () returned 0xd20000 [0107.150] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4f000 | out: hHeap=0xd20000) returned 1 [0107.150] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0107.151] WriteFile (in: hFile=0x230, lpBuffer=0xd4efc8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4efc8*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0107.152] CloseHandle (hObject=0x230) returned 1 [0107.154] GetProcessHeap () returned 0xd20000 [0107.154] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42738 | out: hHeap=0xd20000) returned 1 [0107.154] GetProcessHeap () returned 0xd20000 [0107.154] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bf80 | out: hHeap=0xd20000) returned 1 [0107.154] GetProcessHeap () returned 0xd20000 [0107.154] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0107.155] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\guPzm0OzOJ_1T5U.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\guPzm0OzOJ_1T5U.mp4") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\guPzm0OzOJ_1T5U.mp4" [0107.155] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\guPzm0OzOJ_1T5U.mp4", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\guPzm0OzOJ_1T5U.mp4.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\guPzm0OzOJ_1T5U.mp4.[ponce.lorena@aol.com]" [0107.155] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\guPzm0OzOJ_1T5U.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\uobad49auemcjxvufdb\\gupzm0ozoj_1t5u.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\guPzm0OzOJ_1T5U.mp4.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\uobad49auemcjxvufdb\\gupzm0ozoj_1t5u.mp4.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0107.155] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\guPzm0OzOJ_1T5U.mp4" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb") returned 1 [0107.156] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\") returned="" [0107.156] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\HOW_RECOVER.html" [0107.156] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\uobad49auemcjxvufdb\\how_recover.html")) returned 0x20 [0107.156] GetProcessHeap () returned 0xd20000 [0107.156] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36568 | out: hHeap=0xd20000) returned 1 [0107.156] FindNextFileW (in: hFindFile=0xd48ca0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239a070, ftCreationTime.dwHighDateTime=0x1d4c810, ftLastAccessTime.dwLowDateTime=0x42406e90, ftLastAccessTime.dwHighDateTime=0x1d4cf4c, ftLastWriteTime.dwLowDateTime=0x42406e90, ftLastWriteTime.dwHighDateTime=0x1d4cf4c, nFileSizeHigh=0x0, nFileSizeLow=0x441, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="guPzm0OzOJ_1T5U.mp4", cAlternateFileName="GUPZM0~1.MP4")) returned 0 [0107.156] FindClose (in: hFindFile=0xd48ca0 | out: hFindFile=0xd48ca0) returned 1 [0107.156] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\" [0107.156] GetProcessHeap () returned 0xd20000 [0107.156] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0107.156] GetProcessHeap () returned 0xd20000 [0107.156] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.156] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\") returned 73 [0107.156] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\*") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\*" [0107.156] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x996d0a00, ftCreationTime.dwHighDateTime=0x1d4caad, ftLastAccessTime.dwLowDateTime=0xc16030d0, ftLastAccessTime.dwHighDateTime=0x1d4cbdb, ftLastWriteTime.dwLowDateTime=0xc16030d0, ftLastWriteTime.dwHighDateTime=0x1d4cbdb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd49260 [0107.157] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0107.157] FindNextFileW (in: hFindFile=0xd49260, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x996d0a00, ftCreationTime.dwHighDateTime=0x1d4caad, ftLastAccessTime.dwLowDateTime=0xc16030d0, ftLastAccessTime.dwHighDateTime=0x1d4cbdb, ftLastWriteTime.dwLowDateTime=0xc16030d0, ftLastWriteTime.dwHighDateTime=0x1d4cbdb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.157] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0107.157] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0107.157] FindNextFileW (in: hFindFile=0xd49260, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f2aea80, ftCreationTime.dwHighDateTime=0x1d4d143, ftLastAccessTime.dwLowDateTime=0x91cd3ec0, ftLastAccessTime.dwHighDateTime=0x1d4d02d, ftLastWriteTime.dwLowDateTime=0x91cd3ec0, ftLastWriteTime.dwHighDateTime=0x1d4d02d, nFileSizeHigh=0x0, nFileSizeLow=0x17b20, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7cfDcJ Mh37QOdxjm4n.avi", cAlternateFileName="7CFDCJ~1.AVI")) returned 1 [0107.157] lstrcmpiW (lpString1="7cfDcJ Mh37QOdxjm4n.avi", lpString2=".") returned 1 [0107.157] lstrcmpiW (lpString1="7cfDcJ Mh37QOdxjm4n.avi", lpString2="..") returned 1 [0107.157] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\", lpString2="7cfDcJ Mh37QOdxjm4n.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\7cfDcJ Mh37QOdxjm4n.avi") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\7cfDcJ Mh37QOdxjm4n.avi" [0107.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="7cfDcJ Mh37QOdxjm4n.avi", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0107.157] GetProcessHeap () returned 0xd20000 [0107.157] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x18) returned 0xd36568 [0107.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="7cfDcJ Mh37QOdxjm4n.avi", cchWideChar=-1, lpMultiByteStr=0xd36568, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7cfDcJ Mh37QOdxjm4n.avi", lpUsedDefaultChar=0x0) returned 24 [0107.157] lstrlenA (lpString="7cfDcJ Mh37QOdxjm4n.avi") returned 23 [0107.157] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0107.157] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0107.157] lstrlenA (lpString="7cfDcJ Mh37QOdxjm4n.avi") returned 23 [0107.157] lstrcmpiA (lpString1="7cfDcJ Mh37QOdxjm4n.avi", lpString2=".[ponce.lorena@aol.com]") returned 1 [0107.157] lstrlenA (lpString="7cfDcJ Mh37QOdxjm4n.avi") returned 23 [0107.157] lstrlenA (lpString=".dll") returned 4 [0107.158] lstrlenA (lpString=".dll") returned 4 [0107.158] lstrlenA (lpString="7cfDcJ Mh37QOdxjm4n.avi") returned 23 [0107.158] lstrcmpiA (lpString1=".avi", lpString2=".dll") returned -1 [0107.158] lstrlenA (lpString="7cfDcJ Mh37QOdxjm4n.avi") returned 23 [0107.158] lstrlenA (lpString=".ini") returned 4 [0107.158] lstrlenA (lpString=".ini") returned 4 [0107.158] lstrlenA (lpString="7cfDcJ Mh37QOdxjm4n.avi") returned 23 [0107.158] lstrcmpiA (lpString1=".avi", lpString2=".ini") returned -1 [0107.158] lstrlenA (lpString="7cfDcJ Mh37QOdxjm4n.avi") returned 23 [0107.158] lstrlenA (lpString=".inc") returned 4 [0107.158] lstrlenA (lpString=".inc") returned 4 [0107.158] lstrlenA (lpString="7cfDcJ Mh37QOdxjm4n.avi") returned 23 [0107.158] lstrcmpiA (lpString1=".avi", lpString2=".inc") returned -1 [0107.158] lstrcmpiW (lpString1="7cfDcJ Mh37QOdxjm4n.avi", lpString2="HOW_RECOVER.html") returned -1 [0107.158] lstrcmpiW (lpString1="7cfDcJ Mh37QOdxjm4n.avi", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0107.158] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0107.158] lstrcmpiW (lpString1="7cfDcJ Mh37QOdxjm4n.avi", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0107.158] GetProcessHeap () returned 0xd20000 [0107.158] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42828 [0107.158] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\7cfDcJ Mh37QOdxjm4n.avi" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\uobad49auemcjxvufdb\\enj84qz4gk6xooz\\7cfdcj mh37qodxjm4n.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0107.159] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=97056) returned 1 [0107.159] GetProcessHeap () returned 0xd20000 [0107.159] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c250 [0107.159] GetProcessHeap () returned 0xd20000 [0107.159] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0107.159] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\7cfDcJ Mh37QOdxjm4n.avi") returned 96 [0107.159] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0107.159] GetProcessHeap () returned 0xd20000 [0107.159] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0107.159] GetProcessHeap () returned 0xd20000 [0107.159] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4f000 [0107.159] lstrlenA (lpString="rsa_encrypt") returned 11 [0107.159] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0107.161] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0107.161] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0107.161] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0107.161] GetProcessHeap () returned 0xd20000 [0107.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0107.161] lstrlenA (lpString="010001") returned 6 [0107.161] GetProcessHeap () returned 0xd20000 [0107.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cf68 [0107.161] GetProcessHeap () returned 0xd20000 [0107.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0107.162] GetProcessHeap () returned 0xd20000 [0107.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4adc8 [0107.162] GetProcessHeap () returned 0xd20000 [0107.162] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0107.162] GetProcessHeap () returned 0xd20000 [0107.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aee8 [0107.162] GetProcessHeap () returned 0xd20000 [0107.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45410 [0107.162] GetProcessHeap () returned 0xd20000 [0107.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cec8 [0107.162] GetProcessHeap () returned 0xd20000 [0107.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0107.162] GetProcessHeap () returned 0xd20000 [0107.162] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.162] GetProcessHeap () returned 0xd20000 [0107.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0107.162] GetProcessHeap () returned 0xd20000 [0107.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0107.162] GetProcessHeap () returned 0xd20000 [0107.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44c68 [0107.162] GetProcessHeap () returned 0xd20000 [0107.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.162] GetProcessHeap () returned 0xd20000 [0107.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44510 [0107.162] GetProcessHeap () returned 0xd20000 [0107.163] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b248 [0107.163] GetProcessHeap () returned 0xd20000 [0107.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0107.163] GetProcessHeap () returned 0xd20000 [0107.163] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0107.163] GetProcessHeap () returned 0xd20000 [0107.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b248 | out: hHeap=0xd20000) returned 1 [0107.163] GetProcessHeap () returned 0xd20000 [0107.163] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.163] GetProcessHeap () returned 0xd20000 [0107.163] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44540 [0107.163] GetProcessHeap () returned 0xd20000 [0107.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.163] GetProcessHeap () returned 0xd20000 [0107.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.163] GetProcessHeap () returned 0xd20000 [0107.163] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0107.163] GetProcessHeap () returned 0xd20000 [0107.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0107.163] GetProcessHeap () returned 0xd20000 [0107.163] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.163] GetProcessHeap () returned 0xd20000 [0107.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.164] GetProcessHeap () returned 0xd20000 [0107.164] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b638 [0107.164] GetProcessHeap () returned 0xd20000 [0107.164] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44540 | out: hHeap=0xd20000) returned 1 [0107.164] GetProcessHeap () returned 0xd20000 [0107.164] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0107.164] GetProcessHeap () returned 0xd20000 [0107.164] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b638 | out: hHeap=0xd20000) returned 1 [0107.164] GetProcessHeap () returned 0xd20000 [0107.164] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.164] GetProcessHeap () returned 0xd20000 [0107.164] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.164] GetProcessHeap () returned 0xd20000 [0107.164] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.164] GetProcessHeap () returned 0xd20000 [0107.164] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.164] GetProcessHeap () returned 0xd20000 [0107.164] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.164] GetProcessHeap () returned 0xd20000 [0107.164] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.164] GetProcessHeap () returned 0xd20000 [0107.164] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.164] GetProcessHeap () returned 0xd20000 [0107.164] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.164] GetProcessHeap () returned 0xd20000 [0107.164] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.164] GetProcessHeap () returned 0xd20000 [0107.164] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.165] GetProcessHeap () returned 0xd20000 [0107.165] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.165] GetProcessHeap () returned 0xd20000 [0107.165] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.165] GetProcessHeap () returned 0xd20000 [0107.165] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.165] GetProcessHeap () returned 0xd20000 [0107.165] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.165] GetProcessHeap () returned 0xd20000 [0107.165] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.165] GetProcessHeap () returned 0xd20000 [0107.165] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.165] GetProcessHeap () returned 0xd20000 [0107.165] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.165] GetProcessHeap () returned 0xd20000 [0107.165] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.165] GetProcessHeap () returned 0xd20000 [0107.165] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.165] GetProcessHeap () returned 0xd20000 [0107.165] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.165] GetProcessHeap () returned 0xd20000 [0107.165] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.165] GetProcessHeap () returned 0xd20000 [0107.165] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.165] GetProcessHeap () returned 0xd20000 [0107.165] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.166] GetProcessHeap () returned 0xd20000 [0107.166] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.166] GetProcessHeap () returned 0xd20000 [0107.166] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.166] GetProcessHeap () returned 0xd20000 [0107.166] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.166] GetProcessHeap () returned 0xd20000 [0107.166] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.166] GetProcessHeap () returned 0xd20000 [0107.166] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.166] GetProcessHeap () returned 0xd20000 [0107.166] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.166] GetProcessHeap () returned 0xd20000 [0107.166] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.166] GetProcessHeap () returned 0xd20000 [0107.166] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.167] GetProcessHeap () returned 0xd20000 [0107.167] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.167] GetProcessHeap () returned 0xd20000 [0107.167] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.167] GetProcessHeap () returned 0xd20000 [0107.167] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.167] GetProcessHeap () returned 0xd20000 [0107.167] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.167] GetProcessHeap () returned 0xd20000 [0107.167] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.167] GetProcessHeap () returned 0xd20000 [0107.167] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.167] GetProcessHeap () returned 0xd20000 [0107.167] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.167] GetProcessHeap () returned 0xd20000 [0107.167] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.167] GetProcessHeap () returned 0xd20000 [0107.167] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.167] GetProcessHeap () returned 0xd20000 [0107.167] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.167] GetProcessHeap () returned 0xd20000 [0107.167] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.167] GetProcessHeap () returned 0xd20000 [0107.167] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.167] GetProcessHeap () returned 0xd20000 [0107.167] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.167] GetProcessHeap () returned 0xd20000 [0107.168] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.168] GetProcessHeap () returned 0xd20000 [0107.168] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.168] GetProcessHeap () returned 0xd20000 [0107.168] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.168] GetProcessHeap () returned 0xd20000 [0107.168] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.168] GetProcessHeap () returned 0xd20000 [0107.168] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.168] GetProcessHeap () returned 0xd20000 [0107.168] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.168] GetProcessHeap () returned 0xd20000 [0107.168] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.168] GetProcessHeap () returned 0xd20000 [0107.168] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.168] GetProcessHeap () returned 0xd20000 [0107.168] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.168] GetProcessHeap () returned 0xd20000 [0107.168] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.168] GetProcessHeap () returned 0xd20000 [0107.168] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.168] GetProcessHeap () returned 0xd20000 [0107.168] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.168] GetProcessHeap () returned 0xd20000 [0107.168] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.168] GetProcessHeap () returned 0xd20000 [0107.168] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.168] GetProcessHeap () returned 0xd20000 [0107.169] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.169] GetProcessHeap () returned 0xd20000 [0107.169] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.169] GetProcessHeap () returned 0xd20000 [0107.169] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.169] GetProcessHeap () returned 0xd20000 [0107.169] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.169] GetProcessHeap () returned 0xd20000 [0107.169] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.169] GetProcessHeap () returned 0xd20000 [0107.169] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.169] GetProcessHeap () returned 0xd20000 [0107.169] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.169] GetProcessHeap () returned 0xd20000 [0107.169] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.169] GetProcessHeap () returned 0xd20000 [0107.169] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.169] GetProcessHeap () returned 0xd20000 [0107.169] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.169] GetProcessHeap () returned 0xd20000 [0107.169] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.169] GetProcessHeap () returned 0xd20000 [0107.169] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.169] GetProcessHeap () returned 0xd20000 [0107.169] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.169] GetProcessHeap () returned 0xd20000 [0107.169] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.169] GetProcessHeap () returned 0xd20000 [0107.170] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.170] GetProcessHeap () returned 0xd20000 [0107.170] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.170] GetProcessHeap () returned 0xd20000 [0107.170] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.170] GetProcessHeap () returned 0xd20000 [0107.170] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.170] GetProcessHeap () returned 0xd20000 [0107.170] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.170] GetProcessHeap () returned 0xd20000 [0107.170] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.170] GetProcessHeap () returned 0xd20000 [0107.170] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.170] GetProcessHeap () returned 0xd20000 [0107.170] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.170] GetProcessHeap () returned 0xd20000 [0107.170] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.170] GetProcessHeap () returned 0xd20000 [0107.170] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.170] GetProcessHeap () returned 0xd20000 [0107.170] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.170] GetProcessHeap () returned 0xd20000 [0107.170] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.170] GetProcessHeap () returned 0xd20000 [0107.170] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.170] GetProcessHeap () returned 0xd20000 [0107.170] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.170] GetProcessHeap () returned 0xd20000 [0107.170] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.171] GetProcessHeap () returned 0xd20000 [0107.171] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.171] GetProcessHeap () returned 0xd20000 [0107.171] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.171] GetProcessHeap () returned 0xd20000 [0107.171] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.171] GetProcessHeap () returned 0xd20000 [0107.171] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.171] GetProcessHeap () returned 0xd20000 [0107.171] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.171] GetProcessHeap () returned 0xd20000 [0107.171] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.171] GetProcessHeap () returned 0xd20000 [0107.171] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.171] GetProcessHeap () returned 0xd20000 [0107.171] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.171] GetProcessHeap () returned 0xd20000 [0107.171] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.171] GetProcessHeap () returned 0xd20000 [0107.171] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.171] GetProcessHeap () returned 0xd20000 [0107.171] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.171] GetProcessHeap () returned 0xd20000 [0107.171] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.171] GetProcessHeap () returned 0xd20000 [0107.171] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.171] GetProcessHeap () returned 0xd20000 [0107.171] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0107.171] GetProcessHeap () returned 0xd20000 [0107.172] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0107.172] GetProcessHeap () returned 0xd20000 [0107.172] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.172] GetProcessHeap () returned 0xd20000 [0107.172] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.172] GetProcessHeap () returned 0xd20000 [0107.172] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.172] GetProcessHeap () returned 0xd20000 [0107.172] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.172] GetProcessHeap () returned 0xd20000 [0107.172] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.172] GetProcessHeap () returned 0xd20000 [0107.172] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.172] GetProcessHeap () returned 0xd20000 [0107.172] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.172] GetProcessHeap () returned 0xd20000 [0107.172] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.172] GetProcessHeap () returned 0xd20000 [0107.172] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.172] GetProcessHeap () returned 0xd20000 [0107.172] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.172] GetProcessHeap () returned 0xd20000 [0107.172] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.172] GetProcessHeap () returned 0xd20000 [0107.172] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.172] GetProcessHeap () returned 0xd20000 [0107.172] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.172] GetProcessHeap () returned 0xd20000 [0107.172] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.172] GetProcessHeap () returned 0xd20000 [0107.173] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.173] GetProcessHeap () returned 0xd20000 [0107.173] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.173] GetProcessHeap () returned 0xd20000 [0107.173] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.173] GetProcessHeap () returned 0xd20000 [0107.173] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.173] GetProcessHeap () returned 0xd20000 [0107.173] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.173] GetProcessHeap () returned 0xd20000 [0107.173] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.173] GetProcessHeap () returned 0xd20000 [0107.173] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.173] GetProcessHeap () returned 0xd20000 [0107.173] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.173] GetProcessHeap () returned 0xd20000 [0107.173] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.173] GetProcessHeap () returned 0xd20000 [0107.173] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.173] GetProcessHeap () returned 0xd20000 [0107.173] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.173] GetProcessHeap () returned 0xd20000 [0107.173] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.173] GetProcessHeap () returned 0xd20000 [0107.173] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.173] GetProcessHeap () returned 0xd20000 [0107.173] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.173] GetProcessHeap () returned 0xd20000 [0107.173] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.174] GetProcessHeap () returned 0xd20000 [0107.174] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.174] GetProcessHeap () returned 0xd20000 [0107.174] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.174] GetProcessHeap () returned 0xd20000 [0107.174] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.174] GetProcessHeap () returned 0xd20000 [0107.174] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.174] GetProcessHeap () returned 0xd20000 [0107.174] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.174] GetProcessHeap () returned 0xd20000 [0107.174] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.174] GetProcessHeap () returned 0xd20000 [0107.174] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.174] GetProcessHeap () returned 0xd20000 [0107.174] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.174] GetProcessHeap () returned 0xd20000 [0107.174] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.174] GetProcessHeap () returned 0xd20000 [0107.174] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.174] GetProcessHeap () returned 0xd20000 [0107.174] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.174] GetProcessHeap () returned 0xd20000 [0107.174] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.174] GetProcessHeap () returned 0xd20000 [0107.174] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.174] GetProcessHeap () returned 0xd20000 [0107.174] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.174] GetProcessHeap () returned 0xd20000 [0107.174] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.175] GetProcessHeap () returned 0xd20000 [0107.175] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.175] GetProcessHeap () returned 0xd20000 [0107.175] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.175] GetProcessHeap () returned 0xd20000 [0107.175] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.175] GetProcessHeap () returned 0xd20000 [0107.175] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.175] GetProcessHeap () returned 0xd20000 [0107.175] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.175] GetProcessHeap () returned 0xd20000 [0107.175] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.175] GetProcessHeap () returned 0xd20000 [0107.175] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.175] GetProcessHeap () returned 0xd20000 [0107.175] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.175] GetProcessHeap () returned 0xd20000 [0107.175] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.175] GetProcessHeap () returned 0xd20000 [0107.175] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.175] GetProcessHeap () returned 0xd20000 [0107.175] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.175] GetProcessHeap () returned 0xd20000 [0107.175] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.175] GetProcessHeap () returned 0xd20000 [0107.175] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.175] GetProcessHeap () returned 0xd20000 [0107.175] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.176] GetProcessHeap () returned 0xd20000 [0107.176] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.176] GetProcessHeap () returned 0xd20000 [0107.176] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.176] GetProcessHeap () returned 0xd20000 [0107.176] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.176] GetProcessHeap () returned 0xd20000 [0107.176] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.176] GetProcessHeap () returned 0xd20000 [0107.176] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.176] GetProcessHeap () returned 0xd20000 [0107.176] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.176] GetProcessHeap () returned 0xd20000 [0107.176] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0107.176] GetProcessHeap () returned 0xd20000 [0107.176] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0107.176] GetProcessHeap () returned 0xd20000 [0107.176] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.176] GetProcessHeap () returned 0xd20000 [0107.176] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.176] GetProcessHeap () returned 0xd20000 [0107.176] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0107.176] GetProcessHeap () returned 0xd20000 [0107.176] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0107.176] GetProcessHeap () returned 0xd20000 [0107.176] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0107.176] GetProcessHeap () returned 0xd20000 [0107.176] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0107.176] GetProcessHeap () returned 0xd20000 [0107.177] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44510 | out: hHeap=0xd20000) returned 1 [0107.177] GetProcessHeap () returned 0xd20000 [0107.177] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aee8 | out: hHeap=0xd20000) returned 1 [0107.177] GetProcessHeap () returned 0xd20000 [0107.177] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0107.177] GetProcessHeap () returned 0xd20000 [0107.177] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4adc8 | out: hHeap=0xd20000) returned 1 [0107.177] GetProcessHeap () returned 0xd20000 [0107.177] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0107.177] GetProcessHeap () returned 0xd20000 [0107.177] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.177] GetProcessHeap () returned 0xd20000 [0107.177] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0107.177] WriteFile (in: hFile=0x230, lpBuffer=0xd4f000*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f000*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0107.240] GetProcessHeap () returned 0xd20000 [0107.240] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4f000, Size=0x30) returned 0xd4f000 [0107.240] GetProcessHeap () returned 0xd20000 [0107.240] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0107.240] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0107.241] GetProcessHeap () returned 0xd20000 [0107.241] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x17b20) returned 0xd4f038 [0107.241] ReadFile (in: hFile=0x230, lpBuffer=0xd4f038, nNumberOfBytesToRead=0x17b20, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4f038*, lpNumberOfBytesRead=0x299d7e8*=0x17b20, lpOverlapped=0x0) returned 1 [0107.243] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0107.243] WriteFile (in: hFile=0x230, lpBuffer=0xd4f038*, nNumberOfBytesToWrite=0x17b20, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4f038*, lpNumberOfBytesWritten=0x299d7e4*=0x17b20, lpOverlapped=0x0) returned 1 [0107.253] GetProcessHeap () returned 0xd20000 [0107.253] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4f038 | out: hHeap=0xd20000) returned 1 [0107.253] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0107.253] WriteFile (in: hFile=0x230, lpBuffer=0xd4f000*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f000*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0107.259] CloseHandle (hObject=0x230) returned 1 [0107.272] GetProcessHeap () returned 0xd20000 [0107.272] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42828 | out: hHeap=0xd20000) returned 1 [0107.272] GetProcessHeap () returned 0xd20000 [0107.272] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c250 | out: hHeap=0xd20000) returned 1 [0107.272] GetProcessHeap () returned 0xd20000 [0107.272] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0107.273] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\7cfDcJ Mh37QOdxjm4n.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\7cfDcJ Mh37QOdxjm4n.avi") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\7cfDcJ Mh37QOdxjm4n.avi" [0107.273] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\7cfDcJ Mh37QOdxjm4n.avi", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\7cfDcJ Mh37QOdxjm4n.avi.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\7cfDcJ Mh37QOdxjm4n.avi.[ponce.lorena@aol.com]" [0107.273] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\7cfDcJ Mh37QOdxjm4n.avi" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\uobad49auemcjxvufdb\\enj84qz4gk6xooz\\7cfdcj mh37qodxjm4n.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\7cfDcJ Mh37QOdxjm4n.avi.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\uobad49auemcjxvufdb\\enj84qz4gk6xooz\\7cfdcj mh37qodxjm4n.avi.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0107.274] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\7cfDcJ Mh37QOdxjm4n.avi" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ") returned 1 [0107.274] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\") returned="" [0107.274] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\HOW_RECOVER.html" [0107.274] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\uobad49auemcjxvufdb\\enj84qz4gk6xooz\\how_recover.html")) returned 0xffffffff [0107.274] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\uobad49auemcjxvufdb\\enj84qz4gk6xooz\\how_recover.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0107.278] GetProcessHeap () returned 0xd20000 [0107.278] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c0e8 [0107.278] GetProcessHeap () returned 0xd20000 [0107.278] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0107.298] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.300] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.300] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.300] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.300] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.300] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.300] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.300] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.300] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.301] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.301] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.301] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.301] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.301] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.301] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.301] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.302] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.302] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.302] GetProcessHeap () returned 0xd20000 [0107.302] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c0e8 | out: hHeap=0xd20000) returned 1 [0107.302] GetProcessHeap () returned 0xd20000 [0107.302] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0107.302] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x299d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x299d9d0*=0x300, lpOverlapped=0x0) returned 1 [0107.303] GetProcessHeap () returned 0xd20000 [0107.303] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bc38 [0107.303] GetProcessHeap () returned 0xd20000 [0107.303] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0107.321] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.321] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.321] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.321] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.321] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.321] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.322] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.322] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.322] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.323] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.323] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.323] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.323] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.323] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.323] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.323] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.323] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.324] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.324] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.324] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.324] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.324] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.324] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.324] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.324] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.325] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.325] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.325] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.325] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.325] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.325] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.325] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.325] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.326] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.326] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.326] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.326] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.326] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.326] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.326] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.326] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.327] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.327] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.327] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.327] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.327] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.327] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.327] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.327] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.328] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.328] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.328] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.328] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.328] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.328] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.328] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.328] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.329] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.329] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.329] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.329] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.329] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.329] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.329] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.329] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.330] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.330] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.330] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.330] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.330] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.330] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.330] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.331] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.331] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.331] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.331] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.331] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.331] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.331] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.331] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.332] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.332] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.332] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.332] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.332] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.332] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.332] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.333] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.333] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.333] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.333] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.333] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.333] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.334] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.334] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.334] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.334] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.334] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.334] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.334] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.335] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.335] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.335] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.335] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.335] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.335] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.335] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.336] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.336] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.336] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.336] GetProcessHeap () returned 0xd20000 [0107.336] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bc38 | out: hHeap=0xd20000) returned 1 [0107.336] GetProcessHeap () returned 0xd20000 [0107.336] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0107.336] CloseHandle (hObject=0x230) returned 1 [0107.337] GetProcessHeap () returned 0xd20000 [0107.337] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36568 | out: hHeap=0xd20000) returned 1 [0107.337] FindNextFileW (in: hFindFile=0xd49260, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b45cc0, ftCreationTime.dwHighDateTime=0x1d4cc85, ftLastAccessTime.dwLowDateTime=0x2a213800, ftLastAccessTime.dwHighDateTime=0x1d4cc7f, ftLastWriteTime.dwLowDateTime=0x2a213800, ftLastWriteTime.dwHighDateTime=0x1d4cc7f, nFileSizeHigh=0x0, nFileSizeLow=0x9229, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pN yRZO5ky3.avi", cAlternateFileName="PNYRZO~1.AVI")) returned 1 [0107.337] lstrcmpiW (lpString1="pN yRZO5ky3.avi", lpString2=".") returned 1 [0107.337] lstrcmpiW (lpString1="pN yRZO5ky3.avi", lpString2="..") returned 1 [0107.337] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\", lpString2="pN yRZO5ky3.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\pN yRZO5ky3.avi") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\pN yRZO5ky3.avi" [0107.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pN yRZO5ky3.avi", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0107.337] GetProcessHeap () returned 0xd20000 [0107.337] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd446f0 [0107.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="pN yRZO5ky3.avi", cchWideChar=-1, lpMultiByteStr=0xd446f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pN yRZO5ky3.avi", lpUsedDefaultChar=0x0) returned 16 [0107.337] lstrlenA (lpString="pN yRZO5ky3.avi") returned 15 [0107.337] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0107.337] lstrlenA (lpString="pN yRZO5ky3.avi") returned 15 [0107.337] lstrlenA (lpString=".dll") returned 4 [0107.337] lstrlenA (lpString=".dll") returned 4 [0107.337] lstrlenA (lpString="pN yRZO5ky3.avi") returned 15 [0107.337] lstrcmpiA (lpString1=".avi", lpString2=".dll") returned -1 [0107.337] lstrlenA (lpString="pN yRZO5ky3.avi") returned 15 [0107.337] lstrlenA (lpString=".ini") returned 4 [0107.338] lstrlenA (lpString=".ini") returned 4 [0107.338] lstrlenA (lpString="pN yRZO5ky3.avi") returned 15 [0107.338] lstrcmpiA (lpString1=".avi", lpString2=".ini") returned -1 [0107.338] lstrlenA (lpString="pN yRZO5ky3.avi") returned 15 [0107.338] lstrlenA (lpString=".inc") returned 4 [0107.338] lstrlenA (lpString=".inc") returned 4 [0107.339] lstrlenA (lpString="pN yRZO5ky3.avi") returned 15 [0107.339] lstrcmpiA (lpString1=".avi", lpString2=".inc") returned -1 [0107.339] lstrcmpiW (lpString1="pN yRZO5ky3.avi", lpString2="HOW_RECOVER.html") returned 1 [0107.339] lstrcmpiW (lpString1="pN yRZO5ky3.avi", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0107.339] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0107.339] lstrcmpiW (lpString1="pN yRZO5ky3.avi", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0107.339] GetProcessHeap () returned 0xd20000 [0107.339] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42850 [0107.339] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\pN yRZO5ky3.avi" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\uobad49auemcjxvufdb\\enj84qz4gk6xooz\\pn yrzo5ky3.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0107.339] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=37417) returned 1 [0107.339] GetProcessHeap () returned 0xd20000 [0107.339] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bda0 [0107.339] GetProcessHeap () returned 0xd20000 [0107.339] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0107.340] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\pN yRZO5ky3.avi") returned 88 [0107.340] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0107.340] GetProcessHeap () returned 0xd20000 [0107.340] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0107.340] GetProcessHeap () returned 0xd20000 [0107.340] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x387) returned 0xd4f038 [0107.340] lstrlenA (lpString="rsa_encrypt") returned 11 [0107.340] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0107.342] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0107.342] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0107.342] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0107.342] GetProcessHeap () returned 0xd20000 [0107.342] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0107.342] lstrlenA (lpString="010001") returned 6 [0107.342] GetProcessHeap () returned 0xd20000 [0107.342] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ce58 [0107.342] GetProcessHeap () returned 0xd20000 [0107.342] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0107.342] GetProcessHeap () returned 0xd20000 [0107.343] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ad38 [0107.343] GetProcessHeap () returned 0xd20000 [0107.343] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0107.343] GetProcessHeap () returned 0xd20000 [0107.343] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b5a8 [0107.343] GetProcessHeap () returned 0xd20000 [0107.343] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45640 [0107.343] GetProcessHeap () returned 0xd20000 [0107.343] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cdf8 [0107.343] GetProcessHeap () returned 0xd20000 [0107.343] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0107.343] GetProcessHeap () returned 0xd20000 [0107.343] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.343] GetProcessHeap () returned 0xd20000 [0107.343] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0107.343] GetProcessHeap () returned 0xd20000 [0107.343] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0107.343] GetProcessHeap () returned 0xd20000 [0107.343] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44b50 [0107.343] GetProcessHeap () returned 0xd20000 [0107.343] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.343] GetProcessHeap () returned 0xd20000 [0107.343] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44408 [0107.343] GetProcessHeap () returned 0xd20000 [0107.343] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b7e8 [0107.343] GetProcessHeap () returned 0xd20000 [0107.343] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0107.344] GetProcessHeap () returned 0xd20000 [0107.344] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44c68 [0107.344] GetProcessHeap () returned 0xd20000 [0107.344] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0107.344] GetProcessHeap () returned 0xd20000 [0107.344] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.344] GetProcessHeap () returned 0xd20000 [0107.344] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44648 [0107.344] GetProcessHeap () returned 0xd20000 [0107.344] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.344] GetProcessHeap () returned 0xd20000 [0107.344] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.344] GetProcessHeap () returned 0xd20000 [0107.344] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.344] GetProcessHeap () returned 0xd20000 [0107.344] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.344] GetProcessHeap () returned 0xd20000 [0107.344] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.344] GetProcessHeap () returned 0xd20000 [0107.344] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.344] GetProcessHeap () returned 0xd20000 [0107.344] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b1b8 [0107.344] GetProcessHeap () returned 0xd20000 [0107.344] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44648 | out: hHeap=0xd20000) returned 1 [0107.344] GetProcessHeap () returned 0xd20000 [0107.344] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0107.345] GetProcessHeap () returned 0xd20000 [0107.345] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b1b8 | out: hHeap=0xd20000) returned 1 [0107.345] GetProcessHeap () returned 0xd20000 [0107.345] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.345] GetProcessHeap () returned 0xd20000 [0107.345] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.345] GetProcessHeap () returned 0xd20000 [0107.345] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.345] GetProcessHeap () returned 0xd20000 [0107.345] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.345] GetProcessHeap () returned 0xd20000 [0107.345] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0107.345] GetProcessHeap () returned 0xd20000 [0107.345] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0107.345] GetProcessHeap () returned 0xd20000 [0107.345] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.345] GetProcessHeap () returned 0xd20000 [0107.345] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.345] GetProcessHeap () returned 0xd20000 [0107.345] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0107.345] GetProcessHeap () returned 0xd20000 [0107.345] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0107.345] GetProcessHeap () returned 0xd20000 [0107.345] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.345] GetProcessHeap () returned 0xd20000 [0107.345] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.346] GetProcessHeap () returned 0xd20000 [0107.346] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0107.346] GetProcessHeap () returned 0xd20000 [0107.346] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0107.346] GetProcessHeap () returned 0xd20000 [0107.346] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.346] GetProcessHeap () returned 0xd20000 [0107.346] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.346] GetProcessHeap () returned 0xd20000 [0107.346] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.346] GetProcessHeap () returned 0xd20000 [0107.346] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.346] GetProcessHeap () returned 0xd20000 [0107.346] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0107.346] GetProcessHeap () returned 0xd20000 [0107.346] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0107.346] GetProcessHeap () returned 0xd20000 [0107.346] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.346] GetProcessHeap () returned 0xd20000 [0107.346] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.346] GetProcessHeap () returned 0xd20000 [0107.346] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.346] GetProcessHeap () returned 0xd20000 [0107.346] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.346] GetProcessHeap () returned 0xd20000 [0107.346] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.346] GetProcessHeap () returned 0xd20000 [0107.347] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.347] GetProcessHeap () returned 0xd20000 [0107.347] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.347] GetProcessHeap () returned 0xd20000 [0107.347] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.347] GetProcessHeap () returned 0xd20000 [0107.347] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.347] GetProcessHeap () returned 0xd20000 [0107.347] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.347] GetProcessHeap () returned 0xd20000 [0107.347] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.347] GetProcessHeap () returned 0xd20000 [0107.347] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.347] GetProcessHeap () returned 0xd20000 [0107.347] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.347] GetProcessHeap () returned 0xd20000 [0107.347] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.347] GetProcessHeap () returned 0xd20000 [0107.347] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.347] GetProcessHeap () returned 0xd20000 [0107.347] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.347] GetProcessHeap () returned 0xd20000 [0107.348] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.348] GetProcessHeap () returned 0xd20000 [0107.348] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.348] GetProcessHeap () returned 0xd20000 [0107.348] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.348] GetProcessHeap () returned 0xd20000 [0107.348] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.348] GetProcessHeap () returned 0xd20000 [0107.348] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.348] GetProcessHeap () returned 0xd20000 [0107.348] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.348] GetProcessHeap () returned 0xd20000 [0107.348] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.348] GetProcessHeap () returned 0xd20000 [0107.348] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.348] GetProcessHeap () returned 0xd20000 [0107.348] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.348] GetProcessHeap () returned 0xd20000 [0107.348] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.348] GetProcessHeap () returned 0xd20000 [0107.348] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.348] GetProcessHeap () returned 0xd20000 [0107.348] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.348] GetProcessHeap () returned 0xd20000 [0107.348] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.348] GetProcessHeap () returned 0xd20000 [0107.349] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.349] GetProcessHeap () returned 0xd20000 [0107.349] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.349] GetProcessHeap () returned 0xd20000 [0107.349] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.349] GetProcessHeap () returned 0xd20000 [0107.349] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0107.349] GetProcessHeap () returned 0xd20000 [0107.349] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0107.349] GetProcessHeap () returned 0xd20000 [0107.349] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.349] GetProcessHeap () returned 0xd20000 [0107.349] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.349] GetProcessHeap () returned 0xd20000 [0107.349] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.349] GetProcessHeap () returned 0xd20000 [0107.349] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.349] GetProcessHeap () returned 0xd20000 [0107.349] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.349] GetProcessHeap () returned 0xd20000 [0107.349] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.349] GetProcessHeap () returned 0xd20000 [0107.349] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.349] GetProcessHeap () returned 0xd20000 [0107.349] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.350] GetProcessHeap () returned 0xd20000 [0107.350] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.350] GetProcessHeap () returned 0xd20000 [0107.350] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.350] GetProcessHeap () returned 0xd20000 [0107.350] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0107.350] GetProcessHeap () returned 0xd20000 [0107.350] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0107.350] GetProcessHeap () returned 0xd20000 [0107.350] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.350] GetProcessHeap () returned 0xd20000 [0107.350] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.350] GetProcessHeap () returned 0xd20000 [0107.350] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.350] GetProcessHeap () returned 0xd20000 [0107.350] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.350] GetProcessHeap () returned 0xd20000 [0107.350] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.350] GetProcessHeap () returned 0xd20000 [0107.350] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.350] GetProcessHeap () returned 0xd20000 [0107.350] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.350] GetProcessHeap () returned 0xd20000 [0107.350] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.350] GetProcessHeap () returned 0xd20000 [0107.351] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.351] GetProcessHeap () returned 0xd20000 [0107.351] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.351] GetProcessHeap () returned 0xd20000 [0107.351] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.351] GetProcessHeap () returned 0xd20000 [0107.351] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.351] GetProcessHeap () returned 0xd20000 [0107.351] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.351] GetProcessHeap () returned 0xd20000 [0107.351] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.351] GetProcessHeap () returned 0xd20000 [0107.351] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0107.351] GetProcessHeap () returned 0xd20000 [0107.351] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0107.351] GetProcessHeap () returned 0xd20000 [0107.351] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.351] GetProcessHeap () returned 0xd20000 [0107.351] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.351] GetProcessHeap () returned 0xd20000 [0107.351] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.351] GetProcessHeap () returned 0xd20000 [0107.351] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.351] GetProcessHeap () returned 0xd20000 [0107.351] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.351] GetProcessHeap () returned 0xd20000 [0107.352] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.352] GetProcessHeap () returned 0xd20000 [0107.352] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.352] GetProcessHeap () returned 0xd20000 [0107.352] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.352] GetProcessHeap () returned 0xd20000 [0107.352] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.352] GetProcessHeap () returned 0xd20000 [0107.352] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.352] GetProcessHeap () returned 0xd20000 [0107.352] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.352] GetProcessHeap () returned 0xd20000 [0107.352] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.352] GetProcessHeap () returned 0xd20000 [0107.352] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.352] GetProcessHeap () returned 0xd20000 [0107.352] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.352] GetProcessHeap () returned 0xd20000 [0107.352] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.352] GetProcessHeap () returned 0xd20000 [0107.352] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.352] GetProcessHeap () returned 0xd20000 [0107.352] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.352] GetProcessHeap () returned 0xd20000 [0107.353] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.353] GetProcessHeap () returned 0xd20000 [0107.353] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.353] GetProcessHeap () returned 0xd20000 [0107.353] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.353] GetProcessHeap () returned 0xd20000 [0107.353] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.353] GetProcessHeap () returned 0xd20000 [0107.353] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.353] GetProcessHeap () returned 0xd20000 [0107.353] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.353] GetProcessHeap () returned 0xd20000 [0107.353] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.353] GetProcessHeap () returned 0xd20000 [0107.353] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.353] GetProcessHeap () returned 0xd20000 [0107.353] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.361] GetProcessHeap () returned 0xd20000 [0107.361] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.361] GetProcessHeap () returned 0xd20000 [0107.361] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.361] GetProcessHeap () returned 0xd20000 [0107.361] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.361] GetProcessHeap () returned 0xd20000 [0107.361] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.361] GetProcessHeap () returned 0xd20000 [0107.361] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.361] GetProcessHeap () returned 0xd20000 [0107.361] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.361] GetProcessHeap () returned 0xd20000 [0107.361] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.361] GetProcessHeap () returned 0xd20000 [0107.361] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.361] GetProcessHeap () returned 0xd20000 [0107.361] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.361] GetProcessHeap () returned 0xd20000 [0107.361] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.362] GetProcessHeap () returned 0xd20000 [0107.362] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.362] GetProcessHeap () returned 0xd20000 [0107.362] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.362] GetProcessHeap () returned 0xd20000 [0107.362] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.362] GetProcessHeap () returned 0xd20000 [0107.362] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.362] GetProcessHeap () returned 0xd20000 [0107.362] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.362] GetProcessHeap () returned 0xd20000 [0107.362] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.362] GetProcessHeap () returned 0xd20000 [0107.362] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.362] GetProcessHeap () returned 0xd20000 [0107.362] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.362] GetProcessHeap () returned 0xd20000 [0107.362] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.362] GetProcessHeap () returned 0xd20000 [0107.362] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.362] GetProcessHeap () returned 0xd20000 [0107.362] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.362] GetProcessHeap () returned 0xd20000 [0107.362] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.363] GetProcessHeap () returned 0xd20000 [0107.363] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.363] GetProcessHeap () returned 0xd20000 [0107.363] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.363] GetProcessHeap () returned 0xd20000 [0107.363] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.363] GetProcessHeap () returned 0xd20000 [0107.363] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.363] GetProcessHeap () returned 0xd20000 [0107.363] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.363] GetProcessHeap () returned 0xd20000 [0107.363] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.363] GetProcessHeap () returned 0xd20000 [0107.363] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.363] GetProcessHeap () returned 0xd20000 [0107.363] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.363] GetProcessHeap () returned 0xd20000 [0107.363] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.363] GetProcessHeap () returned 0xd20000 [0107.363] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.363] GetProcessHeap () returned 0xd20000 [0107.363] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.363] GetProcessHeap () returned 0xd20000 [0107.363] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.363] GetProcessHeap () returned 0xd20000 [0107.363] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.363] GetProcessHeap () returned 0xd20000 [0107.363] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.363] GetProcessHeap () returned 0xd20000 [0107.364] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.364] GetProcessHeap () returned 0xd20000 [0107.364] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.364] GetProcessHeap () returned 0xd20000 [0107.364] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0107.364] GetProcessHeap () returned 0xd20000 [0107.364] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0107.364] GetProcessHeap () returned 0xd20000 [0107.364] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.364] GetProcessHeap () returned 0xd20000 [0107.364] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.364] GetProcessHeap () returned 0xd20000 [0107.364] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.364] GetProcessHeap () returned 0xd20000 [0107.364] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.364] GetProcessHeap () returned 0xd20000 [0107.364] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.364] GetProcessHeap () returned 0xd20000 [0107.364] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.364] GetProcessHeap () returned 0xd20000 [0107.364] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.364] GetProcessHeap () returned 0xd20000 [0107.364] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.364] GetProcessHeap () returned 0xd20000 [0107.364] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.364] GetProcessHeap () returned 0xd20000 [0107.364] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.364] GetProcessHeap () returned 0xd20000 [0107.365] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0107.365] GetProcessHeap () returned 0xd20000 [0107.365] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0107.365] GetProcessHeap () returned 0xd20000 [0107.365] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.365] GetProcessHeap () returned 0xd20000 [0107.365] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.365] GetProcessHeap () returned 0xd20000 [0107.365] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0107.365] GetProcessHeap () returned 0xd20000 [0107.365] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0107.365] GetProcessHeap () returned 0xd20000 [0107.365] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.365] GetProcessHeap () returned 0xd20000 [0107.365] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.365] GetProcessHeap () returned 0xd20000 [0107.365] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.365] GetProcessHeap () returned 0xd20000 [0107.365] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.365] GetProcessHeap () returned 0xd20000 [0107.365] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.365] GetProcessHeap () returned 0xd20000 [0107.365] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.365] GetProcessHeap () returned 0xd20000 [0107.365] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0107.365] GetProcessHeap () returned 0xd20000 [0107.365] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0107.366] GetProcessHeap () returned 0xd20000 [0107.366] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0107.366] GetProcessHeap () returned 0xd20000 [0107.366] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0107.366] GetProcessHeap () returned 0xd20000 [0107.366] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44408 | out: hHeap=0xd20000) returned 1 [0107.366] GetProcessHeap () returned 0xd20000 [0107.366] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b5a8 | out: hHeap=0xd20000) returned 1 [0107.366] GetProcessHeap () returned 0xd20000 [0107.366] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0107.366] GetProcessHeap () returned 0xd20000 [0107.366] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ad38 | out: hHeap=0xd20000) returned 1 [0107.366] GetProcessHeap () returned 0xd20000 [0107.366] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0107.366] GetProcessHeap () returned 0xd20000 [0107.366] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.366] GetProcessHeap () returned 0xd20000 [0107.366] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0107.366] WriteFile (in: hFile=0x230, lpBuffer=0xd4f038*, nNumberOfBytesToWrite=0x387, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f038*, lpNumberOfBytesWritten=0x299d864*=0x387, lpOverlapped=0x0) returned 1 [0107.371] GetProcessHeap () returned 0xd20000 [0107.372] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4f038, Size=0x30) returned 0xd4f038 [0107.372] GetProcessHeap () returned 0xd20000 [0107.372] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0107.372] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0107.372] GetProcessHeap () returned 0xd20000 [0107.372] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x9230) returned 0xd4f070 [0107.372] ReadFile (in: hFile=0x230, lpBuffer=0xd4f070, nNumberOfBytesToRead=0x9230, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4f070*, lpNumberOfBytesRead=0x299d7e8*=0x9230, lpOverlapped=0x0) returned 1 [0107.373] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0107.373] WriteFile (in: hFile=0x230, lpBuffer=0xd4f070*, nNumberOfBytesToWrite=0x9230, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4f070*, lpNumberOfBytesWritten=0x299d7e4*=0x9230, lpOverlapped=0x0) returned 1 [0107.375] GetProcessHeap () returned 0xd20000 [0107.375] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4f070 | out: hHeap=0xd20000) returned 1 [0107.375] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0107.375] WriteFile (in: hFile=0x230, lpBuffer=0xd4f038*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f038*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0107.376] CloseHandle (hObject=0x230) returned 1 [0107.385] GetProcessHeap () returned 0xd20000 [0107.385] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42850 | out: hHeap=0xd20000) returned 1 [0107.385] GetProcessHeap () returned 0xd20000 [0107.385] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bda0 | out: hHeap=0xd20000) returned 1 [0107.385] GetProcessHeap () returned 0xd20000 [0107.385] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0107.385] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\pN yRZO5ky3.avi" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\pN yRZO5ky3.avi") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\pN yRZO5ky3.avi" [0107.385] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\pN yRZO5ky3.avi", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\pN yRZO5ky3.avi.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\pN yRZO5ky3.avi.[ponce.lorena@aol.com]" [0107.385] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\pN yRZO5ky3.avi" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\uobad49auemcjxvufdb\\enj84qz4gk6xooz\\pn yrzo5ky3.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\pN yRZO5ky3.avi.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\uobad49auemcjxvufdb\\enj84qz4gk6xooz\\pn yrzo5ky3.avi.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0107.386] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\pN yRZO5ky3.avi" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ") returned 1 [0107.386] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\") returned="" [0107.386] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\HOW_RECOVER.html" [0107.386] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\Uobad49auEmCJXvufDb\\Enj84Qz4GK6xOoZ\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\uobad49auemcjxvufdb\\enj84qz4gk6xooz\\how_recover.html")) returned 0x20 [0107.386] GetProcessHeap () returned 0xd20000 [0107.387] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446f0 | out: hHeap=0xd20000) returned 1 [0107.387] FindNextFileW (in: hFindFile=0xd49260, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b45cc0, ftCreationTime.dwHighDateTime=0x1d4cc85, ftLastAccessTime.dwLowDateTime=0x2a213800, ftLastAccessTime.dwHighDateTime=0x1d4cc7f, ftLastWriteTime.dwLowDateTime=0x2a213800, ftLastWriteTime.dwHighDateTime=0x1d4cc7f, nFileSizeHigh=0x0, nFileSizeLow=0x9229, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pN yRZO5ky3.avi", cAlternateFileName="PNYRZO~1.AVI")) returned 0 [0107.387] FindClose (in: hFindFile=0xd49260 | out: hFindFile=0xd49260) returned 1 [0107.387] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\" [0107.387] GetProcessHeap () returned 0xd20000 [0107.387] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2e898 | out: hHeap=0xd20000) returned 1 [0107.387] GetProcessHeap () returned 0xd20000 [0107.387] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.387] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\") returned 44 [0107.387] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\*") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\*" [0107.387] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85195b50, ftCreationTime.dwHighDateTime=0x1d4d25d, ftLastAccessTime.dwLowDateTime=0x435b3c10, ftLastAccessTime.dwHighDateTime=0x1d4cd99, ftLastWriteTime.dwLowDateTime=0x435b3c10, ftLastWriteTime.dwHighDateTime=0x1d4cd99, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd48ca0 [0107.387] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0107.387] FindNextFileW (in: hFindFile=0xd48ca0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85195b50, ftCreationTime.dwHighDateTime=0x1d4d25d, ftLastAccessTime.dwLowDateTime=0x435b3c10, ftLastAccessTime.dwHighDateTime=0x1d4cd99, ftLastWriteTime.dwLowDateTime=0x435b3c10, ftLastWriteTime.dwHighDateTime=0x1d4cd99, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.387] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0107.387] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0107.387] FindNextFileW (in: hFindFile=0xd48ca0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25559ed0, ftCreationTime.dwHighDateTime=0x1d4cef3, ftLastAccessTime.dwLowDateTime=0xfaedd90, ftLastAccessTime.dwHighDateTime=0x1d4c6dc, ftLastWriteTime.dwLowDateTime=0xfaedd90, ftLastWriteTime.dwHighDateTime=0x1d4c6dc, nFileSizeHigh=0x0, nFileSizeLow=0x110e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8 x_b8TY9uNIlaEJPu.mp4", cAlternateFileName="8X_B8T~1.MP4")) returned 1 [0107.387] lstrcmpiW (lpString1="8 x_b8TY9uNIlaEJPu.mp4", lpString2=".") returned 1 [0107.388] lstrcmpiW (lpString1="8 x_b8TY9uNIlaEJPu.mp4", lpString2="..") returned 1 [0107.388] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\", lpString2="8 x_b8TY9uNIlaEJPu.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\8 x_b8TY9uNIlaEJPu.mp4") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\8 x_b8TY9uNIlaEJPu.mp4" [0107.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="8 x_b8TY9uNIlaEJPu.mp4", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0107.388] GetProcessHeap () returned 0xd20000 [0107.388] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x17) returned 0xd36688 [0107.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="8 x_b8TY9uNIlaEJPu.mp4", cchWideChar=-1, lpMultiByteStr=0xd36688, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8 x_b8TY9uNIlaEJPu.mp4", lpUsedDefaultChar=0x0) returned 23 [0107.388] lstrlenA (lpString="8 x_b8TY9uNIlaEJPu.mp4") returned 22 [0107.388] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0107.388] lstrlenA (lpString="8 x_b8TY9uNIlaEJPu.mp4") returned 22 [0107.388] lstrlenA (lpString=".dll") returned 4 [0107.388] lstrlenA (lpString=".dll") returned 4 [0107.388] lstrlenA (lpString="8 x_b8TY9uNIlaEJPu.mp4") returned 22 [0107.388] lstrcmpiA (lpString1=".mp4", lpString2=".dll") returned 1 [0107.388] lstrlenA (lpString="8 x_b8TY9uNIlaEJPu.mp4") returned 22 [0107.388] lstrlenA (lpString=".ini") returned 4 [0107.388] lstrlenA (lpString=".ini") returned 4 [0107.388] lstrlenA (lpString="8 x_b8TY9uNIlaEJPu.mp4") returned 22 [0107.388] lstrcmpiA (lpString1=".mp4", lpString2=".ini") returned 1 [0107.388] lstrlenA (lpString="8 x_b8TY9uNIlaEJPu.mp4") returned 22 [0107.388] lstrlenA (lpString=".inc") returned 4 [0107.388] lstrlenA (lpString=".inc") returned 4 [0107.388] lstrlenA (lpString="8 x_b8TY9uNIlaEJPu.mp4") returned 22 [0107.388] lstrcmpiA (lpString1=".mp4", lpString2=".inc") returned 1 [0107.388] lstrcmpiW (lpString1="8 x_b8TY9uNIlaEJPu.mp4", lpString2="HOW_RECOVER.html") returned -1 [0107.388] lstrcmpiW (lpString1="8 x_b8TY9uNIlaEJPu.mp4", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0107.389] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0107.389] lstrcmpiW (lpString1="8 x_b8TY9uNIlaEJPu.mp4", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0107.389] GetProcessHeap () returned 0xd20000 [0107.389] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd426c0 [0107.389] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\8 x_b8TY9uNIlaEJPu.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\pp4pa7\\8 x_b8ty9unilaejpu.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0107.389] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=4366) returned 1 [0107.389] GetProcessHeap () returned 0xd20000 [0107.389] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c070 [0107.389] GetProcessHeap () returned 0xd20000 [0107.389] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0107.389] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\8 x_b8TY9uNIlaEJPu.mp4") returned 66 [0107.389] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0107.389] GetProcessHeap () returned 0xd20000 [0107.389] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0107.389] GetProcessHeap () returned 0xd20000 [0107.389] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x382) returned 0xd4f070 [0107.390] lstrlenA (lpString="rsa_encrypt") returned 11 [0107.390] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0107.391] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0107.391] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0107.391] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0107.391] GetProcessHeap () returned 0xd20000 [0107.391] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0107.392] lstrlenA (lpString="010001") returned 6 [0107.392] GetProcessHeap () returned 0xd20000 [0107.392] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ce18 [0107.392] GetProcessHeap () returned 0xd20000 [0107.392] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0107.392] GetProcessHeap () returned 0xd20000 [0107.392] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b638 [0107.392] GetProcessHeap () returned 0xd20000 [0107.392] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0107.392] GetProcessHeap () returned 0xd20000 [0107.392] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4a9d8 [0107.392] GetProcessHeap () returned 0xd20000 [0107.392] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45528 [0107.392] GetProcessHeap () returned 0xd20000 [0107.392] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cf38 [0107.392] GetProcessHeap () returned 0xd20000 [0107.392] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0107.392] GetProcessHeap () returned 0xd20000 [0107.392] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.392] GetProcessHeap () returned 0xd20000 [0107.392] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0107.392] GetProcessHeap () returned 0xd20000 [0107.393] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0107.393] GetProcessHeap () returned 0xd20000 [0107.393] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44e98 [0107.393] GetProcessHeap () returned 0xd20000 [0107.393] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.393] GetProcessHeap () returned 0xd20000 [0107.393] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44480 [0107.393] GetProcessHeap () returned 0xd20000 [0107.393] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4a948 [0107.393] GetProcessHeap () returned 0xd20000 [0107.393] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0107.393] GetProcessHeap () returned 0xd20000 [0107.393] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0107.393] GetProcessHeap () returned 0xd20000 [0107.393] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a948 | out: hHeap=0xd20000) returned 1 [0107.393] GetProcessHeap () returned 0xd20000 [0107.393] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.393] GetProcessHeap () returned 0xd20000 [0107.393] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444c8 [0107.393] GetProcessHeap () returned 0xd20000 [0107.393] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.393] GetProcessHeap () returned 0xd20000 [0107.393] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.393] GetProcessHeap () returned 0xd20000 [0107.393] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.394] GetProcessHeap () returned 0xd20000 [0107.394] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.394] GetProcessHeap () returned 0xd20000 [0107.394] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.394] GetProcessHeap () returned 0xd20000 [0107.394] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.394] GetProcessHeap () returned 0xd20000 [0107.394] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4adc8 [0107.394] GetProcessHeap () returned 0xd20000 [0107.394] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444c8 | out: hHeap=0xd20000) returned 1 [0107.394] GetProcessHeap () returned 0xd20000 [0107.394] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0107.394] GetProcessHeap () returned 0xd20000 [0107.394] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4adc8 | out: hHeap=0xd20000) returned 1 [0107.394] GetProcessHeap () returned 0xd20000 [0107.394] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.394] GetProcessHeap () returned 0xd20000 [0107.394] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.394] GetProcessHeap () returned 0xd20000 [0107.394] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.394] GetProcessHeap () returned 0xd20000 [0107.395] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.395] GetProcessHeap () returned 0xd20000 [0107.395] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.395] GetProcessHeap () returned 0xd20000 [0107.395] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.395] GetProcessHeap () returned 0xd20000 [0107.395] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.395] GetProcessHeap () returned 0xd20000 [0107.395] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.395] GetProcessHeap () returned 0xd20000 [0107.395] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.395] GetProcessHeap () returned 0xd20000 [0107.395] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.395] GetProcessHeap () returned 0xd20000 [0107.395] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.395] GetProcessHeap () returned 0xd20000 [0107.395] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.395] GetProcessHeap () returned 0xd20000 [0107.395] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.395] GetProcessHeap () returned 0xd20000 [0107.395] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.395] GetProcessHeap () returned 0xd20000 [0107.395] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.395] GetProcessHeap () returned 0xd20000 [0107.395] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.395] GetProcessHeap () returned 0xd20000 [0107.395] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.395] GetProcessHeap () returned 0xd20000 [0107.395] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.396] GetProcessHeap () returned 0xd20000 [0107.396] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.396] GetProcessHeap () returned 0xd20000 [0107.396] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.396] GetProcessHeap () returned 0xd20000 [0107.396] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.396] GetProcessHeap () returned 0xd20000 [0107.396] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.396] GetProcessHeap () returned 0xd20000 [0107.396] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.396] GetProcessHeap () returned 0xd20000 [0107.396] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.396] GetProcessHeap () returned 0xd20000 [0107.396] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.396] GetProcessHeap () returned 0xd20000 [0107.396] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.396] GetProcessHeap () returned 0xd20000 [0107.396] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.396] GetProcessHeap () returned 0xd20000 [0107.396] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.396] GetProcessHeap () returned 0xd20000 [0107.396] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.396] GetProcessHeap () returned 0xd20000 [0107.396] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.396] GetProcessHeap () returned 0xd20000 [0107.396] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.397] GetProcessHeap () returned 0xd20000 [0107.397] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.397] GetProcessHeap () returned 0xd20000 [0107.397] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.397] GetProcessHeap () returned 0xd20000 [0107.397] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.397] GetProcessHeap () returned 0xd20000 [0107.397] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.397] GetProcessHeap () returned 0xd20000 [0107.397] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.397] GetProcessHeap () returned 0xd20000 [0107.397] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.397] GetProcessHeap () returned 0xd20000 [0107.397] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.397] GetProcessHeap () returned 0xd20000 [0107.397] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.397] GetProcessHeap () returned 0xd20000 [0107.397] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.397] GetProcessHeap () returned 0xd20000 [0107.397] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.397] GetProcessHeap () returned 0xd20000 [0107.397] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.397] GetProcessHeap () returned 0xd20000 [0107.397] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.397] GetProcessHeap () returned 0xd20000 [0107.397] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.398] GetProcessHeap () returned 0xd20000 [0107.398] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.398] GetProcessHeap () returned 0xd20000 [0107.398] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.398] GetProcessHeap () returned 0xd20000 [0107.398] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.398] GetProcessHeap () returned 0xd20000 [0107.398] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.398] GetProcessHeap () returned 0xd20000 [0107.398] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.398] GetProcessHeap () returned 0xd20000 [0107.398] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.398] GetProcessHeap () returned 0xd20000 [0107.398] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.398] GetProcessHeap () returned 0xd20000 [0107.398] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.398] GetProcessHeap () returned 0xd20000 [0107.398] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.398] GetProcessHeap () returned 0xd20000 [0107.398] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.398] GetProcessHeap () returned 0xd20000 [0107.398] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.398] GetProcessHeap () returned 0xd20000 [0107.398] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.398] GetProcessHeap () returned 0xd20000 [0107.398] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.398] GetProcessHeap () returned 0xd20000 [0107.398] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.399] GetProcessHeap () returned 0xd20000 [0107.399] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.399] GetProcessHeap () returned 0xd20000 [0107.399] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.399] GetProcessHeap () returned 0xd20000 [0107.399] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.399] GetProcessHeap () returned 0xd20000 [0107.399] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.399] GetProcessHeap () returned 0xd20000 [0107.399] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.399] GetProcessHeap () returned 0xd20000 [0107.399] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.399] GetProcessHeap () returned 0xd20000 [0107.399] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.399] GetProcessHeap () returned 0xd20000 [0107.399] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.399] GetProcessHeap () returned 0xd20000 [0107.399] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.399] GetProcessHeap () returned 0xd20000 [0107.399] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.399] GetProcessHeap () returned 0xd20000 [0107.399] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.399] GetProcessHeap () returned 0xd20000 [0107.399] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.399] GetProcessHeap () returned 0xd20000 [0107.399] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0107.400] GetProcessHeap () returned 0xd20000 [0107.400] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0107.400] GetProcessHeap () returned 0xd20000 [0107.400] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.400] GetProcessHeap () returned 0xd20000 [0107.400] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.400] GetProcessHeap () returned 0xd20000 [0107.400] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.400] GetProcessHeap () returned 0xd20000 [0107.400] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.400] GetProcessHeap () returned 0xd20000 [0107.400] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.400] GetProcessHeap () returned 0xd20000 [0107.400] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.400] GetProcessHeap () returned 0xd20000 [0107.401] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.401] GetProcessHeap () returned 0xd20000 [0107.401] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.401] GetProcessHeap () returned 0xd20000 [0107.401] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.401] GetProcessHeap () returned 0xd20000 [0107.401] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.401] GetProcessHeap () returned 0xd20000 [0107.401] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.401] GetProcessHeap () returned 0xd20000 [0107.401] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.401] GetProcessHeap () returned 0xd20000 [0107.401] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.401] GetProcessHeap () returned 0xd20000 [0107.401] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.401] GetProcessHeap () returned 0xd20000 [0107.401] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.401] GetProcessHeap () returned 0xd20000 [0107.401] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.401] GetProcessHeap () returned 0xd20000 [0107.401] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.401] GetProcessHeap () returned 0xd20000 [0107.401] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.401] GetProcessHeap () returned 0xd20000 [0107.402] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.402] GetProcessHeap () returned 0xd20000 [0107.402] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.402] GetProcessHeap () returned 0xd20000 [0107.402] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.402] GetProcessHeap () returned 0xd20000 [0107.402] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.402] GetProcessHeap () returned 0xd20000 [0107.402] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.402] GetProcessHeap () returned 0xd20000 [0107.402] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.402] GetProcessHeap () returned 0xd20000 [0107.402] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.402] GetProcessHeap () returned 0xd20000 [0107.402] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.402] GetProcessHeap () returned 0xd20000 [0107.402] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.402] GetProcessHeap () returned 0xd20000 [0107.402] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.402] GetProcessHeap () returned 0xd20000 [0107.402] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.402] GetProcessHeap () returned 0xd20000 [0107.402] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.402] GetProcessHeap () returned 0xd20000 [0107.402] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.403] GetProcessHeap () returned 0xd20000 [0107.403] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.403] GetProcessHeap () returned 0xd20000 [0107.403] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.403] GetProcessHeap () returned 0xd20000 [0107.403] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.403] GetProcessHeap () returned 0xd20000 [0107.403] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.403] GetProcessHeap () returned 0xd20000 [0107.403] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.403] GetProcessHeap () returned 0xd20000 [0107.403] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.403] GetProcessHeap () returned 0xd20000 [0107.403] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.403] GetProcessHeap () returned 0xd20000 [0107.403] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.403] GetProcessHeap () returned 0xd20000 [0107.403] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.403] GetProcessHeap () returned 0xd20000 [0107.403] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.403] GetProcessHeap () returned 0xd20000 [0107.403] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.403] GetProcessHeap () returned 0xd20000 [0107.403] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.403] GetProcessHeap () returned 0xd20000 [0107.403] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.404] GetProcessHeap () returned 0xd20000 [0107.404] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.404] GetProcessHeap () returned 0xd20000 [0107.404] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.404] GetProcessHeap () returned 0xd20000 [0107.404] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.404] GetProcessHeap () returned 0xd20000 [0107.404] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.404] GetProcessHeap () returned 0xd20000 [0107.404] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.404] GetProcessHeap () returned 0xd20000 [0107.404] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.404] GetProcessHeap () returned 0xd20000 [0107.404] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.404] GetProcessHeap () returned 0xd20000 [0107.404] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.404] GetProcessHeap () returned 0xd20000 [0107.404] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.404] GetProcessHeap () returned 0xd20000 [0107.404] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.404] GetProcessHeap () returned 0xd20000 [0107.404] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.404] GetProcessHeap () returned 0xd20000 [0107.404] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.404] GetProcessHeap () returned 0xd20000 [0107.404] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.404] GetProcessHeap () returned 0xd20000 [0107.404] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.404] GetProcessHeap () returned 0xd20000 [0107.405] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.405] GetProcessHeap () returned 0xd20000 [0107.405] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.405] GetProcessHeap () returned 0xd20000 [0107.405] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.405] GetProcessHeap () returned 0xd20000 [0107.405] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.405] GetProcessHeap () returned 0xd20000 [0107.405] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.405] GetProcessHeap () returned 0xd20000 [0107.405] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.405] GetProcessHeap () returned 0xd20000 [0107.405] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0107.405] GetProcessHeap () returned 0xd20000 [0107.405] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0107.405] GetProcessHeap () returned 0xd20000 [0107.405] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.405] GetProcessHeap () returned 0xd20000 [0107.405] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.405] GetProcessHeap () returned 0xd20000 [0107.405] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.405] GetProcessHeap () returned 0xd20000 [0107.405] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.405] GetProcessHeap () returned 0xd20000 [0107.405] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.405] GetProcessHeap () returned 0xd20000 [0107.405] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.405] GetProcessHeap () returned 0xd20000 [0107.405] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.405] GetProcessHeap () returned 0xd20000 [0107.406] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.406] GetProcessHeap () returned 0xd20000 [0107.406] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.406] GetProcessHeap () returned 0xd20000 [0107.406] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.406] GetProcessHeap () returned 0xd20000 [0107.406] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.406] GetProcessHeap () returned 0xd20000 [0107.406] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.406] GetProcessHeap () returned 0xd20000 [0107.406] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.406] GetProcessHeap () returned 0xd20000 [0107.406] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.406] GetProcessHeap () returned 0xd20000 [0107.406] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.406] GetProcessHeap () returned 0xd20000 [0107.406] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.406] GetProcessHeap () returned 0xd20000 [0107.406] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.406] GetProcessHeap () returned 0xd20000 [0107.406] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.406] GetProcessHeap () returned 0xd20000 [0107.406] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.406] GetProcessHeap () returned 0xd20000 [0107.406] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.406] GetProcessHeap () returned 0xd20000 [0107.406] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.407] GetProcessHeap () returned 0xd20000 [0107.407] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.407] GetProcessHeap () returned 0xd20000 [0107.407] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.407] GetProcessHeap () returned 0xd20000 [0107.407] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.407] GetProcessHeap () returned 0xd20000 [0107.407] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.407] GetProcessHeap () returned 0xd20000 [0107.407] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.407] GetProcessHeap () returned 0xd20000 [0107.407] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.407] GetProcessHeap () returned 0xd20000 [0107.407] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.407] GetProcessHeap () returned 0xd20000 [0107.407] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.407] GetProcessHeap () returned 0xd20000 [0107.407] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.407] GetProcessHeap () returned 0xd20000 [0107.407] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0107.407] GetProcessHeap () returned 0xd20000 [0107.407] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0107.407] GetProcessHeap () returned 0xd20000 [0107.407] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0107.407] GetProcessHeap () returned 0xd20000 [0107.407] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0107.407] GetProcessHeap () returned 0xd20000 [0107.407] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0107.407] GetProcessHeap () returned 0xd20000 [0107.407] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0107.407] GetProcessHeap () returned 0xd20000 [0107.407] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44480 | out: hHeap=0xd20000) returned 1 [0107.408] GetProcessHeap () returned 0xd20000 [0107.408] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a9d8 | out: hHeap=0xd20000) returned 1 [0107.408] GetProcessHeap () returned 0xd20000 [0107.408] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0107.408] GetProcessHeap () returned 0xd20000 [0107.408] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b638 | out: hHeap=0xd20000) returned 1 [0107.408] GetProcessHeap () returned 0xd20000 [0107.408] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0107.408] GetProcessHeap () returned 0xd20000 [0107.408] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.408] GetProcessHeap () returned 0xd20000 [0107.408] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0107.408] WriteFile (in: hFile=0x230, lpBuffer=0xd4f070*, nNumberOfBytesToWrite=0x382, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f070*, lpNumberOfBytesWritten=0x299d864*=0x382, lpOverlapped=0x0) returned 1 [0107.413] GetProcessHeap () returned 0xd20000 [0107.413] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4f070, Size=0x30) returned 0xd4f070 [0107.414] GetProcessHeap () returned 0xd20000 [0107.414] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0107.414] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0107.414] GetProcessHeap () returned 0xd20000 [0107.414] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1110) returned 0xd4f0a8 [0107.414] ReadFile (in: hFile=0x230, lpBuffer=0xd4f0a8, nNumberOfBytesToRead=0x1110, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4f0a8*, lpNumberOfBytesRead=0x299d7e8*=0x1110, lpOverlapped=0x0) returned 1 [0107.414] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0107.414] WriteFile (in: hFile=0x230, lpBuffer=0xd4f0a8*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4f0a8*, lpNumberOfBytesWritten=0x299d7e4*=0x1110, lpOverlapped=0x0) returned 1 [0107.415] GetProcessHeap () returned 0xd20000 [0107.415] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4f0a8 | out: hHeap=0xd20000) returned 1 [0107.415] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0107.415] WriteFile (in: hFile=0x230, lpBuffer=0xd4f070*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f070*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0107.417] CloseHandle (hObject=0x230) returned 1 [0107.421] GetProcessHeap () returned 0xd20000 [0107.421] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd426c0 | out: hHeap=0xd20000) returned 1 [0107.421] GetProcessHeap () returned 0xd20000 [0107.421] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c070 | out: hHeap=0xd20000) returned 1 [0107.421] GetProcessHeap () returned 0xd20000 [0107.421] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0107.421] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\8 x_b8TY9uNIlaEJPu.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\8 x_b8TY9uNIlaEJPu.mp4") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\8 x_b8TY9uNIlaEJPu.mp4" [0107.421] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\8 x_b8TY9uNIlaEJPu.mp4", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\8 x_b8TY9uNIlaEJPu.mp4.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\8 x_b8TY9uNIlaEJPu.mp4.[ponce.lorena@aol.com]" [0107.421] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\8 x_b8TY9uNIlaEJPu.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\pp4pa7\\8 x_b8ty9unilaejpu.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\8 x_b8TY9uNIlaEJPu.mp4.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\pp4pa7\\8 x_b8ty9unilaejpu.mp4.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0107.422] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\8 x_b8TY9uNIlaEJPu.mp4" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7") returned 1 [0107.422] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\") returned="" [0107.422] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\HOW_RECOVER.html" [0107.422] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\pp4pa7\\how_recover.html")) returned 0xffffffff [0107.422] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\pp4pa7\\how_recover.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0107.424] GetProcessHeap () returned 0xd20000 [0107.424] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bf08 [0107.425] GetProcessHeap () returned 0xd20000 [0107.425] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0107.437] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.439] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.439] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.439] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.439] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.439] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.440] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.440] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.440] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.440] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.440] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.440] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.440] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.440] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.441] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.441] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.441] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.441] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.441] GetProcessHeap () returned 0xd20000 [0107.441] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bf08 | out: hHeap=0xd20000) returned 1 [0107.441] GetProcessHeap () returned 0xd20000 [0107.441] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0107.441] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x299d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x299d9d0*=0x300, lpOverlapped=0x0) returned 1 [0107.442] GetProcessHeap () returned 0xd20000 [0107.442] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4be90 [0107.442] GetProcessHeap () returned 0xd20000 [0107.442] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0107.455] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.455] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.455] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.456] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.456] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.456] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.456] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.456] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.456] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.456] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.457] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.457] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.457] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.457] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.457] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.457] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.457] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.458] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.458] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.458] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.458] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.458] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.458] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.458] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.459] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.459] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.459] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.459] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.459] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.459] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.459] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.459] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.460] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.460] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.460] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.460] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.460] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.460] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.460] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.461] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.461] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.461] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.461] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.461] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.461] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.470] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.470] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.470] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.470] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.470] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.470] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.471] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.471] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.471] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.471] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.471] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.471] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.471] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.472] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.472] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.472] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.472] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.472] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.472] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.472] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.473] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.473] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.473] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.473] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.473] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.473] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.473] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.474] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.474] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.474] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.474] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.474] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.474] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.475] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.475] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.475] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.475] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.475] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.475] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.475] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.476] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.476] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.476] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.476] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.476] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.476] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.476] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.477] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.477] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.477] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.477] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.477] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.477] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.477] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.477] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.478] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.478] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.478] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.478] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.479] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.479] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.479] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.479] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.480] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.480] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.480] GetProcessHeap () returned 0xd20000 [0107.480] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4be90 | out: hHeap=0xd20000) returned 1 [0107.480] GetProcessHeap () returned 0xd20000 [0107.480] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0107.480] CloseHandle (hObject=0x230) returned 1 [0107.481] GetProcessHeap () returned 0xd20000 [0107.481] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36688 | out: hHeap=0xd20000) returned 1 [0107.481] FindNextFileW (in: hFindFile=0xd48ca0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x521118e0, ftCreationTime.dwHighDateTime=0x1d4cc4c, ftLastAccessTime.dwLowDateTime=0x59aaeb10, ftLastAccessTime.dwHighDateTime=0x1d4c758, ftLastWriteTime.dwLowDateTime=0x59aaeb10, ftLastWriteTime.dwHighDateTime=0x1d4c758, nFileSizeHigh=0x0, nFileSizeLow=0x7368, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="QqkYW3ugL.mkv", cAlternateFileName="QQKYW3~1.MKV")) returned 1 [0107.481] lstrcmpiW (lpString1="QqkYW3ugL.mkv", lpString2=".") returned 1 [0107.481] lstrcmpiW (lpString1="QqkYW3ugL.mkv", lpString2="..") returned 1 [0107.481] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\", lpString2="QqkYW3ugL.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\QqkYW3ugL.mkv") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\QqkYW3ugL.mkv" [0107.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QqkYW3ugL.mkv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0107.481] GetProcessHeap () returned 0xd20000 [0107.481] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xe) returned 0xd445b8 [0107.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QqkYW3ugL.mkv", cchWideChar=-1, lpMultiByteStr=0xd445b8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QqkYW3ugL.mkv", lpUsedDefaultChar=0x0) returned 14 [0107.481] lstrlenA (lpString="QqkYW3ugL.mkv") returned 13 [0107.481] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0107.481] lstrlenA (lpString="QqkYW3ugL.mkv") returned 13 [0107.481] lstrlenA (lpString=".dll") returned 4 [0107.481] lstrlenA (lpString=".dll") returned 4 [0107.481] lstrlenA (lpString="QqkYW3ugL.mkv") returned 13 [0107.481] lstrcmpiA (lpString1=".mkv", lpString2=".dll") returned 1 [0107.481] lstrlenA (lpString="QqkYW3ugL.mkv") returned 13 [0107.482] lstrlenA (lpString=".ini") returned 4 [0107.482] lstrlenA (lpString=".ini") returned 4 [0107.482] lstrlenA (lpString="QqkYW3ugL.mkv") returned 13 [0107.482] lstrcmpiA (lpString1=".mkv", lpString2=".ini") returned 1 [0107.482] lstrlenA (lpString="QqkYW3ugL.mkv") returned 13 [0107.482] lstrlenA (lpString=".inc") returned 4 [0107.482] lstrlenA (lpString=".inc") returned 4 [0107.482] lstrlenA (lpString="QqkYW3ugL.mkv") returned 13 [0107.482] lstrcmpiA (lpString1=".mkv", lpString2=".inc") returned 1 [0107.482] lstrcmpiW (lpString1="QqkYW3ugL.mkv", lpString2="HOW_RECOVER.html") returned 1 [0107.482] lstrcmpiW (lpString1="QqkYW3ugL.mkv", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0107.482] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0107.482] lstrcmpiW (lpString1="QqkYW3ugL.mkv", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0107.482] GetProcessHeap () returned 0xd20000 [0107.482] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd428a0 [0107.482] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\QqkYW3ugL.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\pp4pa7\\qqkyw3ugl.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0107.483] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=29544) returned 1 [0107.483] GetProcessHeap () returned 0xd20000 [0107.483] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bda0 [0107.483] GetProcessHeap () returned 0xd20000 [0107.483] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0107.483] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\QqkYW3ugL.mkv") returned 57 [0107.483] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0107.483] GetProcessHeap () returned 0xd20000 [0107.483] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0107.483] GetProcessHeap () returned 0xd20000 [0107.483] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4f0a8 [0107.483] lstrlenA (lpString="rsa_encrypt") returned 11 [0107.483] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0107.485] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0107.485] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0107.485] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0107.485] GetProcessHeap () returned 0xd20000 [0107.485] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0107.486] lstrlenA (lpString="010001") returned 6 [0107.486] GetProcessHeap () returned 0xd20000 [0107.486] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cdf8 [0107.486] GetProcessHeap () returned 0xd20000 [0107.486] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0107.486] GetProcessHeap () returned 0xd20000 [0107.486] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b2d8 [0107.486] GetProcessHeap () returned 0xd20000 [0107.486] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0107.486] GetProcessHeap () returned 0xd20000 [0107.486] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ab88 [0107.486] GetProcessHeap () returned 0xd20000 [0107.486] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44e98 [0107.486] GetProcessHeap () returned 0xd20000 [0107.486] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cec8 [0107.486] GetProcessHeap () returned 0xd20000 [0107.486] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0107.486] GetProcessHeap () returned 0xd20000 [0107.487] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.487] GetProcessHeap () returned 0xd20000 [0107.487] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0107.487] GetProcessHeap () returned 0xd20000 [0107.487] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0107.487] GetProcessHeap () returned 0xd20000 [0107.487] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd45528 [0107.487] GetProcessHeap () returned 0xd20000 [0107.487] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.487] GetProcessHeap () returned 0xd20000 [0107.487] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445d0 [0107.487] GetProcessHeap () returned 0xd20000 [0107.487] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4a9d8 [0107.487] GetProcessHeap () returned 0xd20000 [0107.487] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0107.487] GetProcessHeap () returned 0xd20000 [0107.487] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0107.487] GetProcessHeap () returned 0xd20000 [0107.487] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a9d8 | out: hHeap=0xd20000) returned 1 [0107.487] GetProcessHeap () returned 0xd20000 [0107.487] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.488] GetProcessHeap () returned 0xd20000 [0107.488] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44678 [0107.488] GetProcessHeap () returned 0xd20000 [0107.488] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.488] GetProcessHeap () returned 0xd20000 [0107.488] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.488] GetProcessHeap () returned 0xd20000 [0107.488] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.488] GetProcessHeap () returned 0xd20000 [0107.488] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.488] GetProcessHeap () returned 0xd20000 [0107.488] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.488] GetProcessHeap () returned 0xd20000 [0107.488] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.488] GetProcessHeap () returned 0xd20000 [0107.488] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b518 [0107.488] GetProcessHeap () returned 0xd20000 [0107.488] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44678 | out: hHeap=0xd20000) returned 1 [0107.488] GetProcessHeap () returned 0xd20000 [0107.488] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0107.488] GetProcessHeap () returned 0xd20000 [0107.488] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0107.489] GetProcessHeap () returned 0xd20000 [0107.489] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.489] GetProcessHeap () returned 0xd20000 [0107.489] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.489] GetProcessHeap () returned 0xd20000 [0107.489] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.489] GetProcessHeap () returned 0xd20000 [0107.489] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.489] GetProcessHeap () returned 0xd20000 [0107.489] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.489] GetProcessHeap () returned 0xd20000 [0107.489] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.489] GetProcessHeap () returned 0xd20000 [0107.489] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.489] GetProcessHeap () returned 0xd20000 [0107.489] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.489] GetProcessHeap () returned 0xd20000 [0107.489] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.489] GetProcessHeap () returned 0xd20000 [0107.489] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.489] GetProcessHeap () returned 0xd20000 [0107.490] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.490] GetProcessHeap () returned 0xd20000 [0107.490] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.490] GetProcessHeap () returned 0xd20000 [0107.490] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.490] GetProcessHeap () returned 0xd20000 [0107.490] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.490] GetProcessHeap () returned 0xd20000 [0107.490] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.490] GetProcessHeap () returned 0xd20000 [0107.490] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.490] GetProcessHeap () returned 0xd20000 [0107.490] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.490] GetProcessHeap () returned 0xd20000 [0107.490] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.490] GetProcessHeap () returned 0xd20000 [0107.490] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0107.490] GetProcessHeap () returned 0xd20000 [0107.490] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0107.490] GetProcessHeap () returned 0xd20000 [0107.491] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.491] GetProcessHeap () returned 0xd20000 [0107.491] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.491] GetProcessHeap () returned 0xd20000 [0107.491] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.491] GetProcessHeap () returned 0xd20000 [0107.491] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.491] GetProcessHeap () returned 0xd20000 [0107.491] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.491] GetProcessHeap () returned 0xd20000 [0107.491] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.491] GetProcessHeap () returned 0xd20000 [0107.491] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.491] GetProcessHeap () returned 0xd20000 [0107.491] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.491] GetProcessHeap () returned 0xd20000 [0107.491] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.491] GetProcessHeap () returned 0xd20000 [0107.491] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.491] GetProcessHeap () returned 0xd20000 [0107.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0107.492] GetProcessHeap () returned 0xd20000 [0107.492] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0107.492] GetProcessHeap () returned 0xd20000 [0107.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.492] GetProcessHeap () returned 0xd20000 [0107.492] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.492] GetProcessHeap () returned 0xd20000 [0107.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.492] GetProcessHeap () returned 0xd20000 [0107.492] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.492] GetProcessHeap () returned 0xd20000 [0107.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.492] GetProcessHeap () returned 0xd20000 [0107.492] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.492] GetProcessHeap () returned 0xd20000 [0107.492] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.492] GetProcessHeap () returned 0xd20000 [0107.492] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.492] GetProcessHeap () returned 0xd20000 [0107.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.493] GetProcessHeap () returned 0xd20000 [0107.493] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.493] GetProcessHeap () returned 0xd20000 [0107.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.493] GetProcessHeap () returned 0xd20000 [0107.493] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.493] GetProcessHeap () returned 0xd20000 [0107.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.493] GetProcessHeap () returned 0xd20000 [0107.493] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.493] GetProcessHeap () returned 0xd20000 [0107.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0107.493] GetProcessHeap () returned 0xd20000 [0107.493] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0107.493] GetProcessHeap () returned 0xd20000 [0107.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.493] GetProcessHeap () returned 0xd20000 [0107.493] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.494] GetProcessHeap () returned 0xd20000 [0107.494] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.494] GetProcessHeap () returned 0xd20000 [0107.494] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.494] GetProcessHeap () returned 0xd20000 [0107.494] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.494] GetProcessHeap () returned 0xd20000 [0107.495] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.495] GetProcessHeap () returned 0xd20000 [0107.495] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.495] GetProcessHeap () returned 0xd20000 [0107.495] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.495] GetProcessHeap () returned 0xd20000 [0107.495] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.495] GetProcessHeap () returned 0xd20000 [0107.495] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.495] GetProcessHeap () returned 0xd20000 [0107.495] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.495] GetProcessHeap () returned 0xd20000 [0107.495] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.495] GetProcessHeap () returned 0xd20000 [0107.495] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.495] GetProcessHeap () returned 0xd20000 [0107.495] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.495] GetProcessHeap () returned 0xd20000 [0107.495] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.495] GetProcessHeap () returned 0xd20000 [0107.496] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.496] GetProcessHeap () returned 0xd20000 [0107.496] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.496] GetProcessHeap () returned 0xd20000 [0107.496] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.496] GetProcessHeap () returned 0xd20000 [0107.496] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.496] GetProcessHeap () returned 0xd20000 [0107.496] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.496] GetProcessHeap () returned 0xd20000 [0107.496] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.496] GetProcessHeap () returned 0xd20000 [0107.496] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.496] GetProcessHeap () returned 0xd20000 [0107.496] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.496] GetProcessHeap () returned 0xd20000 [0107.496] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.496] GetProcessHeap () returned 0xd20000 [0107.496] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.496] GetProcessHeap () returned 0xd20000 [0107.496] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.496] GetProcessHeap () returned 0xd20000 [0107.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.497] GetProcessHeap () returned 0xd20000 [0107.497] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.497] GetProcessHeap () returned 0xd20000 [0107.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.497] GetProcessHeap () returned 0xd20000 [0107.497] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.497] GetProcessHeap () returned 0xd20000 [0107.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.497] GetProcessHeap () returned 0xd20000 [0107.497] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.497] GetProcessHeap () returned 0xd20000 [0107.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.497] GetProcessHeap () returned 0xd20000 [0107.497] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.497] GetProcessHeap () returned 0xd20000 [0107.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.497] GetProcessHeap () returned 0xd20000 [0107.497] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.497] GetProcessHeap () returned 0xd20000 [0107.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.497] GetProcessHeap () returned 0xd20000 [0107.497] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.497] GetProcessHeap () returned 0xd20000 [0107.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.498] GetProcessHeap () returned 0xd20000 [0107.498] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.498] GetProcessHeap () returned 0xd20000 [0107.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.498] GetProcessHeap () returned 0xd20000 [0107.498] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.498] GetProcessHeap () returned 0xd20000 [0107.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.498] GetProcessHeap () returned 0xd20000 [0107.498] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.498] GetProcessHeap () returned 0xd20000 [0107.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.498] GetProcessHeap () returned 0xd20000 [0107.498] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.498] GetProcessHeap () returned 0xd20000 [0107.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.498] GetProcessHeap () returned 0xd20000 [0107.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.499] GetProcessHeap () returned 0xd20000 [0107.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.499] GetProcessHeap () returned 0xd20000 [0107.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.499] GetProcessHeap () returned 0xd20000 [0107.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.499] GetProcessHeap () returned 0xd20000 [0107.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.499] GetProcessHeap () returned 0xd20000 [0107.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.499] GetProcessHeap () returned 0xd20000 [0107.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.499] GetProcessHeap () returned 0xd20000 [0107.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.499] GetProcessHeap () returned 0xd20000 [0107.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.500] GetProcessHeap () returned 0xd20000 [0107.500] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.500] GetProcessHeap () returned 0xd20000 [0107.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.500] GetProcessHeap () returned 0xd20000 [0107.500] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.500] GetProcessHeap () returned 0xd20000 [0107.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.500] GetProcessHeap () returned 0xd20000 [0107.500] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.500] GetProcessHeap () returned 0xd20000 [0107.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.500] GetProcessHeap () returned 0xd20000 [0107.500] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.500] GetProcessHeap () returned 0xd20000 [0107.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.500] GetProcessHeap () returned 0xd20000 [0107.500] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0107.501] GetProcessHeap () returned 0xd20000 [0107.501] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0107.501] GetProcessHeap () returned 0xd20000 [0107.501] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.501] GetProcessHeap () returned 0xd20000 [0107.501] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.501] GetProcessHeap () returned 0xd20000 [0107.501] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.501] GetProcessHeap () returned 0xd20000 [0107.501] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.501] GetProcessHeap () returned 0xd20000 [0107.501] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.501] GetProcessHeap () returned 0xd20000 [0107.501] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.501] GetProcessHeap () returned 0xd20000 [0107.501] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.501] GetProcessHeap () returned 0xd20000 [0107.502] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.502] GetProcessHeap () returned 0xd20000 [0107.502] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.502] GetProcessHeap () returned 0xd20000 [0107.502] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.502] GetProcessHeap () returned 0xd20000 [0107.502] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0107.502] GetProcessHeap () returned 0xd20000 [0107.502] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0107.502] GetProcessHeap () returned 0xd20000 [0107.502] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.502] GetProcessHeap () returned 0xd20000 [0107.502] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.502] GetProcessHeap () returned 0xd20000 [0107.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0107.503] GetProcessHeap () returned 0xd20000 [0107.503] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0107.503] GetProcessHeap () returned 0xd20000 [0107.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.503] GetProcessHeap () returned 0xd20000 [0107.503] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.503] GetProcessHeap () returned 0xd20000 [0107.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.503] GetProcessHeap () returned 0xd20000 [0107.503] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.503] GetProcessHeap () returned 0xd20000 [0107.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.503] GetProcessHeap () returned 0xd20000 [0107.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.504] GetProcessHeap () returned 0xd20000 [0107.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.504] GetProcessHeap () returned 0xd20000 [0107.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.504] GetProcessHeap () returned 0xd20000 [0107.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.504] GetProcessHeap () returned 0xd20000 [0107.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.504] GetProcessHeap () returned 0xd20000 [0107.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.504] GetProcessHeap () returned 0xd20000 [0107.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.504] GetProcessHeap () returned 0xd20000 [0107.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0107.504] GetProcessHeap () returned 0xd20000 [0107.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0107.505] GetProcessHeap () returned 0xd20000 [0107.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.505] GetProcessHeap () returned 0xd20000 [0107.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.505] GetProcessHeap () returned 0xd20000 [0107.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.505] GetProcessHeap () returned 0xd20000 [0107.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.505] GetProcessHeap () returned 0xd20000 [0107.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.505] GetProcessHeap () returned 0xd20000 [0107.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.505] GetProcessHeap () returned 0xd20000 [0107.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.505] GetProcessHeap () returned 0xd20000 [0107.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.505] GetProcessHeap () returned 0xd20000 [0107.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.506] GetProcessHeap () returned 0xd20000 [0107.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.506] GetProcessHeap () returned 0xd20000 [0107.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.506] GetProcessHeap () returned 0xd20000 [0107.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.506] GetProcessHeap () returned 0xd20000 [0107.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.506] GetProcessHeap () returned 0xd20000 [0107.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.506] GetProcessHeap () returned 0xd20000 [0107.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.506] GetProcessHeap () returned 0xd20000 [0107.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.506] GetProcessHeap () returned 0xd20000 [0107.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.506] GetProcessHeap () returned 0xd20000 [0107.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.507] GetProcessHeap () returned 0xd20000 [0107.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.507] GetProcessHeap () returned 0xd20000 [0107.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.507] GetProcessHeap () returned 0xd20000 [0107.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.507] GetProcessHeap () returned 0xd20000 [0107.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.507] GetProcessHeap () returned 0xd20000 [0107.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.507] GetProcessHeap () returned 0xd20000 [0107.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.507] GetProcessHeap () returned 0xd20000 [0107.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.507] GetProcessHeap () returned 0xd20000 [0107.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.507] GetProcessHeap () returned 0xd20000 [0107.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0107.508] GetProcessHeap () returned 0xd20000 [0107.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0107.508] GetProcessHeap () returned 0xd20000 [0107.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0107.508] GetProcessHeap () returned 0xd20000 [0107.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0107.508] GetProcessHeap () returned 0xd20000 [0107.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445d0 | out: hHeap=0xd20000) returned 1 [0107.508] GetProcessHeap () returned 0xd20000 [0107.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ab88 | out: hHeap=0xd20000) returned 1 [0107.508] GetProcessHeap () returned 0xd20000 [0107.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0107.508] GetProcessHeap () returned 0xd20000 [0107.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b2d8 | out: hHeap=0xd20000) returned 1 [0107.508] GetProcessHeap () returned 0xd20000 [0107.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0107.508] GetProcessHeap () returned 0xd20000 [0107.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.509] GetProcessHeap () returned 0xd20000 [0107.509] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0107.509] WriteFile (in: hFile=0x230, lpBuffer=0xd4f0a8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f0a8*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0107.534] GetProcessHeap () returned 0xd20000 [0107.534] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4f0a8, Size=0x30) returned 0xd4f0a8 [0107.534] GetProcessHeap () returned 0xd20000 [0107.534] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0107.534] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0107.534] GetProcessHeap () returned 0xd20000 [0107.534] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x7368) returned 0xd4f0e0 [0107.535] ReadFile (in: hFile=0x230, lpBuffer=0xd4f0e0, nNumberOfBytesToRead=0x7368, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4f0e0*, lpNumberOfBytesRead=0x299d7e8*=0x7368, lpOverlapped=0x0) returned 1 [0107.536] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0107.536] WriteFile (in: hFile=0x230, lpBuffer=0xd4f0e0*, nNumberOfBytesToWrite=0x7368, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4f0e0*, lpNumberOfBytesWritten=0x299d7e4*=0x7368, lpOverlapped=0x0) returned 1 [0107.539] GetProcessHeap () returned 0xd20000 [0107.539] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4f0e0 | out: hHeap=0xd20000) returned 1 [0107.539] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0107.539] WriteFile (in: hFile=0x230, lpBuffer=0xd4f0a8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f0a8*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0107.540] CloseHandle (hObject=0x230) returned 1 [0107.549] GetProcessHeap () returned 0xd20000 [0107.549] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd428a0 | out: hHeap=0xd20000) returned 1 [0107.549] GetProcessHeap () returned 0xd20000 [0107.549] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bda0 | out: hHeap=0xd20000) returned 1 [0107.549] GetProcessHeap () returned 0xd20000 [0107.549] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0107.549] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\QqkYW3ugL.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\QqkYW3ugL.mkv") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\QqkYW3ugL.mkv" [0107.549] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\QqkYW3ugL.mkv", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\QqkYW3ugL.mkv.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\QqkYW3ugL.mkv.[ponce.lorena@aol.com]" [0107.549] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\QqkYW3ugL.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\pp4pa7\\qqkyw3ugl.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\QqkYW3ugL.mkv.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\pp4pa7\\qqkyw3ugl.mkv.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0107.550] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\QqkYW3ugL.mkv" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7") returned 1 [0107.550] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\") returned="" [0107.550] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\HOW_RECOVER.html" [0107.550] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\pp4pa7\\how_recover.html")) returned 0x20 [0107.551] GetProcessHeap () returned 0xd20000 [0107.551] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445b8 | out: hHeap=0xd20000) returned 1 [0107.551] FindNextFileW (in: hFindFile=0xd48ca0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b0b9a0, ftCreationTime.dwHighDateTime=0x1d4ccb2, ftLastAccessTime.dwLowDateTime=0x5af2ca70, ftLastAccessTime.dwHighDateTime=0x1d4d0c6, ftLastWriteTime.dwLowDateTime=0x5af2ca70, ftLastWriteTime.dwHighDateTime=0x1d4d0c6, nFileSizeHigh=0x0, nFileSizeLow=0xc823, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="u8c4wCL.mp4", cAlternateFileName="")) returned 1 [0107.551] lstrcmpiW (lpString1="u8c4wCL.mp4", lpString2=".") returned 1 [0107.551] lstrcmpiW (lpString1="u8c4wCL.mp4", lpString2="..") returned 1 [0107.551] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\", lpString2="u8c4wCL.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\u8c4wCL.mp4") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\u8c4wCL.mp4" [0107.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="u8c4wCL.mp4", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.551] GetProcessHeap () returned 0xd20000 [0107.551] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd444e0 [0107.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="u8c4wCL.mp4", cchWideChar=-1, lpMultiByteStr=0xd444e0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="u8c4wCL.mp4", lpUsedDefaultChar=0x0) returned 12 [0107.551] lstrlenA (lpString="u8c4wCL.mp4") returned 11 [0107.551] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0107.551] lstrlenA (lpString="u8c4wCL.mp4") returned 11 [0107.551] lstrlenA (lpString=".dll") returned 4 [0107.551] lstrlenA (lpString=".dll") returned 4 [0107.551] lstrlenA (lpString="u8c4wCL.mp4") returned 11 [0107.552] lstrcmpiA (lpString1=".mp4", lpString2=".dll") returned 1 [0107.552] lstrlenA (lpString="u8c4wCL.mp4") returned 11 [0107.552] lstrlenA (lpString=".ini") returned 4 [0107.552] lstrlenA (lpString=".ini") returned 4 [0107.552] lstrlenA (lpString="u8c4wCL.mp4") returned 11 [0107.552] lstrcmpiA (lpString1=".mp4", lpString2=".ini") returned 1 [0107.552] lstrlenA (lpString="u8c4wCL.mp4") returned 11 [0107.552] lstrlenA (lpString=".inc") returned 4 [0107.552] lstrlenA (lpString=".inc") returned 4 [0107.552] lstrlenA (lpString="u8c4wCL.mp4") returned 11 [0107.552] lstrcmpiA (lpString1=".mp4", lpString2=".inc") returned 1 [0107.552] lstrcmpiW (lpString1="u8c4wCL.mp4", lpString2="HOW_RECOVER.html") returned 1 [0107.552] lstrcmpiW (lpString1="u8c4wCL.mp4", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0107.552] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0107.552] lstrcmpiW (lpString1="u8c4wCL.mp4", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0107.552] GetProcessHeap () returned 0xd20000 [0107.552] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42620 [0107.552] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\u8c4wCL.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\pp4pa7\\u8c4wcl.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0107.553] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=51235) returned 1 [0107.553] GetProcessHeap () returned 0xd20000 [0107.553] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bf08 [0107.553] GetProcessHeap () returned 0xd20000 [0107.553] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0107.553] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\u8c4wCL.mp4") returned 55 [0107.553] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0107.553] GetProcessHeap () returned 0xd20000 [0107.553] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0107.553] GetProcessHeap () returned 0xd20000 [0107.554] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x38d) returned 0xd4f0e0 [0107.554] lstrlenA (lpString="rsa_encrypt") returned 11 [0107.554] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0107.556] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0107.557] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0107.557] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0107.557] GetProcessHeap () returned 0xd20000 [0107.557] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0107.557] lstrlenA (lpString="010001") returned 6 [0107.557] GetProcessHeap () returned 0xd20000 [0107.557] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ce48 [0107.558] GetProcessHeap () returned 0xd20000 [0107.558] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0107.558] GetProcessHeap () returned 0xd20000 [0107.558] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b7e8 [0107.558] GetProcessHeap () returned 0xd20000 [0107.558] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0107.558] GetProcessHeap () returned 0xd20000 [0107.558] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aa68 [0107.558] GetProcessHeap () returned 0xd20000 [0107.558] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44c68 [0107.558] GetProcessHeap () returned 0xd20000 [0107.558] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cec8 [0107.558] GetProcessHeap () returned 0xd20000 [0107.558] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0107.558] GetProcessHeap () returned 0xd20000 [0107.558] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.559] GetProcessHeap () returned 0xd20000 [0107.559] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0107.559] GetProcessHeap () returned 0xd20000 [0107.559] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0107.559] GetProcessHeap () returned 0xd20000 [0107.559] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd45640 [0107.559] GetProcessHeap () returned 0xd20000 [0107.559] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.559] GetProcessHeap () returned 0xd20000 [0107.559] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446d8 [0107.559] GetProcessHeap () returned 0xd20000 [0107.559] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b128 [0107.559] GetProcessHeap () returned 0xd20000 [0107.559] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0107.559] GetProcessHeap () returned 0xd20000 [0107.559] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0107.559] GetProcessHeap () returned 0xd20000 [0107.559] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b128 | out: hHeap=0xd20000) returned 1 [0107.559] GetProcessHeap () returned 0xd20000 [0107.559] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.560] GetProcessHeap () returned 0xd20000 [0107.560] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44630 [0107.560] GetProcessHeap () returned 0xd20000 [0107.560] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.560] GetProcessHeap () returned 0xd20000 [0107.560] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.560] GetProcessHeap () returned 0xd20000 [0107.560] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.560] GetProcessHeap () returned 0xd20000 [0107.560] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.560] GetProcessHeap () returned 0xd20000 [0107.560] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.560] GetProcessHeap () returned 0xd20000 [0107.560] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.560] GetProcessHeap () returned 0xd20000 [0107.560] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b128 [0107.560] GetProcessHeap () returned 0xd20000 [0107.560] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44630 | out: hHeap=0xd20000) returned 1 [0107.560] GetProcessHeap () returned 0xd20000 [0107.560] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0107.560] GetProcessHeap () returned 0xd20000 [0107.561] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b128 | out: hHeap=0xd20000) returned 1 [0107.561] GetProcessHeap () returned 0xd20000 [0107.561] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.561] GetProcessHeap () returned 0xd20000 [0107.561] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.561] GetProcessHeap () returned 0xd20000 [0107.561] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.561] GetProcessHeap () returned 0xd20000 [0107.561] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.561] GetProcessHeap () returned 0xd20000 [0107.561] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.561] GetProcessHeap () returned 0xd20000 [0107.561] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.561] GetProcessHeap () returned 0xd20000 [0107.561] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.561] GetProcessHeap () returned 0xd20000 [0107.561] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.561] GetProcessHeap () returned 0xd20000 [0107.561] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.561] GetProcessHeap () returned 0xd20000 [0107.561] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.561] GetProcessHeap () returned 0xd20000 [0107.562] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.562] GetProcessHeap () returned 0xd20000 [0107.562] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.562] GetProcessHeap () returned 0xd20000 [0107.562] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.562] GetProcessHeap () returned 0xd20000 [0107.562] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.562] GetProcessHeap () returned 0xd20000 [0107.562] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.562] GetProcessHeap () returned 0xd20000 [0107.562] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.562] GetProcessHeap () returned 0xd20000 [0107.562] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.562] GetProcessHeap () returned 0xd20000 [0107.562] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.562] GetProcessHeap () returned 0xd20000 [0107.562] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.562] GetProcessHeap () returned 0xd20000 [0107.562] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.562] GetProcessHeap () returned 0xd20000 [0107.563] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.563] GetProcessHeap () returned 0xd20000 [0107.563] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.563] GetProcessHeap () returned 0xd20000 [0107.563] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.563] GetProcessHeap () returned 0xd20000 [0107.563] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.563] GetProcessHeap () returned 0xd20000 [0107.563] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.563] GetProcessHeap () returned 0xd20000 [0107.563] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.563] GetProcessHeap () returned 0xd20000 [0107.563] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.563] GetProcessHeap () returned 0xd20000 [0107.563] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.563] GetProcessHeap () returned 0xd20000 [0107.563] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.563] GetProcessHeap () returned 0xd20000 [0107.563] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.563] GetProcessHeap () returned 0xd20000 [0107.563] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.564] GetProcessHeap () returned 0xd20000 [0107.564] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.564] GetProcessHeap () returned 0xd20000 [0107.564] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.564] GetProcessHeap () returned 0xd20000 [0107.564] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.564] GetProcessHeap () returned 0xd20000 [0107.564] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.564] GetProcessHeap () returned 0xd20000 [0107.564] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.564] GetProcessHeap () returned 0xd20000 [0107.564] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.564] GetProcessHeap () returned 0xd20000 [0107.564] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.564] GetProcessHeap () returned 0xd20000 [0107.564] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0107.564] GetProcessHeap () returned 0xd20000 [0107.564] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0107.564] GetProcessHeap () returned 0xd20000 [0107.564] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.564] GetProcessHeap () returned 0xd20000 [0107.565] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.565] GetProcessHeap () returned 0xd20000 [0107.565] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.565] GetProcessHeap () returned 0xd20000 [0107.565] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.565] GetProcessHeap () returned 0xd20000 [0107.565] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.565] GetProcessHeap () returned 0xd20000 [0107.565] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.565] GetProcessHeap () returned 0xd20000 [0107.565] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.565] GetProcessHeap () returned 0xd20000 [0107.565] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.565] GetProcessHeap () returned 0xd20000 [0107.565] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.565] GetProcessHeap () returned 0xd20000 [0107.565] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.565] GetProcessHeap () returned 0xd20000 [0107.565] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.565] GetProcessHeap () returned 0xd20000 [0107.565] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.566] GetProcessHeap () returned 0xd20000 [0107.566] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.566] GetProcessHeap () returned 0xd20000 [0107.566] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.566] GetProcessHeap () returned 0xd20000 [0107.566] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.566] GetProcessHeap () returned 0xd20000 [0107.566] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.566] GetProcessHeap () returned 0xd20000 [0107.566] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.566] GetProcessHeap () returned 0xd20000 [0107.566] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.566] GetProcessHeap () returned 0xd20000 [0107.566] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.566] GetProcessHeap () returned 0xd20000 [0107.566] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.566] GetProcessHeap () returned 0xd20000 [0107.566] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.566] GetProcessHeap () returned 0xd20000 [0107.566] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.567] GetProcessHeap () returned 0xd20000 [0107.567] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.567] GetProcessHeap () returned 0xd20000 [0107.567] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.567] GetProcessHeap () returned 0xd20000 [0107.567] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.567] GetProcessHeap () returned 0xd20000 [0107.567] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.567] GetProcessHeap () returned 0xd20000 [0107.567] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.567] GetProcessHeap () returned 0xd20000 [0107.567] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.567] GetProcessHeap () returned 0xd20000 [0107.567] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.567] GetProcessHeap () returned 0xd20000 [0107.567] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.567] GetProcessHeap () returned 0xd20000 [0107.567] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.567] GetProcessHeap () returned 0xd20000 [0107.567] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.567] GetProcessHeap () returned 0xd20000 [0107.568] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.568] GetProcessHeap () returned 0xd20000 [0107.568] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.568] GetProcessHeap () returned 0xd20000 [0107.568] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.568] GetProcessHeap () returned 0xd20000 [0107.568] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.568] GetProcessHeap () returned 0xd20000 [0107.568] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.568] GetProcessHeap () returned 0xd20000 [0107.568] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.568] GetProcessHeap () returned 0xd20000 [0107.568] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.568] GetProcessHeap () returned 0xd20000 [0107.568] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.568] GetProcessHeap () returned 0xd20000 [0107.568] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.568] GetProcessHeap () returned 0xd20000 [0107.568] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.568] GetProcessHeap () returned 0xd20000 [0107.568] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.569] GetProcessHeap () returned 0xd20000 [0107.569] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.569] GetProcessHeap () returned 0xd20000 [0107.569] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.569] GetProcessHeap () returned 0xd20000 [0107.569] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.569] GetProcessHeap () returned 0xd20000 [0107.569] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.569] GetProcessHeap () returned 0xd20000 [0107.569] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.569] GetProcessHeap () returned 0xd20000 [0107.569] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.569] GetProcessHeap () returned 0xd20000 [0107.569] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.569] GetProcessHeap () returned 0xd20000 [0107.569] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.569] GetProcessHeap () returned 0xd20000 [0107.569] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.569] GetProcessHeap () returned 0xd20000 [0107.569] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.569] GetProcessHeap () returned 0xd20000 [0107.570] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.570] GetProcessHeap () returned 0xd20000 [0107.570] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.570] GetProcessHeap () returned 0xd20000 [0107.570] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.570] GetProcessHeap () returned 0xd20000 [0107.570] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.570] GetProcessHeap () returned 0xd20000 [0107.570] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.570] GetProcessHeap () returned 0xd20000 [0107.570] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.570] GetProcessHeap () returned 0xd20000 [0107.570] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.570] GetProcessHeap () returned 0xd20000 [0107.570] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.570] GetProcessHeap () returned 0xd20000 [0107.570] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.570] GetProcessHeap () returned 0xd20000 [0107.570] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.570] GetProcessHeap () returned 0xd20000 [0107.571] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.571] GetProcessHeap () returned 0xd20000 [0107.571] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0107.571] GetProcessHeap () returned 0xd20000 [0107.571] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0107.571] GetProcessHeap () returned 0xd20000 [0107.571] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.571] GetProcessHeap () returned 0xd20000 [0107.571] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.571] GetProcessHeap () returned 0xd20000 [0107.571] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.571] GetProcessHeap () returned 0xd20000 [0107.571] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.571] GetProcessHeap () returned 0xd20000 [0107.571] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.571] GetProcessHeap () returned 0xd20000 [0107.571] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.571] GetProcessHeap () returned 0xd20000 [0107.572] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.572] GetProcessHeap () returned 0xd20000 [0107.572] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.572] GetProcessHeap () returned 0xd20000 [0107.572] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.572] GetProcessHeap () returned 0xd20000 [0107.572] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.572] GetProcessHeap () returned 0xd20000 [0107.572] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.572] GetProcessHeap () returned 0xd20000 [0107.572] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.572] GetProcessHeap () returned 0xd20000 [0107.572] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.572] GetProcessHeap () returned 0xd20000 [0107.572] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.572] GetProcessHeap () returned 0xd20000 [0107.572] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.572] GetProcessHeap () returned 0xd20000 [0107.573] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.573] GetProcessHeap () returned 0xd20000 [0107.573] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.573] GetProcessHeap () returned 0xd20000 [0107.573] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.573] GetProcessHeap () returned 0xd20000 [0107.573] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.573] GetProcessHeap () returned 0xd20000 [0107.573] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.573] GetProcessHeap () returned 0xd20000 [0107.573] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.573] GetProcessHeap () returned 0xd20000 [0107.573] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.573] GetProcessHeap () returned 0xd20000 [0107.573] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.573] GetProcessHeap () returned 0xd20000 [0107.573] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.573] GetProcessHeap () returned 0xd20000 [0107.573] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.573] GetProcessHeap () returned 0xd20000 [0107.573] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.574] GetProcessHeap () returned 0xd20000 [0107.574] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.574] GetProcessHeap () returned 0xd20000 [0107.574] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.574] GetProcessHeap () returned 0xd20000 [0107.574] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.574] GetProcessHeap () returned 0xd20000 [0107.574] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.574] GetProcessHeap () returned 0xd20000 [0107.574] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0107.574] GetProcessHeap () returned 0xd20000 [0107.574] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0107.574] GetProcessHeap () returned 0xd20000 [0107.574] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.574] GetProcessHeap () returned 0xd20000 [0107.574] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.574] GetProcessHeap () returned 0xd20000 [0107.574] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.574] GetProcessHeap () returned 0xd20000 [0107.574] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.575] GetProcessHeap () returned 0xd20000 [0107.575] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.575] GetProcessHeap () returned 0xd20000 [0107.575] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.575] GetProcessHeap () returned 0xd20000 [0107.575] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.575] GetProcessHeap () returned 0xd20000 [0107.575] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.575] GetProcessHeap () returned 0xd20000 [0107.575] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.575] GetProcessHeap () returned 0xd20000 [0107.575] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.575] GetProcessHeap () returned 0xd20000 [0107.575] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.575] GetProcessHeap () returned 0xd20000 [0107.575] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.575] GetProcessHeap () returned 0xd20000 [0107.575] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.575] GetProcessHeap () returned 0xd20000 [0107.575] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.576] GetProcessHeap () returned 0xd20000 [0107.576] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.576] GetProcessHeap () returned 0xd20000 [0107.576] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.576] GetProcessHeap () returned 0xd20000 [0107.576] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.576] GetProcessHeap () returned 0xd20000 [0107.576] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.576] GetProcessHeap () returned 0xd20000 [0107.576] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.576] GetProcessHeap () returned 0xd20000 [0107.576] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.576] GetProcessHeap () returned 0xd20000 [0107.576] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0107.576] GetProcessHeap () returned 0xd20000 [0107.576] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0107.576] GetProcessHeap () returned 0xd20000 [0107.576] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.576] GetProcessHeap () returned 0xd20000 [0107.576] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.576] GetProcessHeap () returned 0xd20000 [0107.577] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.577] GetProcessHeap () returned 0xd20000 [0107.577] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.577] GetProcessHeap () returned 0xd20000 [0107.577] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.577] GetProcessHeap () returned 0xd20000 [0107.577] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.577] GetProcessHeap () returned 0xd20000 [0107.577] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.577] GetProcessHeap () returned 0xd20000 [0107.577] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.577] GetProcessHeap () returned 0xd20000 [0107.577] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.577] GetProcessHeap () returned 0xd20000 [0107.577] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.577] GetProcessHeap () returned 0xd20000 [0107.577] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0107.577] GetProcessHeap () returned 0xd20000 [0107.577] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0107.577] GetProcessHeap () returned 0xd20000 [0107.578] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0107.578] GetProcessHeap () returned 0xd20000 [0107.578] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0107.578] GetProcessHeap () returned 0xd20000 [0107.578] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446d8 | out: hHeap=0xd20000) returned 1 [0107.578] GetProcessHeap () returned 0xd20000 [0107.578] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aa68 | out: hHeap=0xd20000) returned 1 [0107.578] GetProcessHeap () returned 0xd20000 [0107.578] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0107.578] GetProcessHeap () returned 0xd20000 [0107.578] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0107.578] GetProcessHeap () returned 0xd20000 [0107.578] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0107.578] GetProcessHeap () returned 0xd20000 [0107.578] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.578] GetProcessHeap () returned 0xd20000 [0107.578] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0107.578] WriteFile (in: hFile=0x230, lpBuffer=0xd4f0e0*, nNumberOfBytesToWrite=0x38d, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f0e0*, lpNumberOfBytesWritten=0x299d864*=0x38d, lpOverlapped=0x0) returned 1 [0107.581] GetProcessHeap () returned 0xd20000 [0107.581] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4f0e0, Size=0x30) returned 0xd4f0e0 [0107.581] GetProcessHeap () returned 0xd20000 [0107.582] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0107.582] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0107.582] GetProcessHeap () returned 0xd20000 [0107.582] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc830) returned 0xd4f118 [0107.582] ReadFile (in: hFile=0x230, lpBuffer=0xd4f118, nNumberOfBytesToRead=0xc830, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4f118*, lpNumberOfBytesRead=0x299d7e8*=0xc830, lpOverlapped=0x0) returned 1 [0107.583] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0107.583] WriteFile (in: hFile=0x230, lpBuffer=0xd4f118*, nNumberOfBytesToWrite=0xc830, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4f118*, lpNumberOfBytesWritten=0x299d7e4*=0xc830, lpOverlapped=0x0) returned 1 [0107.585] GetProcessHeap () returned 0xd20000 [0107.585] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4f118 | out: hHeap=0xd20000) returned 1 [0107.585] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0107.585] WriteFile (in: hFile=0x230, lpBuffer=0xd4f0e0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f0e0*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0107.586] CloseHandle (hObject=0x230) returned 1 [0107.593] GetProcessHeap () returned 0xd20000 [0107.593] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42620 | out: hHeap=0xd20000) returned 1 [0107.593] GetProcessHeap () returned 0xd20000 [0107.593] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bf08 | out: hHeap=0xd20000) returned 1 [0107.593] GetProcessHeap () returned 0xd20000 [0107.593] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0107.593] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\u8c4wCL.mp4" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\u8c4wCL.mp4") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\u8c4wCL.mp4" [0107.593] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\u8c4wCL.mp4", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\u8c4wCL.mp4.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\u8c4wCL.mp4.[ponce.lorena@aol.com]" [0107.593] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\u8c4wCL.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\pp4pa7\\u8c4wcl.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\u8c4wCL.mp4.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\pp4pa7\\u8c4wcl.mp4.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0107.594] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\u8c4wCL.mp4" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7") returned 1 [0107.594] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\") returned="" [0107.594] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\HOW_RECOVER.html" [0107.594] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fs-XkNXFe2_OG\\pp4Pa7\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\fs-xknxfe2_og\\pp4pa7\\how_recover.html")) returned 0x20 [0107.594] GetProcessHeap () returned 0xd20000 [0107.594] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444e0 | out: hHeap=0xd20000) returned 1 [0107.595] FindNextFileW (in: hFindFile=0xd48ca0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b0b9a0, ftCreationTime.dwHighDateTime=0x1d4ccb2, ftLastAccessTime.dwLowDateTime=0x5af2ca70, ftLastAccessTime.dwHighDateTime=0x1d4d0c6, ftLastWriteTime.dwLowDateTime=0x5af2ca70, ftLastWriteTime.dwHighDateTime=0x1d4d0c6, nFileSizeHigh=0x0, nFileSizeLow=0xc823, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="u8c4wCL.mp4", cAlternateFileName="")) returned 0 [0107.595] FindClose (in: hFindFile=0xd48ca0 | out: hFindFile=0xd48ca0) returned 1 [0107.595] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\") returned="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\" [0107.595] GetProcessHeap () returned 0xd20000 [0107.595] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd32260 | out: hHeap=0xd20000) returned 1 [0107.595] GetProcessHeap () returned 0xd20000 [0107.595] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0107.595] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\") returned 30 [0107.595] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\*") returned="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\*" [0107.595] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11848110, ftCreationTime.dwHighDateTime=0x1d4d447, ftLastAccessTime.dwLowDateTime=0x6b773200, ftLastAccessTime.dwHighDateTime=0x1d4d003, ftLastWriteTime.dwLowDateTime=0x6b773200, ftLastWriteTime.dwHighDateTime=0x1d4d003, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd49360 [0107.595] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0107.595] FindNextFileW (in: hFindFile=0xd49360, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11848110, ftCreationTime.dwHighDateTime=0x1d4d447, ftLastAccessTime.dwLowDateTime=0x6b773200, ftLastAccessTime.dwHighDateTime=0x1d4d003, ftLastWriteTime.dwLowDateTime=0x6b773200, ftLastWriteTime.dwHighDateTime=0x1d4d003, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.596] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0107.596] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0107.596] FindNextFileW (in: hFindFile=0xd49360, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7621d60, ftCreationTime.dwHighDateTime=0x1d4cc1c, ftLastAccessTime.dwLowDateTime=0x4381d9a0, ftLastAccessTime.dwHighDateTime=0x1d4ce17, ftLastWriteTime.dwLowDateTime=0x4381d9a0, ftLastWriteTime.dwHighDateTime=0x1d4ce17, nFileSizeHigh=0x0, nFileSizeLow=0x6c25, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="48ePaspYmmfLg.flv", cAlternateFileName="48EPAS~1.FLV")) returned 1 [0107.596] lstrcmpiW (lpString1="48ePaspYmmfLg.flv", lpString2=".") returned 1 [0107.596] lstrcmpiW (lpString1="48ePaspYmmfLg.flv", lpString2="..") returned 1 [0107.596] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\", lpString2="48ePaspYmmfLg.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\48ePaspYmmfLg.flv") returned="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\48ePaspYmmfLg.flv" [0107.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="48ePaspYmmfLg.flv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0107.596] GetProcessHeap () returned 0xd20000 [0107.596] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x12) returned 0xd36748 [0107.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="48ePaspYmmfLg.flv", cchWideChar=-1, lpMultiByteStr=0xd36748, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="48ePaspYmmfLg.flv", lpUsedDefaultChar=0x0) returned 18 [0107.596] lstrlenA (lpString="48ePaspYmmfLg.flv") returned 17 [0107.596] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0107.596] lstrlenA (lpString="48ePaspYmmfLg.flv") returned 17 [0107.596] lstrlenA (lpString=".dll") returned 4 [0107.596] lstrlenA (lpString=".dll") returned 4 [0107.596] lstrlenA (lpString="48ePaspYmmfLg.flv") returned 17 [0107.596] lstrcmpiA (lpString1=".flv", lpString2=".dll") returned 1 [0107.596] lstrlenA (lpString="48ePaspYmmfLg.flv") returned 17 [0107.596] lstrlenA (lpString=".ini") returned 4 [0107.597] lstrlenA (lpString=".ini") returned 4 [0107.597] lstrlenA (lpString="48ePaspYmmfLg.flv") returned 17 [0107.597] lstrcmpiA (lpString1=".flv", lpString2=".ini") returned -1 [0107.597] lstrlenA (lpString="48ePaspYmmfLg.flv") returned 17 [0107.597] lstrlenA (lpString=".inc") returned 4 [0107.597] lstrlenA (lpString=".inc") returned 4 [0107.597] lstrlenA (lpString="48ePaspYmmfLg.flv") returned 17 [0107.597] lstrcmpiA (lpString1=".flv", lpString2=".inc") returned -1 [0107.597] lstrcmpiW (lpString1="48ePaspYmmfLg.flv", lpString2="HOW_RECOVER.html") returned -1 [0107.597] lstrcmpiW (lpString1="48ePaspYmmfLg.flv", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0107.597] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0107.597] lstrcmpiW (lpString1="48ePaspYmmfLg.flv", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0107.597] GetProcessHeap () returned 0xd20000 [0107.597] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42490 [0107.597] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\48ePaspYmmfLg.flv" (normalized: "c:\\users\\fd1hvy\\videos\\fj8tjd\\48epaspymmflg.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0107.597] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=27685) returned 1 [0107.598] GetProcessHeap () returned 0xd20000 [0107.598] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4be90 [0107.598] GetProcessHeap () returned 0xd20000 [0107.598] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0107.598] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\48ePaspYmmfLg.flv") returned 47 [0107.598] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0107.598] GetProcessHeap () returned 0xd20000 [0107.598] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0107.598] GetProcessHeap () returned 0xd20000 [0107.598] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4f118 [0107.598] lstrlenA (lpString="rsa_encrypt") returned 11 [0107.598] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0107.600] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0107.600] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0107.600] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0107.600] GetProcessHeap () returned 0xd20000 [0107.600] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0107.601] lstrlenA (lpString="010001") returned 6 [0107.601] GetProcessHeap () returned 0xd20000 [0107.601] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cf18 [0107.601] GetProcessHeap () returned 0xd20000 [0107.601] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0107.601] GetProcessHeap () returned 0xd20000 [0107.601] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ad38 [0107.601] GetProcessHeap () returned 0xd20000 [0107.601] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0107.601] GetProcessHeap () returned 0xd20000 [0107.601] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b878 [0107.601] GetProcessHeap () returned 0xd20000 [0107.601] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45410 [0107.601] GetProcessHeap () returned 0xd20000 [0107.601] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ce78 [0107.601] GetProcessHeap () returned 0xd20000 [0107.601] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0107.601] GetProcessHeap () returned 0xd20000 [0107.601] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.601] GetProcessHeap () returned 0xd20000 [0107.602] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0107.602] GetProcessHeap () returned 0xd20000 [0107.602] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0107.602] GetProcessHeap () returned 0xd20000 [0107.602] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44920 [0107.602] GetProcessHeap () returned 0xd20000 [0107.602] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.602] GetProcessHeap () returned 0xd20000 [0107.602] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44570 [0107.602] GetProcessHeap () returned 0xd20000 [0107.602] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b3f8 [0107.602] GetProcessHeap () returned 0xd20000 [0107.602] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0107.602] GetProcessHeap () returned 0xd20000 [0107.602] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0107.602] GetProcessHeap () returned 0xd20000 [0107.602] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b3f8 | out: hHeap=0xd20000) returned 1 [0107.602] GetProcessHeap () returned 0xd20000 [0107.602] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.602] GetProcessHeap () returned 0xd20000 [0107.603] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44420 [0107.603] GetProcessHeap () returned 0xd20000 [0107.603] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.603] GetProcessHeap () returned 0xd20000 [0107.603] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.603] GetProcessHeap () returned 0xd20000 [0107.603] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.603] GetProcessHeap () returned 0xd20000 [0107.603] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.603] GetProcessHeap () returned 0xd20000 [0107.603] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.603] GetProcessHeap () returned 0xd20000 [0107.603] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.603] GetProcessHeap () returned 0xd20000 [0107.603] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b128 [0107.603] GetProcessHeap () returned 0xd20000 [0107.603] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44420 | out: hHeap=0xd20000) returned 1 [0107.604] GetProcessHeap () returned 0xd20000 [0107.604] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0107.604] GetProcessHeap () returned 0xd20000 [0107.604] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b128 | out: hHeap=0xd20000) returned 1 [0107.604] GetProcessHeap () returned 0xd20000 [0107.604] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.604] GetProcessHeap () returned 0xd20000 [0107.604] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.604] GetProcessHeap () returned 0xd20000 [0107.604] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.604] GetProcessHeap () returned 0xd20000 [0107.604] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.604] GetProcessHeap () returned 0xd20000 [0107.604] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.604] GetProcessHeap () returned 0xd20000 [0107.604] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.604] GetProcessHeap () returned 0xd20000 [0107.604] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.604] GetProcessHeap () returned 0xd20000 [0107.605] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.605] GetProcessHeap () returned 0xd20000 [0107.605] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.605] GetProcessHeap () returned 0xd20000 [0107.605] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.605] GetProcessHeap () returned 0xd20000 [0107.605] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.605] GetProcessHeap () returned 0xd20000 [0107.605] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.605] GetProcessHeap () returned 0xd20000 [0107.605] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.605] GetProcessHeap () returned 0xd20000 [0107.605] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.605] GetProcessHeap () returned 0xd20000 [0107.605] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0107.605] GetProcessHeap () returned 0xd20000 [0107.605] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0107.605] GetProcessHeap () returned 0xd20000 [0107.605] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.606] GetProcessHeap () returned 0xd20000 [0107.606] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.606] GetProcessHeap () returned 0xd20000 [0107.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.606] GetProcessHeap () returned 0xd20000 [0107.606] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.606] GetProcessHeap () returned 0xd20000 [0107.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.606] GetProcessHeap () returned 0xd20000 [0107.606] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.606] GetProcessHeap () returned 0xd20000 [0107.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.606] GetProcessHeap () returned 0xd20000 [0107.606] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.606] GetProcessHeap () returned 0xd20000 [0107.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.606] GetProcessHeap () returned 0xd20000 [0107.606] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.606] GetProcessHeap () returned 0xd20000 [0107.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.607] GetProcessHeap () returned 0xd20000 [0107.607] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.607] GetProcessHeap () returned 0xd20000 [0107.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.607] GetProcessHeap () returned 0xd20000 [0107.607] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.607] GetProcessHeap () returned 0xd20000 [0107.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.607] GetProcessHeap () returned 0xd20000 [0107.607] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.607] GetProcessHeap () returned 0xd20000 [0107.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.607] GetProcessHeap () returned 0xd20000 [0107.607] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.607] GetProcessHeap () returned 0xd20000 [0107.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.607] GetProcessHeap () returned 0xd20000 [0107.607] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.608] GetProcessHeap () returned 0xd20000 [0107.608] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.608] GetProcessHeap () returned 0xd20000 [0107.608] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.608] GetProcessHeap () returned 0xd20000 [0107.608] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.608] GetProcessHeap () returned 0xd20000 [0107.608] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.608] GetProcessHeap () returned 0xd20000 [0107.608] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.608] GetProcessHeap () returned 0xd20000 [0107.608] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.608] GetProcessHeap () returned 0xd20000 [0107.608] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.608] GetProcessHeap () returned 0xd20000 [0107.608] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.608] GetProcessHeap () returned 0xd20000 [0107.608] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.608] GetProcessHeap () returned 0xd20000 [0107.608] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.609] GetProcessHeap () returned 0xd20000 [0107.609] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0107.609] GetProcessHeap () returned 0xd20000 [0107.609] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0107.609] GetProcessHeap () returned 0xd20000 [0107.609] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.609] GetProcessHeap () returned 0xd20000 [0107.609] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.609] GetProcessHeap () returned 0xd20000 [0107.609] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.609] GetProcessHeap () returned 0xd20000 [0107.609] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.609] GetProcessHeap () returned 0xd20000 [0107.609] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.609] GetProcessHeap () returned 0xd20000 [0107.609] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.609] GetProcessHeap () returned 0xd20000 [0107.609] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.610] GetProcessHeap () returned 0xd20000 [0107.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.610] GetProcessHeap () returned 0xd20000 [0107.610] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0107.610] GetProcessHeap () returned 0xd20000 [0107.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0107.610] GetProcessHeap () returned 0xd20000 [0107.610] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.610] GetProcessHeap () returned 0xd20000 [0107.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.610] GetProcessHeap () returned 0xd20000 [0107.610] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.610] GetProcessHeap () returned 0xd20000 [0107.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.610] GetProcessHeap () returned 0xd20000 [0107.610] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0107.610] GetProcessHeap () returned 0xd20000 [0107.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0107.610] GetProcessHeap () returned 0xd20000 [0107.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.611] GetProcessHeap () returned 0xd20000 [0107.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.611] GetProcessHeap () returned 0xd20000 [0107.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.611] GetProcessHeap () returned 0xd20000 [0107.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.611] GetProcessHeap () returned 0xd20000 [0107.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.611] GetProcessHeap () returned 0xd20000 [0107.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.611] GetProcessHeap () returned 0xd20000 [0107.612] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.612] GetProcessHeap () returned 0xd20000 [0107.612] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.612] GetProcessHeap () returned 0xd20000 [0107.612] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.612] GetProcessHeap () returned 0xd20000 [0107.612] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.612] GetProcessHeap () returned 0xd20000 [0107.612] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.612] GetProcessHeap () returned 0xd20000 [0107.612] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.612] GetProcessHeap () returned 0xd20000 [0107.612] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.612] GetProcessHeap () returned 0xd20000 [0107.612] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.612] GetProcessHeap () returned 0xd20000 [0107.612] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.612] GetProcessHeap () returned 0xd20000 [0107.612] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.613] GetProcessHeap () returned 0xd20000 [0107.613] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0107.613] GetProcessHeap () returned 0xd20000 [0107.613] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0107.613] GetProcessHeap () returned 0xd20000 [0107.613] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.613] GetProcessHeap () returned 0xd20000 [0107.613] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.613] GetProcessHeap () returned 0xd20000 [0107.613] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.613] GetProcessHeap () returned 0xd20000 [0107.613] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.613] GetProcessHeap () returned 0xd20000 [0107.613] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.613] GetProcessHeap () returned 0xd20000 [0107.613] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.613] GetProcessHeap () returned 0xd20000 [0107.613] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.613] GetProcessHeap () returned 0xd20000 [0107.613] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.613] GetProcessHeap () returned 0xd20000 [0107.613] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.614] GetProcessHeap () returned 0xd20000 [0107.614] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.614] GetProcessHeap () returned 0xd20000 [0107.614] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0107.614] GetProcessHeap () returned 0xd20000 [0107.614] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0107.614] GetProcessHeap () returned 0xd20000 [0107.614] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.614] GetProcessHeap () returned 0xd20000 [0107.614] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.614] GetProcessHeap () returned 0xd20000 [0107.614] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0107.614] GetProcessHeap () returned 0xd20000 [0107.615] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0107.615] GetProcessHeap () returned 0xd20000 [0107.615] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.615] GetProcessHeap () returned 0xd20000 [0107.615] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.615] GetProcessHeap () returned 0xd20000 [0107.615] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.615] GetProcessHeap () returned 0xd20000 [0107.615] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.615] GetProcessHeap () returned 0xd20000 [0107.615] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.615] GetProcessHeap () returned 0xd20000 [0107.615] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.615] GetProcessHeap () returned 0xd20000 [0107.615] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.615] GetProcessHeap () returned 0xd20000 [0107.615] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.615] GetProcessHeap () returned 0xd20000 [0107.615] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.616] GetProcessHeap () returned 0xd20000 [0107.616] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.616] GetProcessHeap () returned 0xd20000 [0107.616] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.616] GetProcessHeap () returned 0xd20000 [0107.616] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.616] GetProcessHeap () returned 0xd20000 [0107.616] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0107.616] GetProcessHeap () returned 0xd20000 [0107.616] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0107.616] GetProcessHeap () returned 0xd20000 [0107.616] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.616] GetProcessHeap () returned 0xd20000 [0107.616] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.616] GetProcessHeap () returned 0xd20000 [0107.616] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.616] GetProcessHeap () returned 0xd20000 [0107.616] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.616] GetProcessHeap () returned 0xd20000 [0107.616] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.616] GetProcessHeap () returned 0xd20000 [0107.617] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.617] GetProcessHeap () returned 0xd20000 [0107.617] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.617] GetProcessHeap () returned 0xd20000 [0107.617] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.617] GetProcessHeap () returned 0xd20000 [0107.617] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.617] GetProcessHeap () returned 0xd20000 [0107.617] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.617] GetProcessHeap () returned 0xd20000 [0107.617] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.617] GetProcessHeap () returned 0xd20000 [0107.617] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.617] GetProcessHeap () returned 0xd20000 [0107.617] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.617] GetProcessHeap () returned 0xd20000 [0107.617] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.617] GetProcessHeap () returned 0xd20000 [0107.617] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.617] GetProcessHeap () returned 0xd20000 [0107.618] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.618] GetProcessHeap () returned 0xd20000 [0107.618] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.618] GetProcessHeap () returned 0xd20000 [0107.618] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.618] GetProcessHeap () returned 0xd20000 [0107.618] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.618] GetProcessHeap () returned 0xd20000 [0107.618] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.618] GetProcessHeap () returned 0xd20000 [0107.618] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.618] GetProcessHeap () returned 0xd20000 [0107.618] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.618] GetProcessHeap () returned 0xd20000 [0107.618] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.618] GetProcessHeap () returned 0xd20000 [0107.618] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.618] GetProcessHeap () returned 0xd20000 [0107.618] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.618] GetProcessHeap () returned 0xd20000 [0107.619] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.619] GetProcessHeap () returned 0xd20000 [0107.619] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.619] GetProcessHeap () returned 0xd20000 [0107.619] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.619] GetProcessHeap () returned 0xd20000 [0107.619] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.620] GetProcessHeap () returned 0xd20000 [0107.620] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.620] GetProcessHeap () returned 0xd20000 [0107.620] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.620] GetProcessHeap () returned 0xd20000 [0107.620] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.620] GetProcessHeap () returned 0xd20000 [0107.620] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.620] GetProcessHeap () returned 0xd20000 [0107.621] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.621] GetProcessHeap () returned 0xd20000 [0107.621] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0107.621] GetProcessHeap () returned 0xd20000 [0107.621] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0107.621] GetProcessHeap () returned 0xd20000 [0107.621] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.621] GetProcessHeap () returned 0xd20000 [0107.621] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.621] GetProcessHeap () returned 0xd20000 [0107.621] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.621] GetProcessHeap () returned 0xd20000 [0107.621] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.621] GetProcessHeap () returned 0xd20000 [0107.621] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.621] GetProcessHeap () returned 0xd20000 [0107.621] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.621] GetProcessHeap () returned 0xd20000 [0107.621] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.621] GetProcessHeap () returned 0xd20000 [0107.621] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.621] GetProcessHeap () returned 0xd20000 [0107.622] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.622] GetProcessHeap () returned 0xd20000 [0107.622] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.622] GetProcessHeap () returned 0xd20000 [0107.622] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.622] GetProcessHeap () returned 0xd20000 [0107.622] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.622] GetProcessHeap () returned 0xd20000 [0107.622] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.622] GetProcessHeap () returned 0xd20000 [0107.622] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.622] GetProcessHeap () returned 0xd20000 [0107.622] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.622] GetProcessHeap () returned 0xd20000 [0107.622] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.622] GetProcessHeap () returned 0xd20000 [0107.622] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.622] GetProcessHeap () returned 0xd20000 [0107.622] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.622] GetProcessHeap () returned 0xd20000 [0107.623] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0107.623] GetProcessHeap () returned 0xd20000 [0107.623] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0107.623] GetProcessHeap () returned 0xd20000 [0107.623] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.623] GetProcessHeap () returned 0xd20000 [0107.623] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.623] GetProcessHeap () returned 0xd20000 [0107.623] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0107.623] GetProcessHeap () returned 0xd20000 [0107.623] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0107.623] GetProcessHeap () returned 0xd20000 [0107.623] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0107.623] GetProcessHeap () returned 0xd20000 [0107.623] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0107.623] GetProcessHeap () returned 0xd20000 [0107.623] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44570 | out: hHeap=0xd20000) returned 1 [0107.623] GetProcessHeap () returned 0xd20000 [0107.624] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b878 | out: hHeap=0xd20000) returned 1 [0107.624] GetProcessHeap () returned 0xd20000 [0107.624] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0107.624] GetProcessHeap () returned 0xd20000 [0107.624] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ad38 | out: hHeap=0xd20000) returned 1 [0107.624] GetProcessHeap () returned 0xd20000 [0107.624] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0107.624] GetProcessHeap () returned 0xd20000 [0107.624] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.624] GetProcessHeap () returned 0xd20000 [0107.624] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0107.624] WriteFile (in: hFile=0x230, lpBuffer=0xd4f118*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f118*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0107.640] GetProcessHeap () returned 0xd20000 [0107.640] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4f118, Size=0x30) returned 0xd4f118 [0107.640] GetProcessHeap () returned 0xd20000 [0107.640] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0107.640] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0107.640] GetProcessHeap () returned 0xd20000 [0107.640] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x6c25) returned 0xd4f150 [0107.640] ReadFile (in: hFile=0x230, lpBuffer=0xd4f150, nNumberOfBytesToRead=0x6c25, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4f150*, lpNumberOfBytesRead=0x299d7e8*=0x6c25, lpOverlapped=0x0) returned 1 [0107.641] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0107.641] WriteFile (in: hFile=0x230, lpBuffer=0xd4f150*, nNumberOfBytesToWrite=0x6c25, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4f150*, lpNumberOfBytesWritten=0x299d7e4*=0x6c25, lpOverlapped=0x0) returned 1 [0107.646] GetProcessHeap () returned 0xd20000 [0107.646] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4f150 | out: hHeap=0xd20000) returned 1 [0107.646] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0107.646] WriteFile (in: hFile=0x230, lpBuffer=0xd4f118*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f118*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0107.651] CloseHandle (hObject=0x230) returned 1 [0107.657] GetProcessHeap () returned 0xd20000 [0107.657] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42490 | out: hHeap=0xd20000) returned 1 [0107.657] GetProcessHeap () returned 0xd20000 [0107.657] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4be90 | out: hHeap=0xd20000) returned 1 [0107.657] GetProcessHeap () returned 0xd20000 [0107.657] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0107.657] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\48ePaspYmmfLg.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\48ePaspYmmfLg.flv") returned="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\48ePaspYmmfLg.flv" [0107.657] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\48ePaspYmmfLg.flv", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\48ePaspYmmfLg.flv.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\48ePaspYmmfLg.flv.[ponce.lorena@aol.com]" [0107.657] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\48ePaspYmmfLg.flv" (normalized: "c:\\users\\fd1hvy\\videos\\fj8tjd\\48epaspymmflg.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\48ePaspYmmfLg.flv.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\videos\\fj8tjd\\48epaspymmflg.flv.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0107.658] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\48ePaspYmmfLg.flv" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fj8TJD") returned 1 [0107.658] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fj8TJD" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\") returned="" [0107.658] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\HOW_RECOVER.html" [0107.658] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\fj8tjd\\how_recover.html")) returned 0xffffffff [0107.659] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\fj8tjd\\how_recover.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0107.660] GetProcessHeap () returned 0xd20000 [0107.660] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bf08 [0107.660] GetProcessHeap () returned 0xd20000 [0107.660] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0107.669] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.671] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.671] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.672] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.672] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.672] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.672] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.672] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.672] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.672] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.673] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.673] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.673] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.673] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.673] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.673] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.673] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.674] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.674] GetProcessHeap () returned 0xd20000 [0107.674] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bf08 | out: hHeap=0xd20000) returned 1 [0107.674] GetProcessHeap () returned 0xd20000 [0107.674] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0107.674] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x299d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x299d9d0*=0x300, lpOverlapped=0x0) returned 1 [0107.675] GetProcessHeap () returned 0xd20000 [0107.675] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bf80 [0107.675] GetProcessHeap () returned 0xd20000 [0107.675] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0107.685] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.685] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.686] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.686] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.686] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.686] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.686] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.686] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.686] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.686] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.687] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.687] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.687] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.687] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.687] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.687] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.687] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.687] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.687] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.688] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.688] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.688] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.688] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.688] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.688] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.688] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.688] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.688] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.689] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.689] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.689] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.689] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.689] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.689] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.689] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.689] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.690] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.690] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.690] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.690] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.690] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.690] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.690] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.690] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.691] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.691] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.691] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.691] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.691] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.691] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.691] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.692] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.692] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.692] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.692] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.692] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.692] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.692] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.692] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.693] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.693] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.693] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.693] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.693] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.693] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.694] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.694] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.694] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.694] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.716] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.716] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.716] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.716] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.716] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.716] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.716] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.716] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.717] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.717] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.717] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.717] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.717] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.717] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.717] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.717] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.718] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.718] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.718] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.718] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.718] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.718] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.718] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.718] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.718] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.719] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.719] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.719] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.719] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.719] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.719] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.719] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.719] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.719] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.720] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.720] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.720] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.720] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.720] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.720] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.720] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.720] GetProcessHeap () returned 0xd20000 [0107.720] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bf80 | out: hHeap=0xd20000) returned 1 [0107.720] GetProcessHeap () returned 0xd20000 [0107.720] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0107.721] CloseHandle (hObject=0x230) returned 1 [0107.721] GetProcessHeap () returned 0xd20000 [0107.721] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36748 | out: hHeap=0xd20000) returned 1 [0107.721] FindNextFileW (in: hFindFile=0xd49360, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2ed62a0, ftCreationTime.dwHighDateTime=0x1d4d401, ftLastAccessTime.dwLowDateTime=0xda4998a0, ftLastAccessTime.dwHighDateTime=0x1d4d2ef, ftLastWriteTime.dwLowDateTime=0xda4998a0, ftLastWriteTime.dwHighDateTime=0x1d4d2ef, nFileSizeHigh=0x0, nFileSizeLow=0x6243, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EWUuzmNU7w6qdw.swf", cAlternateFileName="EWUUZM~1.SWF")) returned 1 [0107.722] lstrcmpiW (lpString1="EWUuzmNU7w6qdw.swf", lpString2=".") returned 1 [0107.722] lstrcmpiW (lpString1="EWUuzmNU7w6qdw.swf", lpString2="..") returned 1 [0107.722] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\", lpString2="EWUuzmNU7w6qdw.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\EWUuzmNU7w6qdw.swf") returned="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\EWUuzmNU7w6qdw.swf" [0107.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EWUuzmNU7w6qdw.swf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0107.722] GetProcessHeap () returned 0xd20000 [0107.722] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x13) returned 0xd36588 [0107.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EWUuzmNU7w6qdw.swf", cchWideChar=-1, lpMultiByteStr=0xd36588, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EWUuzmNU7w6qdw.swf", lpUsedDefaultChar=0x0) returned 19 [0107.722] lstrlenA (lpString="EWUuzmNU7w6qdw.swf") returned 18 [0107.722] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0107.722] lstrlenA (lpString="EWUuzmNU7w6qdw.swf") returned 18 [0107.722] lstrlenA (lpString=".dll") returned 4 [0107.722] lstrlenA (lpString=".dll") returned 4 [0107.722] lstrlenA (lpString="EWUuzmNU7w6qdw.swf") returned 18 [0107.722] lstrcmpiA (lpString1=".swf", lpString2=".dll") returned 1 [0107.722] lstrlenA (lpString="EWUuzmNU7w6qdw.swf") returned 18 [0107.722] lstrlenA (lpString=".ini") returned 4 [0107.722] lstrlenA (lpString=".ini") returned 4 [0107.723] lstrlenA (lpString="EWUuzmNU7w6qdw.swf") returned 18 [0107.723] lstrcmpiA (lpString1=".swf", lpString2=".ini") returned 1 [0107.723] lstrlenA (lpString="EWUuzmNU7w6qdw.swf") returned 18 [0107.723] lstrlenA (lpString=".inc") returned 4 [0107.723] lstrlenA (lpString=".inc") returned 4 [0107.723] lstrlenA (lpString="EWUuzmNU7w6qdw.swf") returned 18 [0107.723] lstrcmpiA (lpString1=".swf", lpString2=".inc") returned 1 [0107.723] lstrcmpiW (lpString1="EWUuzmNU7w6qdw.swf", lpString2="HOW_RECOVER.html") returned -1 [0107.723] lstrcmpiW (lpString1="EWUuzmNU7w6qdw.swf", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0107.723] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0107.723] lstrcmpiW (lpString1="EWUuzmNU7w6qdw.swf", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0107.723] GetProcessHeap () returned 0xd20000 [0107.723] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd428a0 [0107.723] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\EWUuzmNU7w6qdw.swf" (normalized: "c:\\users\\fd1hvy\\videos\\fj8tjd\\ewuuzmnu7w6qdw.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0107.723] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=25155) returned 1 [0107.724] GetProcessHeap () returned 0xd20000 [0107.724] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bb48 [0107.724] GetProcessHeap () returned 0xd20000 [0107.724] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0107.724] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\EWUuzmNU7w6qdw.swf") returned 48 [0107.724] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0107.724] GetProcessHeap () returned 0xd20000 [0107.724] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0107.724] GetProcessHeap () returned 0xd20000 [0107.724] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4f150 [0107.724] lstrlenA (lpString="rsa_encrypt") returned 11 [0107.724] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0107.726] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0107.726] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0107.726] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0107.726] GetProcessHeap () returned 0xd20000 [0107.726] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0107.726] lstrlenA (lpString="010001") returned 6 [0107.726] GetProcessHeap () returned 0xd20000 [0107.726] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cf88 [0107.727] GetProcessHeap () returned 0xd20000 [0107.727] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0107.727] GetProcessHeap () returned 0xd20000 [0107.727] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b128 [0107.727] GetProcessHeap () returned 0xd20000 [0107.727] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0107.727] GetProcessHeap () returned 0xd20000 [0107.727] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b1b8 [0107.727] GetProcessHeap () returned 0xd20000 [0107.727] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44fb0 [0107.727] GetProcessHeap () returned 0xd20000 [0107.727] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ce48 [0107.727] GetProcessHeap () returned 0xd20000 [0107.727] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0107.727] GetProcessHeap () returned 0xd20000 [0107.727] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.727] GetProcessHeap () returned 0xd20000 [0107.727] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44c68 [0107.727] GetProcessHeap () returned 0xd20000 [0107.727] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0107.727] GetProcessHeap () returned 0xd20000 [0107.727] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd451e0 [0107.727] GetProcessHeap () returned 0xd20000 [0107.727] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.728] GetProcessHeap () returned 0xd20000 [0107.728] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44528 [0107.728] GetProcessHeap () returned 0xd20000 [0107.728] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b2d8 [0107.728] GetProcessHeap () returned 0xd20000 [0107.728] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0107.728] GetProcessHeap () returned 0xd20000 [0107.728] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0107.728] GetProcessHeap () returned 0xd20000 [0107.728] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b2d8 | out: hHeap=0xd20000) returned 1 [0107.728] GetProcessHeap () returned 0xd20000 [0107.728] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.728] GetProcessHeap () returned 0xd20000 [0107.728] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444c8 [0107.728] GetProcessHeap () returned 0xd20000 [0107.728] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.729] GetProcessHeap () returned 0xd20000 [0107.729] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.729] GetProcessHeap () returned 0xd20000 [0107.729] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.729] GetProcessHeap () returned 0xd20000 [0107.729] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.729] GetProcessHeap () returned 0xd20000 [0107.729] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.729] GetProcessHeap () returned 0xd20000 [0107.729] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.729] GetProcessHeap () returned 0xd20000 [0107.730] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4a9d8 [0107.730] GetProcessHeap () returned 0xd20000 [0107.730] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444c8 | out: hHeap=0xd20000) returned 1 [0107.730] GetProcessHeap () returned 0xd20000 [0107.730] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0107.730] GetProcessHeap () returned 0xd20000 [0107.730] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a9d8 | out: hHeap=0xd20000) returned 1 [0107.730] GetProcessHeap () returned 0xd20000 [0107.730] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.730] GetProcessHeap () returned 0xd20000 [0107.730] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.730] GetProcessHeap () returned 0xd20000 [0107.730] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.730] GetProcessHeap () returned 0xd20000 [0107.730] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.730] GetProcessHeap () returned 0xd20000 [0107.731] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.731] GetProcessHeap () returned 0xd20000 [0107.731] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.731] GetProcessHeap () returned 0xd20000 [0107.731] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.731] GetProcessHeap () returned 0xd20000 [0107.731] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.731] GetProcessHeap () returned 0xd20000 [0107.731] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.731] GetProcessHeap () returned 0xd20000 [0107.731] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.731] GetProcessHeap () returned 0xd20000 [0107.731] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.731] GetProcessHeap () returned 0xd20000 [0107.731] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.732] GetProcessHeap () returned 0xd20000 [0107.732] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.732] GetProcessHeap () returned 0xd20000 [0107.732] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.732] GetProcessHeap () returned 0xd20000 [0107.732] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.732] GetProcessHeap () returned 0xd20000 [0107.732] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.732] GetProcessHeap () returned 0xd20000 [0107.732] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.732] GetProcessHeap () returned 0xd20000 [0107.732] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.732] GetProcessHeap () returned 0xd20000 [0107.732] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.732] GetProcessHeap () returned 0xd20000 [0107.732] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.733] GetProcessHeap () returned 0xd20000 [0107.733] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.733] GetProcessHeap () returned 0xd20000 [0107.733] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.733] GetProcessHeap () returned 0xd20000 [0107.733] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.733] GetProcessHeap () returned 0xd20000 [0107.733] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.733] GetProcessHeap () returned 0xd20000 [0107.733] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.733] GetProcessHeap () returned 0xd20000 [0107.733] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.733] GetProcessHeap () returned 0xd20000 [0107.733] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.733] GetProcessHeap () returned 0xd20000 [0107.733] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.733] GetProcessHeap () returned 0xd20000 [0107.734] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.734] GetProcessHeap () returned 0xd20000 [0107.734] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.734] GetProcessHeap () returned 0xd20000 [0107.734] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.734] GetProcessHeap () returned 0xd20000 [0107.734] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.734] GetProcessHeap () returned 0xd20000 [0107.734] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.734] GetProcessHeap () returned 0xd20000 [0107.734] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.734] GetProcessHeap () returned 0xd20000 [0107.734] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.734] GetProcessHeap () returned 0xd20000 [0107.734] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.735] GetProcessHeap () returned 0xd20000 [0107.735] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.735] GetProcessHeap () returned 0xd20000 [0107.735] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.735] GetProcessHeap () returned 0xd20000 [0107.735] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.735] GetProcessHeap () returned 0xd20000 [0107.735] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.735] GetProcessHeap () returned 0xd20000 [0107.735] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.735] GetProcessHeap () returned 0xd20000 [0107.735] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.735] GetProcessHeap () returned 0xd20000 [0107.735] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.735] GetProcessHeap () returned 0xd20000 [0107.735] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.736] GetProcessHeap () returned 0xd20000 [0107.736] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.736] GetProcessHeap () returned 0xd20000 [0107.736] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.736] GetProcessHeap () returned 0xd20000 [0107.736] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.736] GetProcessHeap () returned 0xd20000 [0107.736] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.736] GetProcessHeap () returned 0xd20000 [0107.736] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.736] GetProcessHeap () returned 0xd20000 [0107.736] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.736] GetProcessHeap () returned 0xd20000 [0107.736] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.736] GetProcessHeap () returned 0xd20000 [0107.736] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.737] GetProcessHeap () returned 0xd20000 [0107.737] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.737] GetProcessHeap () returned 0xd20000 [0107.737] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.737] GetProcessHeap () returned 0xd20000 [0107.737] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.737] GetProcessHeap () returned 0xd20000 [0107.737] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.737] GetProcessHeap () returned 0xd20000 [0107.737] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.737] GetProcessHeap () returned 0xd20000 [0107.737] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.737] GetProcessHeap () returned 0xd20000 [0107.737] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.737] GetProcessHeap () returned 0xd20000 [0107.737] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.738] GetProcessHeap () returned 0xd20000 [0107.738] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.738] GetProcessHeap () returned 0xd20000 [0107.738] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.738] GetProcessHeap () returned 0xd20000 [0107.738] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0107.738] GetProcessHeap () returned 0xd20000 [0107.738] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0107.738] GetProcessHeap () returned 0xd20000 [0107.738] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.738] GetProcessHeap () returned 0xd20000 [0107.738] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.738] GetProcessHeap () returned 0xd20000 [0107.738] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.738] GetProcessHeap () returned 0xd20000 [0107.738] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.739] GetProcessHeap () returned 0xd20000 [0107.739] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.739] GetProcessHeap () returned 0xd20000 [0107.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.739] GetProcessHeap () returned 0xd20000 [0107.739] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.739] GetProcessHeap () returned 0xd20000 [0107.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.739] GetProcessHeap () returned 0xd20000 [0107.739] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.739] GetProcessHeap () returned 0xd20000 [0107.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.739] GetProcessHeap () returned 0xd20000 [0107.739] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.739] GetProcessHeap () returned 0xd20000 [0107.740] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.740] GetProcessHeap () returned 0xd20000 [0107.740] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.740] GetProcessHeap () returned 0xd20000 [0107.740] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.740] GetProcessHeap () returned 0xd20000 [0107.740] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.740] GetProcessHeap () returned 0xd20000 [0107.740] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.740] GetProcessHeap () returned 0xd20000 [0107.740] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.740] GetProcessHeap () returned 0xd20000 [0107.740] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.740] GetProcessHeap () returned 0xd20000 [0107.740] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.741] GetProcessHeap () returned 0xd20000 [0107.741] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.741] GetProcessHeap () returned 0xd20000 [0107.741] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.741] GetProcessHeap () returned 0xd20000 [0107.741] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.741] GetProcessHeap () returned 0xd20000 [0107.741] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.741] GetProcessHeap () returned 0xd20000 [0107.741] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.741] GetProcessHeap () returned 0xd20000 [0107.741] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.741] GetProcessHeap () returned 0xd20000 [0107.741] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.741] GetProcessHeap () returned 0xd20000 [0107.741] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.741] GetProcessHeap () returned 0xd20000 [0107.741] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.741] GetProcessHeap () returned 0xd20000 [0107.741] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.741] GetProcessHeap () returned 0xd20000 [0107.742] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.742] GetProcessHeap () returned 0xd20000 [0107.742] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0107.742] GetProcessHeap () returned 0xd20000 [0107.742] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0107.742] GetProcessHeap () returned 0xd20000 [0107.742] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.742] GetProcessHeap () returned 0xd20000 [0107.742] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.742] GetProcessHeap () returned 0xd20000 [0107.742] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.742] GetProcessHeap () returned 0xd20000 [0107.742] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.742] GetProcessHeap () returned 0xd20000 [0107.742] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.742] GetProcessHeap () returned 0xd20000 [0107.742] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.742] GetProcessHeap () returned 0xd20000 [0107.742] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.742] GetProcessHeap () returned 0xd20000 [0107.742] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.743] GetProcessHeap () returned 0xd20000 [0107.743] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0107.743] GetProcessHeap () returned 0xd20000 [0107.743] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0107.743] GetProcessHeap () returned 0xd20000 [0107.743] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.743] GetProcessHeap () returned 0xd20000 [0107.743] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.743] GetProcessHeap () returned 0xd20000 [0107.743] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.743] GetProcessHeap () returned 0xd20000 [0107.743] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.743] GetProcessHeap () returned 0xd20000 [0107.743] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.743] GetProcessHeap () returned 0xd20000 [0107.743] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.743] GetProcessHeap () returned 0xd20000 [0107.743] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.743] GetProcessHeap () returned 0xd20000 [0107.743] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.743] GetProcessHeap () returned 0xd20000 [0107.744] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.744] GetProcessHeap () returned 0xd20000 [0107.744] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.744] GetProcessHeap () returned 0xd20000 [0107.744] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0107.744] GetProcessHeap () returned 0xd20000 [0107.744] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0107.744] GetProcessHeap () returned 0xd20000 [0107.744] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.745] GetProcessHeap () returned 0xd20000 [0107.745] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.745] GetProcessHeap () returned 0xd20000 [0107.745] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.745] GetProcessHeap () returned 0xd20000 [0107.745] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.745] GetProcessHeap () returned 0xd20000 [0107.745] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.745] GetProcessHeap () returned 0xd20000 [0107.745] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.745] GetProcessHeap () returned 0xd20000 [0107.745] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.745] GetProcessHeap () returned 0xd20000 [0107.745] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.745] GetProcessHeap () returned 0xd20000 [0107.745] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.745] GetProcessHeap () returned 0xd20000 [0107.745] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.745] GetProcessHeap () returned 0xd20000 [0107.745] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.745] GetProcessHeap () returned 0xd20000 [0107.746] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.746] GetProcessHeap () returned 0xd20000 [0107.746] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.746] GetProcessHeap () returned 0xd20000 [0107.746] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.746] GetProcessHeap () returned 0xd20000 [0107.746] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.746] GetProcessHeap () returned 0xd20000 [0107.746] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.746] GetProcessHeap () returned 0xd20000 [0107.746] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.746] GetProcessHeap () returned 0xd20000 [0107.746] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.746] GetProcessHeap () returned 0xd20000 [0107.746] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.746] GetProcessHeap () returned 0xd20000 [0107.746] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.746] GetProcessHeap () returned 0xd20000 [0107.746] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.746] GetProcessHeap () returned 0xd20000 [0107.746] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.746] GetProcessHeap () returned 0xd20000 [0107.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.747] GetProcessHeap () returned 0xd20000 [0107.747] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.747] GetProcessHeap () returned 0xd20000 [0107.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.747] GetProcessHeap () returned 0xd20000 [0107.747] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.747] GetProcessHeap () returned 0xd20000 [0107.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.747] GetProcessHeap () returned 0xd20000 [0107.747] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.747] GetProcessHeap () returned 0xd20000 [0107.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.747] GetProcessHeap () returned 0xd20000 [0107.747] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.747] GetProcessHeap () returned 0xd20000 [0107.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.747] GetProcessHeap () returned 0xd20000 [0107.747] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.747] GetProcessHeap () returned 0xd20000 [0107.747] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.748] GetProcessHeap () returned 0xd20000 [0107.748] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.748] GetProcessHeap () returned 0xd20000 [0107.748] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.748] GetProcessHeap () returned 0xd20000 [0107.748] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.748] GetProcessHeap () returned 0xd20000 [0107.748] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.748] GetProcessHeap () returned 0xd20000 [0107.748] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.748] GetProcessHeap () returned 0xd20000 [0107.748] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.748] GetProcessHeap () returned 0xd20000 [0107.748] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.748] GetProcessHeap () returned 0xd20000 [0107.748] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.748] GetProcessHeap () returned 0xd20000 [0107.748] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.748] GetProcessHeap () returned 0xd20000 [0107.748] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.748] GetProcessHeap () returned 0xd20000 [0107.748] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.749] GetProcessHeap () returned 0xd20000 [0107.749] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.749] GetProcessHeap () returned 0xd20000 [0107.749] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.749] GetProcessHeap () returned 0xd20000 [0107.749] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0107.749] GetProcessHeap () returned 0xd20000 [0107.749] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0107.749] GetProcessHeap () returned 0xd20000 [0107.749] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.749] GetProcessHeap () returned 0xd20000 [0107.749] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.749] GetProcessHeap () returned 0xd20000 [0107.749] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.749] GetProcessHeap () returned 0xd20000 [0107.749] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.749] GetProcessHeap () returned 0xd20000 [0107.749] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0107.749] GetProcessHeap () returned 0xd20000 [0107.749] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0107.749] GetProcessHeap () returned 0xd20000 [0107.749] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0107.749] GetProcessHeap () returned 0xd20000 [0107.749] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0107.750] GetProcessHeap () returned 0xd20000 [0107.750] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44528 | out: hHeap=0xd20000) returned 1 [0107.750] GetProcessHeap () returned 0xd20000 [0107.750] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b1b8 | out: hHeap=0xd20000) returned 1 [0107.750] GetProcessHeap () returned 0xd20000 [0107.750] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0107.750] GetProcessHeap () returned 0xd20000 [0107.750] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b128 | out: hHeap=0xd20000) returned 1 [0107.750] GetProcessHeap () returned 0xd20000 [0107.750] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0107.750] GetProcessHeap () returned 0xd20000 [0107.750] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.750] GetProcessHeap () returned 0xd20000 [0107.750] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0107.750] WriteFile (in: hFile=0x230, lpBuffer=0xd4f150*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f150*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0107.753] GetProcessHeap () returned 0xd20000 [0107.753] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4f150, Size=0x30) returned 0xd4f150 [0107.753] GetProcessHeap () returned 0xd20000 [0107.753] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0107.754] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0107.754] GetProcessHeap () returned 0xd20000 [0107.754] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x6243) returned 0xd4f188 [0107.754] ReadFile (in: hFile=0x230, lpBuffer=0xd4f188, nNumberOfBytesToRead=0x6243, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4f188*, lpNumberOfBytesRead=0x299d7e8*=0x6243, lpOverlapped=0x0) returned 1 [0107.754] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0107.755] WriteFile (in: hFile=0x230, lpBuffer=0xd4f188*, nNumberOfBytesToWrite=0x6243, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4f188*, lpNumberOfBytesWritten=0x299d7e4*=0x6243, lpOverlapped=0x0) returned 1 [0107.756] GetProcessHeap () returned 0xd20000 [0107.756] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4f188 | out: hHeap=0xd20000) returned 1 [0107.757] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0107.757] WriteFile (in: hFile=0x230, lpBuffer=0xd4f150*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f150*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0107.758] CloseHandle (hObject=0x230) returned 1 [0107.761] GetProcessHeap () returned 0xd20000 [0107.761] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd428a0 | out: hHeap=0xd20000) returned 1 [0107.761] GetProcessHeap () returned 0xd20000 [0107.761] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bb48 | out: hHeap=0xd20000) returned 1 [0107.761] GetProcessHeap () returned 0xd20000 [0107.761] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0107.761] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\EWUuzmNU7w6qdw.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\EWUuzmNU7w6qdw.swf") returned="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\EWUuzmNU7w6qdw.swf" [0107.761] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\EWUuzmNU7w6qdw.swf", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\EWUuzmNU7w6qdw.swf.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\EWUuzmNU7w6qdw.swf.[ponce.lorena@aol.com]" [0107.761] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\EWUuzmNU7w6qdw.swf" (normalized: "c:\\users\\fd1hvy\\videos\\fj8tjd\\ewuuzmnu7w6qdw.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\EWUuzmNU7w6qdw.swf.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\videos\\fj8tjd\\ewuuzmnu7w6qdw.swf.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0107.762] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\EWUuzmNU7w6qdw.swf" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fj8TJD") returned 1 [0107.762] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fj8TJD" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\") returned="" [0107.762] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\HOW_RECOVER.html" [0107.762] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\fj8tjd\\how_recover.html")) returned 0x20 [0107.762] GetProcessHeap () returned 0xd20000 [0107.762] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36588 | out: hHeap=0xd20000) returned 1 [0107.762] FindNextFileW (in: hFindFile=0xd49360, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f7d1d0, ftCreationTime.dwHighDateTime=0x1d4c9be, ftLastAccessTime.dwLowDateTime=0xeffdcf10, ftLastAccessTime.dwHighDateTime=0x1d4cd6b, ftLastWriteTime.dwLowDateTime=0xeffdcf10, ftLastWriteTime.dwHighDateTime=0x1d4cd6b, nFileSizeHigh=0x0, nFileSizeLow=0xbab5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lVqIswqi1o93jEFRh5.swf", cAlternateFileName="LVQISW~1.SWF")) returned 1 [0107.763] lstrcmpiW (lpString1="lVqIswqi1o93jEFRh5.swf", lpString2=".") returned 1 [0107.763] lstrcmpiW (lpString1="lVqIswqi1o93jEFRh5.swf", lpString2="..") returned 1 [0107.763] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\", lpString2="lVqIswqi1o93jEFRh5.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\lVqIswqi1o93jEFRh5.swf") returned="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\lVqIswqi1o93jEFRh5.swf" [0107.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lVqIswqi1o93jEFRh5.swf", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0107.763] GetProcessHeap () returned 0xd20000 [0107.763] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x17) returned 0xd36588 [0107.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="lVqIswqi1o93jEFRh5.swf", cchWideChar=-1, lpMultiByteStr=0xd36588, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lVqIswqi1o93jEFRh5.swf", lpUsedDefaultChar=0x0) returned 23 [0107.763] lstrlenA (lpString="lVqIswqi1o93jEFRh5.swf") returned 22 [0107.763] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0107.763] lstrlenA (lpString="lVqIswqi1o93jEFRh5.swf") returned 22 [0107.763] lstrlenA (lpString=".dll") returned 4 [0107.763] lstrlenA (lpString=".dll") returned 4 [0107.763] lstrlenA (lpString="lVqIswqi1o93jEFRh5.swf") returned 22 [0107.763] lstrcmpiA (lpString1=".swf", lpString2=".dll") returned 1 [0107.763] lstrlenA (lpString="lVqIswqi1o93jEFRh5.swf") returned 22 [0107.763] lstrlenA (lpString=".ini") returned 4 [0107.763] lstrlenA (lpString=".ini") returned 4 [0107.763] lstrlenA (lpString="lVqIswqi1o93jEFRh5.swf") returned 22 [0107.763] lstrcmpiA (lpString1=".swf", lpString2=".ini") returned 1 [0107.764] lstrlenA (lpString="lVqIswqi1o93jEFRh5.swf") returned 22 [0107.764] lstrlenA (lpString=".inc") returned 4 [0107.764] lstrlenA (lpString=".inc") returned 4 [0107.764] lstrlenA (lpString="lVqIswqi1o93jEFRh5.swf") returned 22 [0107.764] lstrcmpiA (lpString1=".swf", lpString2=".inc") returned 1 [0107.764] lstrcmpiW (lpString1="lVqIswqi1o93jEFRh5.swf", lpString2="HOW_RECOVER.html") returned 1 [0107.764] lstrcmpiW (lpString1="lVqIswqi1o93jEFRh5.swf", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0107.764] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0107.764] lstrcmpiW (lpString1="lVqIswqi1o93jEFRh5.swf", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0107.764] GetProcessHeap () returned 0xd20000 [0107.764] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42828 [0107.764] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\lVqIswqi1o93jEFRh5.swf" (normalized: "c:\\users\\fd1hvy\\videos\\fj8tjd\\lvqiswqi1o93jefrh5.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0107.764] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=47797) returned 1 [0107.764] GetProcessHeap () returned 0xd20000 [0107.764] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c1d8 [0107.764] GetProcessHeap () returned 0xd20000 [0107.765] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0107.765] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\lVqIswqi1o93jEFRh5.swf") returned 52 [0107.765] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0107.765] GetProcessHeap () returned 0xd20000 [0107.765] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0107.765] GetProcessHeap () returned 0xd20000 [0107.765] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4f188 [0107.765] lstrlenA (lpString="rsa_encrypt") returned 11 [0107.765] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0107.767] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0107.767] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0107.767] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0107.767] GetProcessHeap () returned 0xd20000 [0107.767] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0107.767] lstrlenA (lpString="010001") returned 6 [0107.767] GetProcessHeap () returned 0xd20000 [0107.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cf18 [0107.768] GetProcessHeap () returned 0xd20000 [0107.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0107.768] GetProcessHeap () returned 0xd20000 [0107.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aca8 [0107.768] GetProcessHeap () returned 0xd20000 [0107.768] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0107.768] GetProcessHeap () returned 0xd20000 [0107.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b128 [0107.768] GetProcessHeap () returned 0xd20000 [0107.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44b50 [0107.768] GetProcessHeap () returned 0xd20000 [0107.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ce48 [0107.768] GetProcessHeap () returned 0xd20000 [0107.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0107.768] GetProcessHeap () returned 0xd20000 [0107.768] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.768] GetProcessHeap () returned 0xd20000 [0107.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0107.768] GetProcessHeap () returned 0xd20000 [0107.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0107.769] GetProcessHeap () returned 0xd20000 [0107.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44fb0 [0107.769] GetProcessHeap () returned 0xd20000 [0107.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.769] GetProcessHeap () returned 0xd20000 [0107.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44540 [0107.769] GetProcessHeap () returned 0xd20000 [0107.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4af78 [0107.769] GetProcessHeap () returned 0xd20000 [0107.769] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0107.769] GetProcessHeap () returned 0xd20000 [0107.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0107.769] GetProcessHeap () returned 0xd20000 [0107.769] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4af78 | out: hHeap=0xd20000) returned 1 [0107.769] GetProcessHeap () returned 0xd20000 [0107.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.769] GetProcessHeap () returned 0xd20000 [0107.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446c0 [0107.769] GetProcessHeap () returned 0xd20000 [0107.769] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.770] GetProcessHeap () returned 0xd20000 [0107.770] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.770] GetProcessHeap () returned 0xd20000 [0107.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.770] GetProcessHeap () returned 0xd20000 [0107.770] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.770] GetProcessHeap () returned 0xd20000 [0107.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.770] GetProcessHeap () returned 0xd20000 [0107.770] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.770] GetProcessHeap () returned 0xd20000 [0107.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b6c8 [0107.770] GetProcessHeap () returned 0xd20000 [0107.770] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446c0 | out: hHeap=0xd20000) returned 1 [0107.770] GetProcessHeap () returned 0xd20000 [0107.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0107.770] GetProcessHeap () returned 0xd20000 [0107.770] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b6c8 | out: hHeap=0xd20000) returned 1 [0107.770] GetProcessHeap () returned 0xd20000 [0107.770] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.771] GetProcessHeap () returned 0xd20000 [0107.771] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.771] GetProcessHeap () returned 0xd20000 [0107.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.771] GetProcessHeap () returned 0xd20000 [0107.771] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.771] GetProcessHeap () returned 0xd20000 [0107.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.771] GetProcessHeap () returned 0xd20000 [0107.771] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.771] GetProcessHeap () returned 0xd20000 [0107.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.771] GetProcessHeap () returned 0xd20000 [0107.771] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.771] GetProcessHeap () returned 0xd20000 [0107.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0107.771] GetProcessHeap () returned 0xd20000 [0107.771] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0107.771] GetProcessHeap () returned 0xd20000 [0107.771] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.771] GetProcessHeap () returned 0xd20000 [0107.772] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.772] GetProcessHeap () returned 0xd20000 [0107.772] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.772] GetProcessHeap () returned 0xd20000 [0107.772] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.772] GetProcessHeap () returned 0xd20000 [0107.772] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.772] GetProcessHeap () returned 0xd20000 [0107.772] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.772] GetProcessHeap () returned 0xd20000 [0107.772] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.772] GetProcessHeap () returned 0xd20000 [0107.772] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.772] GetProcessHeap () returned 0xd20000 [0107.772] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0107.772] GetProcessHeap () returned 0xd20000 [0107.772] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0107.772] GetProcessHeap () returned 0xd20000 [0107.772] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.773] GetProcessHeap () returned 0xd20000 [0107.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.773] GetProcessHeap () returned 0xd20000 [0107.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.773] GetProcessHeap () returned 0xd20000 [0107.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.773] GetProcessHeap () returned 0xd20000 [0107.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0107.773] GetProcessHeap () returned 0xd20000 [0107.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0107.773] GetProcessHeap () returned 0xd20000 [0107.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.773] GetProcessHeap () returned 0xd20000 [0107.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.773] GetProcessHeap () returned 0xd20000 [0107.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.773] GetProcessHeap () returned 0xd20000 [0107.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.773] GetProcessHeap () returned 0xd20000 [0107.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.773] GetProcessHeap () returned 0xd20000 [0107.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.774] GetProcessHeap () returned 0xd20000 [0107.774] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.774] GetProcessHeap () returned 0xd20000 [0107.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.774] GetProcessHeap () returned 0xd20000 [0107.774] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.774] GetProcessHeap () returned 0xd20000 [0107.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.774] GetProcessHeap () returned 0xd20000 [0107.774] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.774] GetProcessHeap () returned 0xd20000 [0107.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.774] GetProcessHeap () returned 0xd20000 [0107.774] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.774] GetProcessHeap () returned 0xd20000 [0107.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.774] GetProcessHeap () returned 0xd20000 [0107.774] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.774] GetProcessHeap () returned 0xd20000 [0107.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.775] GetProcessHeap () returned 0xd20000 [0107.775] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0107.775] GetProcessHeap () returned 0xd20000 [0107.775] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0107.775] GetProcessHeap () returned 0xd20000 [0107.775] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.775] GetProcessHeap () returned 0xd20000 [0107.775] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.775] GetProcessHeap () returned 0xd20000 [0107.775] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.775] GetProcessHeap () returned 0xd20000 [0107.775] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.775] GetProcessHeap () returned 0xd20000 [0107.776] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.776] GetProcessHeap () returned 0xd20000 [0107.776] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.776] GetProcessHeap () returned 0xd20000 [0107.776] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.776] GetProcessHeap () returned 0xd20000 [0107.776] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.776] GetProcessHeap () returned 0xd20000 [0107.776] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.776] GetProcessHeap () returned 0xd20000 [0107.776] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.776] GetProcessHeap () returned 0xd20000 [0107.777] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0107.777] GetProcessHeap () returned 0xd20000 [0107.777] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0107.777] GetProcessHeap () returned 0xd20000 [0107.777] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.777] GetProcessHeap () returned 0xd20000 [0107.777] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.777] GetProcessHeap () returned 0xd20000 [0107.777] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0107.777] GetProcessHeap () returned 0xd20000 [0107.777] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0107.777] GetProcessHeap () returned 0xd20000 [0107.777] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.777] GetProcessHeap () returned 0xd20000 [0107.777] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.777] GetProcessHeap () returned 0xd20000 [0107.777] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.777] GetProcessHeap () returned 0xd20000 [0107.777] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.777] GetProcessHeap () returned 0xd20000 [0107.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.778] GetProcessHeap () returned 0xd20000 [0107.778] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.778] GetProcessHeap () returned 0xd20000 [0107.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.778] GetProcessHeap () returned 0xd20000 [0107.778] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.778] GetProcessHeap () returned 0xd20000 [0107.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.778] GetProcessHeap () returned 0xd20000 [0107.778] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.778] GetProcessHeap () returned 0xd20000 [0107.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.778] GetProcessHeap () returned 0xd20000 [0107.778] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.778] GetProcessHeap () returned 0xd20000 [0107.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0107.778] GetProcessHeap () returned 0xd20000 [0107.778] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0107.778] GetProcessHeap () returned 0xd20000 [0107.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.779] GetProcessHeap () returned 0xd20000 [0107.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.779] GetProcessHeap () returned 0xd20000 [0107.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.779] GetProcessHeap () returned 0xd20000 [0107.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.779] GetProcessHeap () returned 0xd20000 [0107.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.779] GetProcessHeap () returned 0xd20000 [0107.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.779] GetProcessHeap () returned 0xd20000 [0107.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.779] GetProcessHeap () returned 0xd20000 [0107.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.779] GetProcessHeap () returned 0xd20000 [0107.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.779] GetProcessHeap () returned 0xd20000 [0107.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.779] GetProcessHeap () returned 0xd20000 [0107.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.780] GetProcessHeap () returned 0xd20000 [0107.780] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.780] GetProcessHeap () returned 0xd20000 [0107.780] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.780] GetProcessHeap () returned 0xd20000 [0107.780] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.780] GetProcessHeap () returned 0xd20000 [0107.780] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.780] GetProcessHeap () returned 0xd20000 [0107.780] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.780] GetProcessHeap () returned 0xd20000 [0107.780] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.780] GetProcessHeap () returned 0xd20000 [0107.780] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.780] GetProcessHeap () returned 0xd20000 [0107.780] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.780] GetProcessHeap () returned 0xd20000 [0107.780] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.780] GetProcessHeap () returned 0xd20000 [0107.780] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.781] GetProcessHeap () returned 0xd20000 [0107.781] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.781] GetProcessHeap () returned 0xd20000 [0107.781] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.781] GetProcessHeap () returned 0xd20000 [0107.781] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.781] GetProcessHeap () returned 0xd20000 [0107.781] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.781] GetProcessHeap () returned 0xd20000 [0107.781] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.781] GetProcessHeap () returned 0xd20000 [0107.781] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.781] GetProcessHeap () returned 0xd20000 [0107.781] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.781] GetProcessHeap () returned 0xd20000 [0107.781] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.781] GetProcessHeap () returned 0xd20000 [0107.781] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.781] GetProcessHeap () returned 0xd20000 [0107.781] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.782] GetProcessHeap () returned 0xd20000 [0107.782] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.782] GetProcessHeap () returned 0xd20000 [0107.782] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.782] GetProcessHeap () returned 0xd20000 [0107.782] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.782] GetProcessHeap () returned 0xd20000 [0107.782] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0107.782] GetProcessHeap () returned 0xd20000 [0107.782] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0107.782] GetProcessHeap () returned 0xd20000 [0107.782] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.782] GetProcessHeap () returned 0xd20000 [0107.782] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.782] GetProcessHeap () returned 0xd20000 [0107.782] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.782] GetProcessHeap () returned 0xd20000 [0107.782] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.782] GetProcessHeap () returned 0xd20000 [0107.782] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.783] GetProcessHeap () returned 0xd20000 [0107.783] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.783] GetProcessHeap () returned 0xd20000 [0107.783] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.783] GetProcessHeap () returned 0xd20000 [0107.783] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.783] GetProcessHeap () returned 0xd20000 [0107.783] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.783] GetProcessHeap () returned 0xd20000 [0107.783] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.783] GetProcessHeap () returned 0xd20000 [0107.783] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.783] GetProcessHeap () returned 0xd20000 [0107.783] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.783] GetProcessHeap () returned 0xd20000 [0107.783] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.783] GetProcessHeap () returned 0xd20000 [0107.783] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.783] GetProcessHeap () returned 0xd20000 [0107.783] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.783] GetProcessHeap () returned 0xd20000 [0107.784] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.784] GetProcessHeap () returned 0xd20000 [0107.784] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.784] GetProcessHeap () returned 0xd20000 [0107.784] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.784] GetProcessHeap () returned 0xd20000 [0107.784] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0107.784] GetProcessHeap () returned 0xd20000 [0107.784] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0107.784] GetProcessHeap () returned 0xd20000 [0107.784] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.784] GetProcessHeap () returned 0xd20000 [0107.784] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.784] GetProcessHeap () returned 0xd20000 [0107.784] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.784] GetProcessHeap () returned 0xd20000 [0107.784] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.784] GetProcessHeap () returned 0xd20000 [0107.784] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0107.784] GetProcessHeap () returned 0xd20000 [0107.784] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0107.785] GetProcessHeap () returned 0xd20000 [0107.785] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.785] GetProcessHeap () returned 0xd20000 [0107.785] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.785] GetProcessHeap () returned 0xd20000 [0107.785] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.785] GetProcessHeap () returned 0xd20000 [0107.785] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.785] GetProcessHeap () returned 0xd20000 [0107.785] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0107.785] GetProcessHeap () returned 0xd20000 [0107.785] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0107.785] GetProcessHeap () returned 0xd20000 [0107.785] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.785] GetProcessHeap () returned 0xd20000 [0107.785] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.785] GetProcessHeap () returned 0xd20000 [0107.785] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.785] GetProcessHeap () returned 0xd20000 [0107.785] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.785] GetProcessHeap () returned 0xd20000 [0107.786] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.786] GetProcessHeap () returned 0xd20000 [0107.786] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.786] GetProcessHeap () returned 0xd20000 [0107.786] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.786] GetProcessHeap () returned 0xd20000 [0107.786] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.786] GetProcessHeap () returned 0xd20000 [0107.786] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.786] GetProcessHeap () returned 0xd20000 [0107.786] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.786] GetProcessHeap () returned 0xd20000 [0107.786] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.786] GetProcessHeap () returned 0xd20000 [0107.786] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.786] GetProcessHeap () returned 0xd20000 [0107.786] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.786] GetProcessHeap () returned 0xd20000 [0107.786] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.786] GetProcessHeap () returned 0xd20000 [0107.786] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.787] GetProcessHeap () returned 0xd20000 [0107.787] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.787] GetProcessHeap () returned 0xd20000 [0107.787] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.787] GetProcessHeap () returned 0xd20000 [0107.787] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.787] GetProcessHeap () returned 0xd20000 [0107.787] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.787] GetProcessHeap () returned 0xd20000 [0107.787] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.787] GetProcessHeap () returned 0xd20000 [0107.787] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.787] GetProcessHeap () returned 0xd20000 [0107.787] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.787] GetProcessHeap () returned 0xd20000 [0107.787] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.787] GetProcessHeap () returned 0xd20000 [0107.787] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.787] GetProcessHeap () returned 0xd20000 [0107.788] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.788] GetProcessHeap () returned 0xd20000 [0107.788] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.788] GetProcessHeap () returned 0xd20000 [0107.788] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.788] GetProcessHeap () returned 0xd20000 [0107.788] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.788] GetProcessHeap () returned 0xd20000 [0107.788] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0107.788] GetProcessHeap () returned 0xd20000 [0107.788] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0107.788] GetProcessHeap () returned 0xd20000 [0107.788] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0107.788] GetProcessHeap () returned 0xd20000 [0107.788] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0107.788] GetProcessHeap () returned 0xd20000 [0107.788] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44540 | out: hHeap=0xd20000) returned 1 [0107.788] GetProcessHeap () returned 0xd20000 [0107.788] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b128 | out: hHeap=0xd20000) returned 1 [0107.789] GetProcessHeap () returned 0xd20000 [0107.789] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0107.789] GetProcessHeap () returned 0xd20000 [0107.789] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aca8 | out: hHeap=0xd20000) returned 1 [0107.789] GetProcessHeap () returned 0xd20000 [0107.789] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0107.789] GetProcessHeap () returned 0xd20000 [0107.789] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.789] GetProcessHeap () returned 0xd20000 [0107.789] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0107.789] WriteFile (in: hFile=0x230, lpBuffer=0xd4f188*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f188*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0107.792] GetProcessHeap () returned 0xd20000 [0107.792] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4f188, Size=0x30) returned 0xd4f188 [0107.792] GetProcessHeap () returned 0xd20000 [0107.792] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0107.792] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0107.792] GetProcessHeap () returned 0xd20000 [0107.792] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xbab5) returned 0xd4f1c0 [0107.793] ReadFile (in: hFile=0x230, lpBuffer=0xd4f1c0, nNumberOfBytesToRead=0xbab5, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4f1c0*, lpNumberOfBytesRead=0x299d7e8*=0xbab5, lpOverlapped=0x0) returned 1 [0107.794] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0107.794] WriteFile (in: hFile=0x230, lpBuffer=0xd4f1c0*, nNumberOfBytesToWrite=0xbab5, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4f1c0*, lpNumberOfBytesWritten=0x299d7e4*=0xbab5, lpOverlapped=0x0) returned 1 [0107.796] GetProcessHeap () returned 0xd20000 [0107.796] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4f1c0 | out: hHeap=0xd20000) returned 1 [0107.796] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0107.796] WriteFile (in: hFile=0x230, lpBuffer=0xd4f188*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f188*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0107.797] CloseHandle (hObject=0x230) returned 1 [0107.801] GetProcessHeap () returned 0xd20000 [0107.801] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42828 | out: hHeap=0xd20000) returned 1 [0107.801] GetProcessHeap () returned 0xd20000 [0107.801] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c1d8 | out: hHeap=0xd20000) returned 1 [0107.801] GetProcessHeap () returned 0xd20000 [0107.801] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0107.801] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\lVqIswqi1o93jEFRh5.swf" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\lVqIswqi1o93jEFRh5.swf") returned="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\lVqIswqi1o93jEFRh5.swf" [0107.801] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\lVqIswqi1o93jEFRh5.swf", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\lVqIswqi1o93jEFRh5.swf.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\lVqIswqi1o93jEFRh5.swf.[ponce.lorena@aol.com]" [0107.801] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\lVqIswqi1o93jEFRh5.swf" (normalized: "c:\\users\\fd1hvy\\videos\\fj8tjd\\lvqiswqi1o93jefrh5.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\lVqIswqi1o93jEFRh5.swf.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\videos\\fj8tjd\\lvqiswqi1o93jefrh5.swf.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0107.802] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\lVqIswqi1o93jEFRh5.swf" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fj8TJD") returned 1 [0107.802] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fj8TJD" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\") returned="" [0107.802] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\HOW_RECOVER.html" [0107.802] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\fj8tjd\\how_recover.html")) returned 0x20 [0107.802] GetProcessHeap () returned 0xd20000 [0107.802] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36588 | out: hHeap=0xd20000) returned 1 [0107.802] FindNextFileW (in: hFindFile=0xd49360, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x777c4de0, ftCreationTime.dwHighDateTime=0x1d4c9ac, ftLastAccessTime.dwLowDateTime=0x7f7a7e0, ftLastAccessTime.dwHighDateTime=0x1d4cb9a, ftLastWriteTime.dwLowDateTime=0x7f7a7e0, ftLastWriteTime.dwHighDateTime=0x1d4cb9a, nFileSizeHigh=0x0, nFileSizeLow=0x14919, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="swYEe7.mkv", cAlternateFileName="")) returned 1 [0107.803] lstrcmpiW (lpString1="swYEe7.mkv", lpString2=".") returned 1 [0107.803] lstrcmpiW (lpString1="swYEe7.mkv", lpString2="..") returned 1 [0107.803] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\", lpString2="swYEe7.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\swYEe7.mkv") returned="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\swYEe7.mkv" [0107.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="swYEe7.mkv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0107.803] GetProcessHeap () returned 0xd20000 [0107.803] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xb) returned 0xd44588 [0107.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="swYEe7.mkv", cchWideChar=-1, lpMultiByteStr=0xd44588, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="swYEe7.mkv", lpUsedDefaultChar=0x0) returned 11 [0107.803] lstrlenA (lpString="swYEe7.mkv") returned 10 [0107.803] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0107.803] lstrlenA (lpString="swYEe7.mkv") returned 10 [0107.803] lstrlenA (lpString=".dll") returned 4 [0107.803] lstrlenA (lpString=".dll") returned 4 [0107.803] lstrlenA (lpString="swYEe7.mkv") returned 10 [0107.803] lstrcmpiA (lpString1=".mkv", lpString2=".dll") returned 1 [0107.803] lstrlenA (lpString="swYEe7.mkv") returned 10 [0107.803] lstrlenA (lpString=".ini") returned 4 [0107.803] lstrlenA (lpString=".ini") returned 4 [0107.803] lstrlenA (lpString="swYEe7.mkv") returned 10 [0107.803] lstrcmpiA (lpString1=".mkv", lpString2=".ini") returned 1 [0107.803] lstrlenA (lpString="swYEe7.mkv") returned 10 [0107.804] lstrlenA (lpString=".inc") returned 4 [0107.804] lstrlenA (lpString=".inc") returned 4 [0107.804] lstrlenA (lpString="swYEe7.mkv") returned 10 [0107.804] lstrcmpiA (lpString1=".mkv", lpString2=".inc") returned 1 [0107.804] lstrcmpiW (lpString1="swYEe7.mkv", lpString2="HOW_RECOVER.html") returned 1 [0107.804] lstrcmpiW (lpString1="swYEe7.mkv", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0107.804] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0107.804] lstrcmpiW (lpString1="swYEe7.mkv", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0107.804] GetProcessHeap () returned 0xd20000 [0107.804] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd428c8 [0107.804] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\swYEe7.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\fj8tjd\\swyee7.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0107.804] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=84249) returned 1 [0107.804] GetProcessHeap () returned 0xd20000 [0107.804] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c0e8 [0107.804] GetProcessHeap () returned 0xd20000 [0107.804] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0107.804] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\swYEe7.mkv") returned 40 [0107.805] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0107.805] GetProcessHeap () returned 0xd20000 [0107.805] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0107.805] GetProcessHeap () returned 0xd20000 [0107.805] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x387) returned 0xd4f1c0 [0107.805] lstrlenA (lpString="rsa_encrypt") returned 11 [0107.805] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0107.807] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0107.807] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0107.807] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0107.808] GetProcessHeap () returned 0xd20000 [0107.808] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0107.808] lstrlenA (lpString="010001") returned 6 [0107.808] GetProcessHeap () returned 0xd20000 [0107.808] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cf18 [0107.808] GetProcessHeap () returned 0xd20000 [0107.808] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0107.808] GetProcessHeap () returned 0xd20000 [0107.808] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0107.808] GetProcessHeap () returned 0xd20000 [0107.808] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0107.808] GetProcessHeap () returned 0xd20000 [0107.808] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4a9d8 [0107.808] GetProcessHeap () returned 0xd20000 [0107.808] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd452f8 [0107.808] GetProcessHeap () returned 0xd20000 [0107.808] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cf88 [0107.808] GetProcessHeap () returned 0xd20000 [0107.808] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0107.808] GetProcessHeap () returned 0xd20000 [0107.809] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.809] GetProcessHeap () returned 0xd20000 [0107.809] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0107.809] GetProcessHeap () returned 0xd20000 [0107.809] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0107.809] GetProcessHeap () returned 0xd20000 [0107.809] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44920 [0107.809] GetProcessHeap () returned 0xd20000 [0107.809] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.809] GetProcessHeap () returned 0xd20000 [0107.809] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44528 [0107.809] GetProcessHeap () returned 0xd20000 [0107.809] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b2d8 [0107.809] GetProcessHeap () returned 0xd20000 [0107.809] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0107.809] GetProcessHeap () returned 0xd20000 [0107.809] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0107.809] GetProcessHeap () returned 0xd20000 [0107.809] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b2d8 | out: hHeap=0xd20000) returned 1 [0107.809] GetProcessHeap () returned 0xd20000 [0107.809] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.809] GetProcessHeap () returned 0xd20000 [0107.809] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445a0 [0107.810] GetProcessHeap () returned 0xd20000 [0107.810] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.810] GetProcessHeap () returned 0xd20000 [0107.810] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.810] GetProcessHeap () returned 0xd20000 [0107.810] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.810] GetProcessHeap () returned 0xd20000 [0107.810] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.810] GetProcessHeap () returned 0xd20000 [0107.810] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.810] GetProcessHeap () returned 0xd20000 [0107.810] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.810] GetProcessHeap () returned 0xd20000 [0107.810] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4a948 [0107.810] GetProcessHeap () returned 0xd20000 [0107.810] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445a0 | out: hHeap=0xd20000) returned 1 [0107.810] GetProcessHeap () returned 0xd20000 [0107.810] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44c68 [0107.810] GetProcessHeap () returned 0xd20000 [0107.810] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a948 | out: hHeap=0xd20000) returned 1 [0107.810] GetProcessHeap () returned 0xd20000 [0107.810] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.811] GetProcessHeap () returned 0xd20000 [0107.811] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.811] GetProcessHeap () returned 0xd20000 [0107.811] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.811] GetProcessHeap () returned 0xd20000 [0107.811] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.811] GetProcessHeap () returned 0xd20000 [0107.811] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.811] GetProcessHeap () returned 0xd20000 [0107.811] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.811] GetProcessHeap () returned 0xd20000 [0107.811] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.811] GetProcessHeap () returned 0xd20000 [0107.811] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.811] GetProcessHeap () returned 0xd20000 [0107.811] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.811] GetProcessHeap () returned 0xd20000 [0107.811] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.811] GetProcessHeap () returned 0xd20000 [0107.811] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.811] GetProcessHeap () returned 0xd20000 [0107.811] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.811] GetProcessHeap () returned 0xd20000 [0107.811] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.812] GetProcessHeap () returned 0xd20000 [0107.812] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.812] GetProcessHeap () returned 0xd20000 [0107.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.812] GetProcessHeap () returned 0xd20000 [0107.812] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.812] GetProcessHeap () returned 0xd20000 [0107.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.812] GetProcessHeap () returned 0xd20000 [0107.812] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.812] GetProcessHeap () returned 0xd20000 [0107.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.812] GetProcessHeap () returned 0xd20000 [0107.812] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.812] GetProcessHeap () returned 0xd20000 [0107.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.812] GetProcessHeap () returned 0xd20000 [0107.812] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.812] GetProcessHeap () returned 0xd20000 [0107.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.812] GetProcessHeap () returned 0xd20000 [0107.812] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.812] GetProcessHeap () returned 0xd20000 [0107.813] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.813] GetProcessHeap () returned 0xd20000 [0107.813] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.813] GetProcessHeap () returned 0xd20000 [0107.813] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.813] GetProcessHeap () returned 0xd20000 [0107.813] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.813] GetProcessHeap () returned 0xd20000 [0107.813] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.813] GetProcessHeap () returned 0xd20000 [0107.813] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.813] GetProcessHeap () returned 0xd20000 [0107.813] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.813] GetProcessHeap () returned 0xd20000 [0107.813] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.813] GetProcessHeap () returned 0xd20000 [0107.813] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.813] GetProcessHeap () returned 0xd20000 [0107.813] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.813] GetProcessHeap () returned 0xd20000 [0107.813] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0107.813] GetProcessHeap () returned 0xd20000 [0107.814] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0107.814] GetProcessHeap () returned 0xd20000 [0107.814] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.814] GetProcessHeap () returned 0xd20000 [0107.814] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.814] GetProcessHeap () returned 0xd20000 [0107.814] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.814] GetProcessHeap () returned 0xd20000 [0107.814] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.814] GetProcessHeap () returned 0xd20000 [0107.814] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.814] GetProcessHeap () returned 0xd20000 [0107.814] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.814] GetProcessHeap () returned 0xd20000 [0107.814] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.814] GetProcessHeap () returned 0xd20000 [0107.814] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.814] GetProcessHeap () returned 0xd20000 [0107.814] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.814] GetProcessHeap () returned 0xd20000 [0107.814] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.814] GetProcessHeap () returned 0xd20000 [0107.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.815] GetProcessHeap () returned 0xd20000 [0107.815] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.815] GetProcessHeap () returned 0xd20000 [0107.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.815] GetProcessHeap () returned 0xd20000 [0107.815] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.815] GetProcessHeap () returned 0xd20000 [0107.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.815] GetProcessHeap () returned 0xd20000 [0107.815] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.815] GetProcessHeap () returned 0xd20000 [0107.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.815] GetProcessHeap () returned 0xd20000 [0107.815] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.815] GetProcessHeap () returned 0xd20000 [0107.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.815] GetProcessHeap () returned 0xd20000 [0107.815] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.815] GetProcessHeap () returned 0xd20000 [0107.815] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.816] GetProcessHeap () returned 0xd20000 [0107.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.816] GetProcessHeap () returned 0xd20000 [0107.816] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.816] GetProcessHeap () returned 0xd20000 [0107.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.816] GetProcessHeap () returned 0xd20000 [0107.816] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.816] GetProcessHeap () returned 0xd20000 [0107.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.816] GetProcessHeap () returned 0xd20000 [0107.816] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.816] GetProcessHeap () returned 0xd20000 [0107.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.816] GetProcessHeap () returned 0xd20000 [0107.816] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.816] GetProcessHeap () returned 0xd20000 [0107.816] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.816] GetProcessHeap () returned 0xd20000 [0107.816] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0107.817] GetProcessHeap () returned 0xd20000 [0107.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0107.817] GetProcessHeap () returned 0xd20000 [0107.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.817] GetProcessHeap () returned 0xd20000 [0107.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.817] GetProcessHeap () returned 0xd20000 [0107.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.817] GetProcessHeap () returned 0xd20000 [0107.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.817] GetProcessHeap () returned 0xd20000 [0107.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.817] GetProcessHeap () returned 0xd20000 [0107.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.817] GetProcessHeap () returned 0xd20000 [0107.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.817] GetProcessHeap () returned 0xd20000 [0107.817] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.817] GetProcessHeap () returned 0xd20000 [0107.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0107.817] GetProcessHeap () returned 0xd20000 [0107.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0107.818] GetProcessHeap () returned 0xd20000 [0107.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.818] GetProcessHeap () returned 0xd20000 [0107.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.818] GetProcessHeap () returned 0xd20000 [0107.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.818] GetProcessHeap () returned 0xd20000 [0107.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.818] GetProcessHeap () returned 0xd20000 [0107.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.818] GetProcessHeap () returned 0xd20000 [0107.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.818] GetProcessHeap () returned 0xd20000 [0107.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.818] GetProcessHeap () returned 0xd20000 [0107.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.818] GetProcessHeap () returned 0xd20000 [0107.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.818] GetProcessHeap () returned 0xd20000 [0107.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.819] GetProcessHeap () returned 0xd20000 [0107.819] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0107.819] GetProcessHeap () returned 0xd20000 [0107.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0107.819] GetProcessHeap () returned 0xd20000 [0107.819] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.819] GetProcessHeap () returned 0xd20000 [0107.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.819] GetProcessHeap () returned 0xd20000 [0107.819] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.819] GetProcessHeap () returned 0xd20000 [0107.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.819] GetProcessHeap () returned 0xd20000 [0107.819] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.819] GetProcessHeap () returned 0xd20000 [0107.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.819] GetProcessHeap () returned 0xd20000 [0107.819] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.819] GetProcessHeap () returned 0xd20000 [0107.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.819] GetProcessHeap () returned 0xd20000 [0107.819] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.820] GetProcessHeap () returned 0xd20000 [0107.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.820] GetProcessHeap () returned 0xd20000 [0107.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.820] GetProcessHeap () returned 0xd20000 [0107.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.820] GetProcessHeap () returned 0xd20000 [0107.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.820] GetProcessHeap () returned 0xd20000 [0107.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.820] GetProcessHeap () returned 0xd20000 [0107.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.820] GetProcessHeap () returned 0xd20000 [0107.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.820] GetProcessHeap () returned 0xd20000 [0107.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.820] GetProcessHeap () returned 0xd20000 [0107.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.820] GetProcessHeap () returned 0xd20000 [0107.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.820] GetProcessHeap () returned 0xd20000 [0107.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.821] GetProcessHeap () returned 0xd20000 [0107.821] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.821] GetProcessHeap () returned 0xd20000 [0107.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.821] GetProcessHeap () returned 0xd20000 [0107.821] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.821] GetProcessHeap () returned 0xd20000 [0107.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.821] GetProcessHeap () returned 0xd20000 [0107.821] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.821] GetProcessHeap () returned 0xd20000 [0107.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.821] GetProcessHeap () returned 0xd20000 [0107.821] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.821] GetProcessHeap () returned 0xd20000 [0107.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.821] GetProcessHeap () returned 0xd20000 [0107.821] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.821] GetProcessHeap () returned 0xd20000 [0107.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.821] GetProcessHeap () returned 0xd20000 [0107.821] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.822] GetProcessHeap () returned 0xd20000 [0107.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.822] GetProcessHeap () returned 0xd20000 [0107.822] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.822] GetProcessHeap () returned 0xd20000 [0107.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.822] GetProcessHeap () returned 0xd20000 [0107.822] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.822] GetProcessHeap () returned 0xd20000 [0107.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.823] GetProcessHeap () returned 0xd20000 [0107.823] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.823] GetProcessHeap () returned 0xd20000 [0107.823] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.823] GetProcessHeap () returned 0xd20000 [0107.823] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.823] GetProcessHeap () returned 0xd20000 [0107.823] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.823] GetProcessHeap () returned 0xd20000 [0107.824] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.824] GetProcessHeap () returned 0xd20000 [0107.824] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.824] GetProcessHeap () returned 0xd20000 [0107.824] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.824] GetProcessHeap () returned 0xd20000 [0107.824] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.824] GetProcessHeap () returned 0xd20000 [0107.824] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.824] GetProcessHeap () returned 0xd20000 [0107.824] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.824] GetProcessHeap () returned 0xd20000 [0107.824] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0107.824] GetProcessHeap () returned 0xd20000 [0107.824] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0107.824] GetProcessHeap () returned 0xd20000 [0107.824] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.824] GetProcessHeap () returned 0xd20000 [0107.824] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.824] GetProcessHeap () returned 0xd20000 [0107.824] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.824] GetProcessHeap () returned 0xd20000 [0107.825] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.825] GetProcessHeap () returned 0xd20000 [0107.825] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.825] GetProcessHeap () returned 0xd20000 [0107.825] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.825] GetProcessHeap () returned 0xd20000 [0107.825] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0107.825] GetProcessHeap () returned 0xd20000 [0107.825] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0107.825] GetProcessHeap () returned 0xd20000 [0107.825] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0107.825] GetProcessHeap () returned 0xd20000 [0107.825] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0107.825] GetProcessHeap () returned 0xd20000 [0107.825] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0107.825] GetProcessHeap () returned 0xd20000 [0107.825] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0107.825] GetProcessHeap () returned 0xd20000 [0107.825] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.825] GetProcessHeap () returned 0xd20000 [0107.825] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.826] GetProcessHeap () returned 0xd20000 [0107.826] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0107.826] GetProcessHeap () returned 0xd20000 [0107.826] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0107.826] GetProcessHeap () returned 0xd20000 [0107.826] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.826] GetProcessHeap () returned 0xd20000 [0107.826] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.826] GetProcessHeap () returned 0xd20000 [0107.826] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.826] GetProcessHeap () returned 0xd20000 [0107.826] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.826] GetProcessHeap () returned 0xd20000 [0107.826] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0107.826] GetProcessHeap () returned 0xd20000 [0107.826] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0107.826] GetProcessHeap () returned 0xd20000 [0107.826] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.826] GetProcessHeap () returned 0xd20000 [0107.826] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.826] GetProcessHeap () returned 0xd20000 [0107.826] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.826] GetProcessHeap () returned 0xd20000 [0107.827] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.827] GetProcessHeap () returned 0xd20000 [0107.827] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.827] GetProcessHeap () returned 0xd20000 [0107.827] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.827] GetProcessHeap () returned 0xd20000 [0107.827] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.827] GetProcessHeap () returned 0xd20000 [0107.827] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.827] GetProcessHeap () returned 0xd20000 [0107.827] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.827] GetProcessHeap () returned 0xd20000 [0107.827] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.827] GetProcessHeap () returned 0xd20000 [0107.827] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0107.827] GetProcessHeap () returned 0xd20000 [0107.827] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0107.827] GetProcessHeap () returned 0xd20000 [0107.827] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0107.827] GetProcessHeap () returned 0xd20000 [0107.827] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0107.827] GetProcessHeap () returned 0xd20000 [0107.828] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44528 | out: hHeap=0xd20000) returned 1 [0107.828] GetProcessHeap () returned 0xd20000 [0107.828] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a9d8 | out: hHeap=0xd20000) returned 1 [0107.828] GetProcessHeap () returned 0xd20000 [0107.828] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0107.828] GetProcessHeap () returned 0xd20000 [0107.828] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0107.828] GetProcessHeap () returned 0xd20000 [0107.828] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0107.828] GetProcessHeap () returned 0xd20000 [0107.828] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.828] GetProcessHeap () returned 0xd20000 [0107.828] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0107.828] WriteFile (in: hFile=0x230, lpBuffer=0xd4f1c0*, nNumberOfBytesToWrite=0x387, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f1c0*, lpNumberOfBytesWritten=0x299d864*=0x387, lpOverlapped=0x0) returned 1 [0107.831] GetProcessHeap () returned 0xd20000 [0107.831] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4f1c0, Size=0x30) returned 0xd4f1c0 [0107.831] GetProcessHeap () returned 0xd20000 [0107.831] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0107.831] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0107.831] GetProcessHeap () returned 0xd20000 [0107.831] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x14920) returned 0xd4f1f8 [0107.832] ReadFile (in: hFile=0x230, lpBuffer=0xd4f1f8, nNumberOfBytesToRead=0x14920, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4f1f8*, lpNumberOfBytesRead=0x299d7e8*=0x14920, lpOverlapped=0x0) returned 1 [0107.834] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0107.834] WriteFile (in: hFile=0x230, lpBuffer=0xd4f1f8*, nNumberOfBytesToWrite=0x14920, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4f1f8*, lpNumberOfBytesWritten=0x299d7e4*=0x14920, lpOverlapped=0x0) returned 1 [0107.836] GetProcessHeap () returned 0xd20000 [0107.836] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4f1f8 | out: hHeap=0xd20000) returned 1 [0107.837] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0107.837] WriteFile (in: hFile=0x230, lpBuffer=0xd4f1c0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f1c0*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0107.839] CloseHandle (hObject=0x230) returned 1 [0107.845] GetProcessHeap () returned 0xd20000 [0107.845] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd428c8 | out: hHeap=0xd20000) returned 1 [0107.845] GetProcessHeap () returned 0xd20000 [0107.845] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c0e8 | out: hHeap=0xd20000) returned 1 [0107.845] GetProcessHeap () returned 0xd20000 [0107.845] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0107.845] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\swYEe7.mkv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\swYEe7.mkv") returned="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\swYEe7.mkv" [0107.845] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\swYEe7.mkv", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\swYEe7.mkv.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\swYEe7.mkv.[ponce.lorena@aol.com]" [0107.845] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\swYEe7.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\fj8tjd\\swyee7.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\swYEe7.mkv.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\videos\\fj8tjd\\swyee7.mkv.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0107.846] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\swYEe7.mkv" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fj8TJD") returned 1 [0107.846] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fj8TJD" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\") returned="" [0107.846] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\HOW_RECOVER.html" [0107.846] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\fj8tjd\\how_recover.html")) returned 0x20 [0107.846] GetProcessHeap () returned 0xd20000 [0107.847] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44588 | out: hHeap=0xd20000) returned 1 [0107.847] FindNextFileW (in: hFindFile=0xd49360, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5013b4f0, ftCreationTime.dwHighDateTime=0x1d4cbcd, ftLastAccessTime.dwLowDateTime=0x71f97670, ftLastAccessTime.dwHighDateTime=0x1d4c95e, ftLastWriteTime.dwLowDateTime=0x71f97670, ftLastWriteTime.dwHighDateTime=0x1d4c95e, nFileSizeHigh=0x0, nFileSizeLow=0x1384a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Vt-bd6OSSldFWZwm.flv", cAlternateFileName="VT-BD6~1.FLV")) returned 1 [0107.847] lstrcmpiW (lpString1="Vt-bd6OSSldFWZwm.flv", lpString2=".") returned 1 [0107.847] lstrcmpiW (lpString1="Vt-bd6OSSldFWZwm.flv", lpString2="..") returned 1 [0107.847] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\", lpString2="Vt-bd6OSSldFWZwm.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\Vt-bd6OSSldFWZwm.flv") returned="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\Vt-bd6OSSldFWZwm.flv" [0107.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Vt-bd6OSSldFWZwm.flv", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0107.847] GetProcessHeap () returned 0xd20000 [0107.847] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x15) returned 0xd36768 [0107.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Vt-bd6OSSldFWZwm.flv", cchWideChar=-1, lpMultiByteStr=0xd36768, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Vt-bd6OSSldFWZwm.flv", lpUsedDefaultChar=0x0) returned 21 [0107.847] lstrlenA (lpString="Vt-bd6OSSldFWZwm.flv") returned 20 [0107.847] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0107.847] lstrlenA (lpString="Vt-bd6OSSldFWZwm.flv") returned 20 [0107.847] lstrlenA (lpString=".dll") returned 4 [0107.847] lstrlenA (lpString=".dll") returned 4 [0107.847] lstrlenA (lpString="Vt-bd6OSSldFWZwm.flv") returned 20 [0107.847] lstrcmpiA (lpString1=".flv", lpString2=".dll") returned 1 [0107.847] lstrlenA (lpString="Vt-bd6OSSldFWZwm.flv") returned 20 [0107.847] lstrlenA (lpString=".ini") returned 4 [0107.847] lstrlenA (lpString=".ini") returned 4 [0107.848] lstrlenA (lpString="Vt-bd6OSSldFWZwm.flv") returned 20 [0107.848] lstrcmpiA (lpString1=".flv", lpString2=".ini") returned -1 [0107.848] lstrlenA (lpString="Vt-bd6OSSldFWZwm.flv") returned 20 [0107.848] lstrlenA (lpString=".inc") returned 4 [0107.848] lstrlenA (lpString=".inc") returned 4 [0107.848] lstrlenA (lpString="Vt-bd6OSSldFWZwm.flv") returned 20 [0107.848] lstrcmpiA (lpString1=".flv", lpString2=".inc") returned -1 [0107.848] lstrcmpiW (lpString1="Vt-bd6OSSldFWZwm.flv", lpString2="HOW_RECOVER.html") returned 1 [0107.848] lstrcmpiW (lpString1="Vt-bd6OSSldFWZwm.flv", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0107.848] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0107.848] lstrcmpiW (lpString1="Vt-bd6OSSldFWZwm.flv", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0107.848] GetProcessHeap () returned 0xd20000 [0107.848] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42828 [0107.848] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\Vt-bd6OSSldFWZwm.flv" (normalized: "c:\\users\\fd1hvy\\videos\\fj8tjd\\vt-bd6ossldfwzwm.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0107.848] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=79946) returned 1 [0107.848] GetProcessHeap () returned 0xd20000 [0107.848] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bd28 [0107.849] GetProcessHeap () returned 0xd20000 [0107.849] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0107.849] lstrlenW (lpString="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\Vt-bd6OSSldFWZwm.flv") returned 50 [0107.849] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0107.849] GetProcessHeap () returned 0xd20000 [0107.849] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0107.849] GetProcessHeap () returned 0xd20000 [0107.849] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4f1f8 [0107.849] lstrlenA (lpString="rsa_encrypt") returned 11 [0107.849] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0107.851] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0107.851] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0107.851] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0107.851] GetProcessHeap () returned 0xd20000 [0107.851] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0107.851] lstrlenA (lpString="010001") returned 6 [0107.851] GetProcessHeap () returned 0xd20000 [0107.852] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cf68 [0107.852] GetProcessHeap () returned 0xd20000 [0107.852] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0107.852] GetProcessHeap () returned 0xd20000 [0107.852] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b638 [0107.852] GetProcessHeap () returned 0xd20000 [0107.852] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0107.852] GetProcessHeap () returned 0xd20000 [0107.852] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4adc8 [0107.852] GetProcessHeap () returned 0xd20000 [0107.852] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45528 [0107.852] GetProcessHeap () returned 0xd20000 [0107.852] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ce78 [0107.852] GetProcessHeap () returned 0xd20000 [0107.852] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0107.852] GetProcessHeap () returned 0xd20000 [0107.853] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.853] GetProcessHeap () returned 0xd20000 [0107.853] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0107.853] GetProcessHeap () returned 0xd20000 [0107.853] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0107.853] GetProcessHeap () returned 0xd20000 [0107.853] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd450c8 [0107.853] GetProcessHeap () returned 0xd20000 [0107.853] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.853] GetProcessHeap () returned 0xd20000 [0107.853] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445a0 [0107.853] GetProcessHeap () returned 0xd20000 [0107.854] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b758 [0107.854] GetProcessHeap () returned 0xd20000 [0107.854] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0107.854] GetProcessHeap () returned 0xd20000 [0107.854] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0107.854] GetProcessHeap () returned 0xd20000 [0107.854] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b758 | out: hHeap=0xd20000) returned 1 [0107.854] GetProcessHeap () returned 0xd20000 [0107.854] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.854] GetProcessHeap () returned 0xd20000 [0107.854] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44510 [0107.854] GetProcessHeap () returned 0xd20000 [0107.854] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.854] GetProcessHeap () returned 0xd20000 [0107.854] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.854] GetProcessHeap () returned 0xd20000 [0107.855] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0107.855] GetProcessHeap () returned 0xd20000 [0107.855] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0107.855] GetProcessHeap () returned 0xd20000 [0107.855] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.855] GetProcessHeap () returned 0xd20000 [0107.855] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.855] GetProcessHeap () returned 0xd20000 [0107.855] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4ae58 [0107.855] GetProcessHeap () returned 0xd20000 [0107.855] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44510 | out: hHeap=0xd20000) returned 1 [0107.855] GetProcessHeap () returned 0xd20000 [0107.855] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0107.855] GetProcessHeap () returned 0xd20000 [0107.855] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ae58 | out: hHeap=0xd20000) returned 1 [0107.855] GetProcessHeap () returned 0xd20000 [0107.855] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.856] GetProcessHeap () returned 0xd20000 [0107.856] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.856] GetProcessHeap () returned 0xd20000 [0107.856] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.856] GetProcessHeap () returned 0xd20000 [0107.856] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.856] GetProcessHeap () returned 0xd20000 [0107.856] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.856] GetProcessHeap () returned 0xd20000 [0107.856] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.856] GetProcessHeap () returned 0xd20000 [0107.856] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.856] GetProcessHeap () returned 0xd20000 [0107.856] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.856] GetProcessHeap () returned 0xd20000 [0107.856] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.856] GetProcessHeap () returned 0xd20000 [0107.856] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.857] GetProcessHeap () returned 0xd20000 [0107.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.857] GetProcessHeap () returned 0xd20000 [0107.857] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.857] GetProcessHeap () returned 0xd20000 [0107.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.857] GetProcessHeap () returned 0xd20000 [0107.857] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.857] GetProcessHeap () returned 0xd20000 [0107.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.857] GetProcessHeap () returned 0xd20000 [0107.857] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.857] GetProcessHeap () returned 0xd20000 [0107.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0107.857] GetProcessHeap () returned 0xd20000 [0107.857] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0107.858] GetProcessHeap () returned 0xd20000 [0107.858] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.858] GetProcessHeap () returned 0xd20000 [0107.858] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.858] GetProcessHeap () returned 0xd20000 [0107.858] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.858] GetProcessHeap () returned 0xd20000 [0107.858] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.858] GetProcessHeap () returned 0xd20000 [0107.858] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.858] GetProcessHeap () returned 0xd20000 [0107.858] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.858] GetProcessHeap () returned 0xd20000 [0107.858] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.858] GetProcessHeap () returned 0xd20000 [0107.858] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.858] GetProcessHeap () returned 0xd20000 [0107.858] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.858] GetProcessHeap () returned 0xd20000 [0107.859] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.859] GetProcessHeap () returned 0xd20000 [0107.859] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0107.859] GetProcessHeap () returned 0xd20000 [0107.859] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0107.859] GetProcessHeap () returned 0xd20000 [0107.859] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.859] GetProcessHeap () returned 0xd20000 [0107.859] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.859] GetProcessHeap () returned 0xd20000 [0107.859] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0107.859] GetProcessHeap () returned 0xd20000 [0107.859] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0107.859] GetProcessHeap () returned 0xd20000 [0107.859] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.859] GetProcessHeap () returned 0xd20000 [0107.859] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.860] GetProcessHeap () returned 0xd20000 [0107.860] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.860] GetProcessHeap () returned 0xd20000 [0107.860] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.860] GetProcessHeap () returned 0xd20000 [0107.860] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.860] GetProcessHeap () returned 0xd20000 [0107.860] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.860] GetProcessHeap () returned 0xd20000 [0107.860] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.860] GetProcessHeap () returned 0xd20000 [0107.860] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.860] GetProcessHeap () returned 0xd20000 [0107.860] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.860] GetProcessHeap () returned 0xd20000 [0107.860] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.860] GetProcessHeap () returned 0xd20000 [0107.860] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.861] GetProcessHeap () returned 0xd20000 [0107.861] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.861] GetProcessHeap () returned 0xd20000 [0107.861] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0107.861] GetProcessHeap () returned 0xd20000 [0107.861] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0107.861] GetProcessHeap () returned 0xd20000 [0107.861] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.861] GetProcessHeap () returned 0xd20000 [0107.861] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.861] GetProcessHeap () returned 0xd20000 [0107.861] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.861] GetProcessHeap () returned 0xd20000 [0107.861] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.861] GetProcessHeap () returned 0xd20000 [0107.861] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.861] GetProcessHeap () returned 0xd20000 [0107.862] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.862] GetProcessHeap () returned 0xd20000 [0107.862] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.862] GetProcessHeap () returned 0xd20000 [0107.862] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.862] GetProcessHeap () returned 0xd20000 [0107.862] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.862] GetProcessHeap () returned 0xd20000 [0107.862] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.862] GetProcessHeap () returned 0xd20000 [0107.862] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.862] GetProcessHeap () returned 0xd20000 [0107.862] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.862] GetProcessHeap () returned 0xd20000 [0107.862] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.862] GetProcessHeap () returned 0xd20000 [0107.863] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.863] GetProcessHeap () returned 0xd20000 [0107.863] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.863] GetProcessHeap () returned 0xd20000 [0107.863] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.863] GetProcessHeap () returned 0xd20000 [0107.863] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.863] GetProcessHeap () returned 0xd20000 [0107.863] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.863] GetProcessHeap () returned 0xd20000 [0107.863] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.863] GetProcessHeap () returned 0xd20000 [0107.864] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.864] GetProcessHeap () returned 0xd20000 [0107.864] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.864] GetProcessHeap () returned 0xd20000 [0107.864] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.864] GetProcessHeap () returned 0xd20000 [0107.864] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.864] GetProcessHeap () returned 0xd20000 [0107.864] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.864] GetProcessHeap () returned 0xd20000 [0107.864] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.864] GetProcessHeap () returned 0xd20000 [0107.864] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.864] GetProcessHeap () returned 0xd20000 [0107.864] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.864] GetProcessHeap () returned 0xd20000 [0107.864] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.864] GetProcessHeap () returned 0xd20000 [0107.865] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.865] GetProcessHeap () returned 0xd20000 [0107.865] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.865] GetProcessHeap () returned 0xd20000 [0107.865] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.865] GetProcessHeap () returned 0xd20000 [0107.865] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.865] GetProcessHeap () returned 0xd20000 [0107.865] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.865] GetProcessHeap () returned 0xd20000 [0107.865] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.865] GetProcessHeap () returned 0xd20000 [0107.865] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0107.865] GetProcessHeap () returned 0xd20000 [0107.865] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0107.865] GetProcessHeap () returned 0xd20000 [0107.865] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.865] GetProcessHeap () returned 0xd20000 [0107.866] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.866] GetProcessHeap () returned 0xd20000 [0107.866] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.866] GetProcessHeap () returned 0xd20000 [0107.866] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.866] GetProcessHeap () returned 0xd20000 [0107.866] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.866] GetProcessHeap () returned 0xd20000 [0107.866] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.866] GetProcessHeap () returned 0xd20000 [0107.866] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.866] GetProcessHeap () returned 0xd20000 [0107.866] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.866] GetProcessHeap () returned 0xd20000 [0107.866] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.866] GetProcessHeap () returned 0xd20000 [0107.866] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.867] GetProcessHeap () returned 0xd20000 [0107.867] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.867] GetProcessHeap () returned 0xd20000 [0107.867] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.867] GetProcessHeap () returned 0xd20000 [0107.867] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.867] GetProcessHeap () returned 0xd20000 [0107.867] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.867] GetProcessHeap () returned 0xd20000 [0107.867] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.867] GetProcessHeap () returned 0xd20000 [0107.867] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.867] GetProcessHeap () returned 0xd20000 [0107.867] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.867] GetProcessHeap () returned 0xd20000 [0107.867] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.867] GetProcessHeap () returned 0xd20000 [0107.867] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0107.867] GetProcessHeap () returned 0xd20000 [0107.867] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0107.868] GetProcessHeap () returned 0xd20000 [0107.868] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.868] GetProcessHeap () returned 0xd20000 [0107.868] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.868] GetProcessHeap () returned 0xd20000 [0107.868] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.868] GetProcessHeap () returned 0xd20000 [0107.868] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.868] GetProcessHeap () returned 0xd20000 [0107.868] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0107.868] GetProcessHeap () returned 0xd20000 [0107.868] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0107.868] GetProcessHeap () returned 0xd20000 [0107.868] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.868] GetProcessHeap () returned 0xd20000 [0107.868] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.868] GetProcessHeap () returned 0xd20000 [0107.868] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.868] GetProcessHeap () returned 0xd20000 [0107.868] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.868] GetProcessHeap () returned 0xd20000 [0107.868] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0107.869] GetProcessHeap () returned 0xd20000 [0107.869] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0107.869] GetProcessHeap () returned 0xd20000 [0107.869] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.869] GetProcessHeap () returned 0xd20000 [0107.869] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.869] GetProcessHeap () returned 0xd20000 [0107.869] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.870] GetProcessHeap () returned 0xd20000 [0107.870] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.870] GetProcessHeap () returned 0xd20000 [0107.870] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.870] GetProcessHeap () returned 0xd20000 [0107.870] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.870] GetProcessHeap () returned 0xd20000 [0107.870] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.870] GetProcessHeap () returned 0xd20000 [0107.870] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.870] GetProcessHeap () returned 0xd20000 [0107.870] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.870] GetProcessHeap () returned 0xd20000 [0107.870] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.870] GetProcessHeap () returned 0xd20000 [0107.870] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.870] GetProcessHeap () returned 0xd20000 [0107.870] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.870] GetProcessHeap () returned 0xd20000 [0107.870] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.870] GetProcessHeap () returned 0xd20000 [0107.871] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.871] GetProcessHeap () returned 0xd20000 [0107.871] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.871] GetProcessHeap () returned 0xd20000 [0107.871] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.871] GetProcessHeap () returned 0xd20000 [0107.871] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.871] GetProcessHeap () returned 0xd20000 [0107.871] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.871] GetProcessHeap () returned 0xd20000 [0107.871] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.871] GetProcessHeap () returned 0xd20000 [0107.871] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.871] GetProcessHeap () returned 0xd20000 [0107.871] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.871] GetProcessHeap () returned 0xd20000 [0107.871] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.871] GetProcessHeap () returned 0xd20000 [0107.871] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.871] GetProcessHeap () returned 0xd20000 [0107.871] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.872] GetProcessHeap () returned 0xd20000 [0107.872] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.872] GetProcessHeap () returned 0xd20000 [0107.872] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.872] GetProcessHeap () returned 0xd20000 [0107.872] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0107.872] GetProcessHeap () returned 0xd20000 [0107.872] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.872] GetProcessHeap () returned 0xd20000 [0107.872] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.872] GetProcessHeap () returned 0xd20000 [0107.872] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.872] GetProcessHeap () returned 0xd20000 [0107.872] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.872] GetProcessHeap () returned 0xd20000 [0107.872] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.872] GetProcessHeap () returned 0xd20000 [0107.872] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.872] GetProcessHeap () returned 0xd20000 [0107.872] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.872] GetProcessHeap () returned 0xd20000 [0107.873] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.873] GetProcessHeap () returned 0xd20000 [0107.873] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.873] GetProcessHeap () returned 0xd20000 [0107.873] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.873] GetProcessHeap () returned 0xd20000 [0107.873] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.873] GetProcessHeap () returned 0xd20000 [0107.873] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.873] GetProcessHeap () returned 0xd20000 [0107.873] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.873] GetProcessHeap () returned 0xd20000 [0107.873] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.873] GetProcessHeap () returned 0xd20000 [0107.873] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.873] GetProcessHeap () returned 0xd20000 [0107.873] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.873] GetProcessHeap () returned 0xd20000 [0107.873] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.873] GetProcessHeap () returned 0xd20000 [0107.873] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.873] GetProcessHeap () returned 0xd20000 [0107.874] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.874] GetProcessHeap () returned 0xd20000 [0107.874] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.874] GetProcessHeap () returned 0xd20000 [0107.874] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.874] GetProcessHeap () returned 0xd20000 [0107.874] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.874] GetProcessHeap () returned 0xd20000 [0107.874] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.874] GetProcessHeap () returned 0xd20000 [0107.874] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.874] GetProcessHeap () returned 0xd20000 [0107.874] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.874] GetProcessHeap () returned 0xd20000 [0107.874] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.874] GetProcessHeap () returned 0xd20000 [0107.874] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.874] GetProcessHeap () returned 0xd20000 [0107.874] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0107.874] GetProcessHeap () returned 0xd20000 [0107.874] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0107.874] GetProcessHeap () returned 0xd20000 [0107.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0107.875] GetProcessHeap () returned 0xd20000 [0107.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0107.875] GetProcessHeap () returned 0xd20000 [0107.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445a0 | out: hHeap=0xd20000) returned 1 [0107.875] GetProcessHeap () returned 0xd20000 [0107.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4adc8 | out: hHeap=0xd20000) returned 1 [0107.875] GetProcessHeap () returned 0xd20000 [0107.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0107.875] GetProcessHeap () returned 0xd20000 [0107.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b638 | out: hHeap=0xd20000) returned 1 [0107.875] GetProcessHeap () returned 0xd20000 [0107.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0107.875] GetProcessHeap () returned 0xd20000 [0107.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.875] GetProcessHeap () returned 0xd20000 [0107.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0107.875] WriteFile (in: hFile=0x230, lpBuffer=0xd4f1f8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f1f8*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0107.878] GetProcessHeap () returned 0xd20000 [0107.878] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4f1f8, Size=0x30) returned 0xd4f1f8 [0107.878] GetProcessHeap () returned 0xd20000 [0107.878] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0107.878] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0107.878] GetProcessHeap () returned 0xd20000 [0107.878] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1384a) returned 0xd4f230 [0107.878] ReadFile (in: hFile=0x230, lpBuffer=0xd4f230, nNumberOfBytesToRead=0x1384a, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4f230*, lpNumberOfBytesRead=0x299d7e8*=0x1384a, lpOverlapped=0x0) returned 1 [0107.880] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0107.880] WriteFile (in: hFile=0x230, lpBuffer=0xd4f230*, nNumberOfBytesToWrite=0x1384a, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4f230*, lpNumberOfBytesWritten=0x299d7e4*=0x1384a, lpOverlapped=0x0) returned 1 [0107.882] GetProcessHeap () returned 0xd20000 [0107.882] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4f230 | out: hHeap=0xd20000) returned 1 [0107.883] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0107.883] WriteFile (in: hFile=0x230, lpBuffer=0xd4f1f8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f1f8*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0107.884] CloseHandle (hObject=0x230) returned 1 [0107.889] GetProcessHeap () returned 0xd20000 [0107.889] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42828 | out: hHeap=0xd20000) returned 1 [0107.889] GetProcessHeap () returned 0xd20000 [0107.889] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bd28 | out: hHeap=0xd20000) returned 1 [0107.889] GetProcessHeap () returned 0xd20000 [0107.889] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0107.889] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\Vt-bd6OSSldFWZwm.flv" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\Vt-bd6OSSldFWZwm.flv") returned="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\Vt-bd6OSSldFWZwm.flv" [0107.889] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\Vt-bd6OSSldFWZwm.flv", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\Vt-bd6OSSldFWZwm.flv.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\Vt-bd6OSSldFWZwm.flv.[ponce.lorena@aol.com]" [0107.889] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\Vt-bd6OSSldFWZwm.flv" (normalized: "c:\\users\\fd1hvy\\videos\\fj8tjd\\vt-bd6ossldfwzwm.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\Vt-bd6OSSldFWZwm.flv.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\videos\\fj8tjd\\vt-bd6ossldfwzwm.flv.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0107.890] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\Vt-bd6OSSldFWZwm.flv" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fj8TJD") returned 1 [0107.890] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Videos\\fj8TJD" | out: pszPath="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\") returned="" [0107.890] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\HOW_RECOVER.html" [0107.890] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fj8TJD\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\videos\\fj8tjd\\how_recover.html")) returned 0x20 [0107.890] GetProcessHeap () returned 0xd20000 [0107.891] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36768 | out: hHeap=0xd20000) returned 1 [0107.891] FindNextFileW (in: hFindFile=0xd49360, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5013b4f0, ftCreationTime.dwHighDateTime=0x1d4cbcd, ftLastAccessTime.dwLowDateTime=0x71f97670, ftLastAccessTime.dwHighDateTime=0x1d4c95e, ftLastWriteTime.dwLowDateTime=0x71f97670, ftLastWriteTime.dwHighDateTime=0x1d4c95e, nFileSizeHigh=0x0, nFileSizeLow=0x1384a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Vt-bd6OSSldFWZwm.flv", cAlternateFileName="VT-BD6~1.FLV")) returned 0 [0107.891] FindClose (in: hFindFile=0xd49360 | out: hFindFile=0xd49360) returned 1 [0107.891] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Users\\FD1HVy\\Templates\\" | out: lpString1="C:\\Users\\FD1HVy\\Templates\\") returned="C:\\Users\\FD1HVy\\Templates\\" [0107.891] GetProcessHeap () returned 0xd20000 [0107.891] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd48e60 | out: hHeap=0xd20000) returned 1 [0107.891] GetProcessHeap () returned 0xd20000 [0107.891] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf78 | out: hHeap=0xd20000) returned 1 [0107.891] lstrlenW (lpString="C:\\Users\\FD1HVy\\Templates\\") returned 26 [0107.891] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Templates\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Templates\\*") returned="C:\\Users\\FD1HVy\\Templates\\*" [0107.891] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Templates\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5013b4f0, ftCreationTime.dwHighDateTime=0x1d4cbcd, ftLastAccessTime.dwLowDateTime=0x71f97670, ftLastAccessTime.dwHighDateTime=0x1d4c95e, ftLastWriteTime.dwLowDateTime=0x71f97670, ftLastWriteTime.dwHighDateTime=0x1d4c95e, nFileSizeHigh=0x0, nFileSizeLow=0x1384a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Vt-bd6OSSldFWZwm.flv", cAlternateFileName="VT-BD6~1.FLV")) returned 0xffffffff [0107.892] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Users\\FD1HVy\\Start Menu\\" | out: lpString1="C:\\Users\\FD1HVy\\Start Menu\\") returned="C:\\Users\\FD1HVy\\Start Menu\\" [0107.892] GetProcessHeap () returned 0xd20000 [0107.892] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd48ce0 | out: hHeap=0xd20000) returned 1 [0107.892] GetProcessHeap () returned 0xd20000 [0107.892] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf28 | out: hHeap=0xd20000) returned 1 [0107.892] lstrlenW (lpString="C:\\Users\\FD1HVy\\Start Menu\\") returned 27 [0107.892] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Start Menu\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Start Menu\\*") returned="C:\\Users\\FD1HVy\\Start Menu\\*" [0107.892] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Start Menu\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5013b4f0, ftCreationTime.dwHighDateTime=0x1d4cbcd, ftLastAccessTime.dwLowDateTime=0x71f97670, ftLastAccessTime.dwHighDateTime=0x1d4c95e, ftLastWriteTime.dwLowDateTime=0x71f97670, ftLastWriteTime.dwHighDateTime=0x1d4c95e, nFileSizeHigh=0x0, nFileSizeLow=0x1384a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Vt-bd6OSSldFWZwm.flv", cAlternateFileName="VT-BD6~1.FLV")) returned 0xffffffff [0107.893] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Users\\FD1HVy\\SendTo\\" | out: lpString1="C:\\Users\\FD1HVy\\SendTo\\") returned="C:\\Users\\FD1HVy\\SendTo\\" [0107.893] GetProcessHeap () returned 0xd20000 [0107.893] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3fd60 | out: hHeap=0xd20000) returned 1 [0107.893] GetProcessHeap () returned 0xd20000 [0107.893] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce38 | out: hHeap=0xd20000) returned 1 [0107.893] lstrlenW (lpString="C:\\Users\\FD1HVy\\SendTo\\") returned 23 [0107.893] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\SendTo\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\SendTo\\*") returned="C:\\Users\\FD1HVy\\SendTo\\*" [0107.893] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\SendTo\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5013b4f0, ftCreationTime.dwHighDateTime=0x1d4cbcd, ftLastAccessTime.dwLowDateTime=0x71f97670, ftLastAccessTime.dwHighDateTime=0x1d4c95e, ftLastWriteTime.dwLowDateTime=0x71f97670, ftLastWriteTime.dwHighDateTime=0x1d4c95e, nFileSizeHigh=0x0, nFileSizeLow=0x1384a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Vt-bd6OSSldFWZwm.flv", cAlternateFileName="VT-BD6~1.FLV")) returned 0xffffffff [0107.893] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Users\\FD1HVy\\Searches\\" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\") returned="C:\\Users\\FD1HVy\\Searches\\" [0107.893] GetProcessHeap () returned 0xd20000 [0107.893] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd49160 | out: hHeap=0xd20000) returned 1 [0107.893] GetProcessHeap () returned 0xd20000 [0107.893] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce68 | out: hHeap=0xd20000) returned 1 [0107.893] lstrlenW (lpString="C:\\Users\\FD1HVy\\Searches\\") returned 25 [0107.893] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\*") returned="C:\\Users\\FD1HVy\\Searches\\*" [0107.893] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Searches\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd490e0 [0107.894] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0107.894] FindNextFileW (in: hFindFile=0xd490e0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.894] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0107.894] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0107.894] FindNextFileW (in: hFindFile=0xd490e0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0107.894] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0107.894] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0107.894] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\desktop.ini") returned="C:\\Users\\FD1HVy\\Searches\\desktop.ini" [0107.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0107.894] GetProcessHeap () returned 0xd20000 [0107.894] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd445a0 [0107.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0xd445a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0107.895] lstrlenA (lpString="desktop.ini") returned 11 [0107.895] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0107.895] lstrlenA (lpString="desktop.ini") returned 11 [0107.895] lstrlenA (lpString=".dll") returned 4 [0107.895] lstrlenA (lpString=".dll") returned 4 [0107.895] lstrlenA (lpString="desktop.ini") returned 11 [0107.895] lstrcmpiA (lpString1=".ini", lpString2=".dll") returned 1 [0107.895] lstrlenA (lpString="desktop.ini") returned 11 [0107.895] lstrlenA (lpString=".ini") returned 4 [0107.895] lstrlenA (lpString=".ini") returned 4 [0107.895] lstrlenA (lpString="desktop.ini") returned 11 [0107.895] lstrcmpiA (lpString1=".ini", lpString2=".ini") returned 0 [0107.895] GetProcessHeap () returned 0xd20000 [0107.895] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445a0 | out: hHeap=0xd20000) returned 1 [0107.895] FindNextFileW (in: hFindFile=0xd490e0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44269063, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44269063, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44269063, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0107.895] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2=".") returned 1 [0107.895] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="..") returned 1 [0107.895] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="Everywhere.search-ms" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms") returned="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" [0107.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Everywhere.search-ms", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0107.896] GetProcessHeap () returned 0xd20000 [0107.896] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x15) returned 0xd364c8 [0107.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Everywhere.search-ms", cchWideChar=-1, lpMultiByteStr=0xd364c8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Everywhere.search-ms", lpUsedDefaultChar=0x0) returned 21 [0107.896] lstrlenA (lpString="Everywhere.search-ms") returned 20 [0107.896] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0107.896] lstrlenA (lpString="Everywhere.search-ms") returned 20 [0107.896] lstrlenA (lpString=".dll") returned 4 [0107.896] lstrlenA (lpString=".dll") returned 4 [0107.896] lstrlenA (lpString="Everywhere.search-ms") returned 20 [0107.896] lstrcmpiA (lpString1="h-ms", lpString2=".dll") returned 1 [0107.896] lstrlenA (lpString="Everywhere.search-ms") returned 20 [0107.896] lstrlenA (lpString=".ini") returned 4 [0107.896] lstrlenA (lpString=".ini") returned 4 [0107.896] lstrlenA (lpString="Everywhere.search-ms") returned 20 [0107.896] lstrcmpiA (lpString1="h-ms", lpString2=".ini") returned 1 [0107.896] lstrlenA (lpString="Everywhere.search-ms") returned 20 [0107.896] lstrlenA (lpString=".inc") returned 4 [0107.896] lstrlenA (lpString=".inc") returned 4 [0107.896] lstrlenA (lpString="Everywhere.search-ms") returned 20 [0107.896] lstrcmpiA (lpString1="h-ms", lpString2=".inc") returned 1 [0107.897] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="HOW_RECOVER.html") returned -1 [0107.897] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0107.897] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0107.897] lstrcmpiW (lpString1="Everywhere.search-ms", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0107.897] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", dwFileAttributes=0x22) returned 1 [0107.898] GetProcessHeap () returned 0xd20000 [0107.898] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42558 [0107.899] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\everywhere.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0107.899] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=248) returned 1 [0107.899] GetProcessHeap () returned 0xd20000 [0107.899] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bff8 [0107.899] GetProcessHeap () returned 0xd20000 [0107.899] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0107.899] lstrlenW (lpString="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms") returned 45 [0107.899] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0107.899] GetProcessHeap () returned 0xd20000 [0107.899] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0107.899] GetProcessHeap () returned 0xd20000 [0107.899] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x388) returned 0xd4f230 [0107.900] lstrlenA (lpString="rsa_encrypt") returned 11 [0107.900] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0107.902] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0107.902] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0107.902] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0107.902] GetProcessHeap () returned 0xd20000 [0107.902] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0107.902] lstrlenA (lpString="010001") returned 6 [0107.903] GetProcessHeap () returned 0xd20000 [0107.903] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ce78 [0107.903] GetProcessHeap () returned 0xd20000 [0107.903] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0107.903] GetProcessHeap () returned 0xd20000 [0107.903] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ac18 [0107.903] GetProcessHeap () returned 0xd20000 [0107.903] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0107.903] GetProcessHeap () returned 0xd20000 [0107.903] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0107.903] GetProcessHeap () returned 0xd20000 [0107.903] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44d80 [0107.903] GetProcessHeap () returned 0xd20000 [0107.903] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cef8 [0107.903] GetProcessHeap () returned 0xd20000 [0107.903] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0107.903] GetProcessHeap () returned 0xd20000 [0107.903] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.903] GetProcessHeap () returned 0xd20000 [0107.904] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0107.904] GetProcessHeap () returned 0xd20000 [0107.904] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0107.904] GetProcessHeap () returned 0xd20000 [0107.904] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd45640 [0107.904] GetProcessHeap () returned 0xd20000 [0107.904] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf78 [0107.904] GetProcessHeap () returned 0xd20000 [0107.904] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446c0 [0107.904] GetProcessHeap () returned 0xd20000 [0107.904] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b878 [0107.904] GetProcessHeap () returned 0xd20000 [0107.904] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0107.904] GetProcessHeap () returned 0xd20000 [0107.904] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0107.904] GetProcessHeap () returned 0xd20000 [0107.904] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b878 | out: hHeap=0xd20000) returned 1 [0107.904] GetProcessHeap () returned 0xd20000 [0107.904] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.904] GetProcessHeap () returned 0xd20000 [0107.904] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44438 [0107.905] GetProcessHeap () returned 0xd20000 [0107.905] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf78 | out: hHeap=0xd20000) returned 1 [0107.905] GetProcessHeap () returned 0xd20000 [0107.905] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.905] GetProcessHeap () returned 0xd20000 [0107.905] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0107.905] GetProcessHeap () returned 0xd20000 [0107.905] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0107.905] GetProcessHeap () returned 0xd20000 [0107.905] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.905] GetProcessHeap () returned 0xd20000 [0107.905] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.905] GetProcessHeap () returned 0xd20000 [0107.905] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b7e8 [0107.905] GetProcessHeap () returned 0xd20000 [0107.905] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44438 | out: hHeap=0xd20000) returned 1 [0107.905] GetProcessHeap () returned 0xd20000 [0107.905] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0107.905] GetProcessHeap () returned 0xd20000 [0107.905] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0107.906] GetProcessHeap () returned 0xd20000 [0107.906] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf28 [0107.906] GetProcessHeap () returned 0xd20000 [0107.906] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf28 | out: hHeap=0xd20000) returned 1 [0107.906] GetProcessHeap () returned 0xd20000 [0107.906] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.906] GetProcessHeap () returned 0xd20000 [0107.906] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.906] GetProcessHeap () returned 0xd20000 [0107.906] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.906] GetProcessHeap () returned 0xd20000 [0107.906] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.906] GetProcessHeap () returned 0xd20000 [0107.906] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.906] GetProcessHeap () returned 0xd20000 [0107.906] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.906] GetProcessHeap () returned 0xd20000 [0107.906] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.906] GetProcessHeap () returned 0xd20000 [0107.906] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.907] GetProcessHeap () returned 0xd20000 [0107.907] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.907] GetProcessHeap () returned 0xd20000 [0107.907] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.907] GetProcessHeap () returned 0xd20000 [0107.907] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce38 [0107.907] GetProcessHeap () returned 0xd20000 [0107.907] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce38 | out: hHeap=0xd20000) returned 1 [0107.907] GetProcessHeap () returned 0xd20000 [0107.907] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf78 [0107.907] GetProcessHeap () returned 0xd20000 [0107.907] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf78 | out: hHeap=0xd20000) returned 1 [0107.907] GetProcessHeap () returned 0xd20000 [0107.907] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.907] GetProcessHeap () returned 0xd20000 [0107.907] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.907] GetProcessHeap () returned 0xd20000 [0107.907] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.908] GetProcessHeap () returned 0xd20000 [0107.908] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.908] GetProcessHeap () returned 0xd20000 [0107.908] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0107.908] GetProcessHeap () returned 0xd20000 [0107.908] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0107.908] GetProcessHeap () returned 0xd20000 [0107.908] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.908] GetProcessHeap () returned 0xd20000 [0107.908] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.908] GetProcessHeap () returned 0xd20000 [0107.908] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0107.908] GetProcessHeap () returned 0xd20000 [0107.908] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0107.908] GetProcessHeap () returned 0xd20000 [0107.908] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.908] GetProcessHeap () returned 0xd20000 [0107.908] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.908] GetProcessHeap () returned 0xd20000 [0107.908] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.909] GetProcessHeap () returned 0xd20000 [0107.909] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.909] GetProcessHeap () returned 0xd20000 [0107.909] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.909] GetProcessHeap () returned 0xd20000 [0107.909] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.909] GetProcessHeap () returned 0xd20000 [0107.909] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.909] GetProcessHeap () returned 0xd20000 [0107.909] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.909] GetProcessHeap () returned 0xd20000 [0107.909] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0107.909] GetProcessHeap () returned 0xd20000 [0107.909] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0107.909] GetProcessHeap () returned 0xd20000 [0107.909] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.909] GetProcessHeap () returned 0xd20000 [0107.909] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.909] GetProcessHeap () returned 0xd20000 [0107.909] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.910] GetProcessHeap () returned 0xd20000 [0107.910] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.910] GetProcessHeap () returned 0xd20000 [0107.910] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf78 [0107.910] GetProcessHeap () returned 0xd20000 [0107.910] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf78 | out: hHeap=0xd20000) returned 1 [0107.910] GetProcessHeap () returned 0xd20000 [0107.910] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce68 [0107.910] GetProcessHeap () returned 0xd20000 [0107.910] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce68 | out: hHeap=0xd20000) returned 1 [0107.910] GetProcessHeap () returned 0xd20000 [0107.910] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.910] GetProcessHeap () returned 0xd20000 [0107.910] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.910] GetProcessHeap () returned 0xd20000 [0107.910] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0107.910] GetProcessHeap () returned 0xd20000 [0107.910] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0107.910] GetProcessHeap () returned 0xd20000 [0107.910] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.911] GetProcessHeap () returned 0xd20000 [0107.911] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.911] GetProcessHeap () returned 0xd20000 [0107.911] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.911] GetProcessHeap () returned 0xd20000 [0107.911] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.911] GetProcessHeap () returned 0xd20000 [0107.911] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce38 [0107.911] GetProcessHeap () returned 0xd20000 [0107.911] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce38 | out: hHeap=0xd20000) returned 1 [0107.911] GetProcessHeap () returned 0xd20000 [0107.911] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.911] GetProcessHeap () returned 0xd20000 [0107.911] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.911] GetProcessHeap () returned 0xd20000 [0107.911] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.911] GetProcessHeap () returned 0xd20000 [0107.911] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.911] GetProcessHeap () returned 0xd20000 [0107.911] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.911] GetProcessHeap () returned 0xd20000 [0107.912] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.912] GetProcessHeap () returned 0xd20000 [0107.912] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.912] GetProcessHeap () returned 0xd20000 [0107.912] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.912] GetProcessHeap () returned 0xd20000 [0107.912] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.912] GetProcessHeap () returned 0xd20000 [0107.912] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.912] GetProcessHeap () returned 0xd20000 [0107.912] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.912] GetProcessHeap () returned 0xd20000 [0107.912] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.912] GetProcessHeap () returned 0xd20000 [0107.912] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.912] GetProcessHeap () returned 0xd20000 [0107.912] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.912] GetProcessHeap () returned 0xd20000 [0107.912] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf78 [0107.912] GetProcessHeap () returned 0xd20000 [0107.912] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf78 | out: hHeap=0xd20000) returned 1 [0107.913] GetProcessHeap () returned 0xd20000 [0107.913] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.913] GetProcessHeap () returned 0xd20000 [0107.913] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.913] GetProcessHeap () returned 0xd20000 [0107.913] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.913] GetProcessHeap () returned 0xd20000 [0107.913] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.913] GetProcessHeap () returned 0xd20000 [0107.913] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.913] GetProcessHeap () returned 0xd20000 [0107.913] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.913] GetProcessHeap () returned 0xd20000 [0107.913] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.913] GetProcessHeap () returned 0xd20000 [0107.913] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.913] GetProcessHeap () returned 0xd20000 [0107.913] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.913] GetProcessHeap () returned 0xd20000 [0107.913] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.913] GetProcessHeap () returned 0xd20000 [0107.913] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.914] GetProcessHeap () returned 0xd20000 [0107.914] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.914] GetProcessHeap () returned 0xd20000 [0107.914] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf78 [0107.914] GetProcessHeap () returned 0xd20000 [0107.914] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf78 | out: hHeap=0xd20000) returned 1 [0107.914] GetProcessHeap () returned 0xd20000 [0107.914] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.914] GetProcessHeap () returned 0xd20000 [0107.914] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.914] GetProcessHeap () returned 0xd20000 [0107.914] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.914] GetProcessHeap () returned 0xd20000 [0107.914] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.914] GetProcessHeap () returned 0xd20000 [0107.914] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf28 [0107.914] GetProcessHeap () returned 0xd20000 [0107.914] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf28 | out: hHeap=0xd20000) returned 1 [0107.914] GetProcessHeap () returned 0xd20000 [0107.914] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.914] GetProcessHeap () returned 0xd20000 [0107.914] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.915] GetProcessHeap () returned 0xd20000 [0107.915] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0107.915] GetProcessHeap () returned 0xd20000 [0107.915] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0107.915] GetProcessHeap () returned 0xd20000 [0107.915] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0107.915] GetProcessHeap () returned 0xd20000 [0107.915] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0107.915] GetProcessHeap () returned 0xd20000 [0107.915] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0107.915] GetProcessHeap () returned 0xd20000 [0107.915] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0107.915] GetProcessHeap () returned 0xd20000 [0107.915] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.915] GetProcessHeap () returned 0xd20000 [0107.915] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.915] GetProcessHeap () returned 0xd20000 [0107.915] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0107.915] GetProcessHeap () returned 0xd20000 [0107.915] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0107.916] GetProcessHeap () returned 0xd20000 [0107.916] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0107.916] GetProcessHeap () returned 0xd20000 [0107.916] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0107.916] GetProcessHeap () returned 0xd20000 [0107.917] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0107.917] GetProcessHeap () returned 0xd20000 [0107.917] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0107.917] GetProcessHeap () returned 0xd20000 [0107.917] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0107.917] GetProcessHeap () returned 0xd20000 [0107.917] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0107.917] GetProcessHeap () returned 0xd20000 [0107.917] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf28 [0107.917] GetProcessHeap () returned 0xd20000 [0107.917] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf28 | out: hHeap=0xd20000) returned 1 [0107.917] GetProcessHeap () returned 0xd20000 [0107.917] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0107.917] GetProcessHeap () returned 0xd20000 [0107.917] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0107.917] GetProcessHeap () returned 0xd20000 [0107.917] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0107.917] GetProcessHeap () returned 0xd20000 [0107.917] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0107.917] GetProcessHeap () returned 0xd20000 [0107.917] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0107.917] GetProcessHeap () returned 0xd20000 [0107.918] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0107.918] GetProcessHeap () returned 0xd20000 [0107.918] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0107.918] GetProcessHeap () returned 0xd20000 [0107.918] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0107.918] GetProcessHeap () returned 0xd20000 [0107.918] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.918] GetProcessHeap () returned 0xd20000 [0107.918] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.918] GetProcessHeap () returned 0xd20000 [0107.918] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0107.918] GetProcessHeap () returned 0xd20000 [0107.918] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0107.918] GetProcessHeap () returned 0xd20000 [0107.918] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0107.918] GetProcessHeap () returned 0xd20000 [0107.918] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0107.918] GetProcessHeap () returned 0xd20000 [0107.918] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0107.918] GetProcessHeap () returned 0xd20000 [0107.918] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0107.919] GetProcessHeap () returned 0xd20000 [0107.919] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0107.919] GetProcessHeap () returned 0xd20000 [0107.919] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0107.919] GetProcessHeap () returned 0xd20000 [0107.919] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.919] GetProcessHeap () returned 0xd20000 [0107.919] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.919] GetProcessHeap () returned 0xd20000 [0107.919] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce38 [0107.919] GetProcessHeap () returned 0xd20000 [0107.919] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce38 | out: hHeap=0xd20000) returned 1 [0107.919] GetProcessHeap () returned 0xd20000 [0107.919] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.919] GetProcessHeap () returned 0xd20000 [0107.919] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.919] GetProcessHeap () returned 0xd20000 [0107.919] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0107.919] GetProcessHeap () returned 0xd20000 [0107.919] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0107.920] GetProcessHeap () returned 0xd20000 [0107.920] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce68 [0107.920] GetProcessHeap () returned 0xd20000 [0107.920] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce68 | out: hHeap=0xd20000) returned 1 [0107.920] GetProcessHeap () returned 0xd20000 [0107.920] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce38 [0107.920] GetProcessHeap () returned 0xd20000 [0107.920] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce38 | out: hHeap=0xd20000) returned 1 [0107.920] GetProcessHeap () returned 0xd20000 [0107.920] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0107.920] GetProcessHeap () returned 0xd20000 [0107.920] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0107.920] GetProcessHeap () returned 0xd20000 [0107.920] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf78 [0107.920] GetProcessHeap () returned 0xd20000 [0107.920] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf78 | out: hHeap=0xd20000) returned 1 [0107.920] GetProcessHeap () returned 0xd20000 [0107.920] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.920] GetProcessHeap () returned 0xd20000 [0107.920] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.921] GetProcessHeap () returned 0xd20000 [0107.921] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0107.921] GetProcessHeap () returned 0xd20000 [0107.921] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0107.921] GetProcessHeap () returned 0xd20000 [0107.921] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0107.921] GetProcessHeap () returned 0xd20000 [0107.921] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0107.921] GetProcessHeap () returned 0xd20000 [0107.921] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0107.921] GetProcessHeap () returned 0xd20000 [0107.921] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0107.921] GetProcessHeap () returned 0xd20000 [0107.921] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0107.921] GetProcessHeap () returned 0xd20000 [0107.921] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0107.921] GetProcessHeap () returned 0xd20000 [0107.921] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.921] GetProcessHeap () returned 0xd20000 [0107.921] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.922] GetProcessHeap () returned 0xd20000 [0107.922] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0107.922] GetProcessHeap () returned 0xd20000 [0107.922] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0107.922] GetProcessHeap () returned 0xd20000 [0107.922] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.922] GetProcessHeap () returned 0xd20000 [0107.922] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.922] GetProcessHeap () returned 0xd20000 [0107.922] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0107.922] GetProcessHeap () returned 0xd20000 [0107.922] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0107.922] GetProcessHeap () returned 0xd20000 [0107.922] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0107.922] GetProcessHeap () returned 0xd20000 [0107.922] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0107.922] GetProcessHeap () returned 0xd20000 [0107.922] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0107.922] GetProcessHeap () returned 0xd20000 [0107.922] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0107.923] GetProcessHeap () returned 0xd20000 [0107.923] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0107.923] GetProcessHeap () returned 0xd20000 [0107.923] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0107.923] GetProcessHeap () returned 0xd20000 [0107.923] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0107.923] GetProcessHeap () returned 0xd20000 [0107.923] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0107.923] GetProcessHeap () returned 0xd20000 [0107.923] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0107.923] GetProcessHeap () returned 0xd20000 [0107.923] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0107.923] GetProcessHeap () returned 0xd20000 [0107.923] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0107.923] GetProcessHeap () returned 0xd20000 [0107.923] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0107.923] GetProcessHeap () returned 0xd20000 [0107.923] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446c0 | out: hHeap=0xd20000) returned 1 [0107.923] GetProcessHeap () returned 0xd20000 [0107.924] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0107.924] GetProcessHeap () returned 0xd20000 [0107.924] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0107.924] GetProcessHeap () returned 0xd20000 [0107.924] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ac18 | out: hHeap=0xd20000) returned 1 [0107.924] GetProcessHeap () returned 0xd20000 [0107.924] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0107.924] GetProcessHeap () returned 0xd20000 [0107.924] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0107.924] GetProcessHeap () returned 0xd20000 [0107.924] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0107.924] WriteFile (in: hFile=0x230, lpBuffer=0xd4f230*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f230*, lpNumberOfBytesWritten=0x299d864*=0x388, lpOverlapped=0x0) returned 1 [0107.933] GetProcessHeap () returned 0xd20000 [0107.933] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4f230, Size=0x30) returned 0xd4f230 [0107.933] GetProcessHeap () returned 0xd20000 [0107.933] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0107.933] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0107.933] GetProcessHeap () returned 0xd20000 [0107.933] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x100) returned 0xd2fbe0 [0107.933] ReadFile (in: hFile=0x230, lpBuffer=0xd2fbe0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd2fbe0*, lpNumberOfBytesRead=0x299d7e8*=0x100, lpOverlapped=0x0) returned 1 [0107.933] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0107.933] WriteFile (in: hFile=0x230, lpBuffer=0xd2fbe0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd2fbe0*, lpNumberOfBytesWritten=0x299d7e4*=0x100, lpOverlapped=0x0) returned 1 [0107.934] GetProcessHeap () returned 0xd20000 [0107.934] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2fbe0 | out: hHeap=0xd20000) returned 1 [0107.934] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0107.935] WriteFile (in: hFile=0x230, lpBuffer=0xd4f230*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f230*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0107.936] CloseHandle (hObject=0x230) returned 1 [0107.941] GetProcessHeap () returned 0xd20000 [0107.941] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42558 | out: hHeap=0xd20000) returned 1 [0107.941] GetProcessHeap () returned 0xd20000 [0107.941] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bff8 | out: hHeap=0xd20000) returned 1 [0107.941] GetProcessHeap () returned 0xd20000 [0107.941] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0107.941] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms") returned="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" [0107.941] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms.[ponce.lorena@aol.com]" [0107.941] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\everywhere.search-ms"), lpNewFileName="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\searches\\everywhere.search-ms.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0107.942] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Searches\\Everywhere.search-ms" | out: pszPath="C:\\Users\\FD1HVy\\Searches") returned 1 [0107.942] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Searches" | out: pszPath="C:\\Users\\FD1HVy\\Searches\\") returned="" [0107.942] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Searches\\HOW_RECOVER.html" [0107.942] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\searches\\how_recover.html")) returned 0xffffffff [0107.942] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\searches\\how_recover.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0107.942] GetProcessHeap () returned 0xd20000 [0107.942] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bd28 [0107.942] GetProcessHeap () returned 0xd20000 [0107.943] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0107.953] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.955] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.955] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.955] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.956] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.956] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.956] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.956] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.956] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.956] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.956] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.956] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.957] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.957] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.957] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.957] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.957] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.957] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.957] GetProcessHeap () returned 0xd20000 [0107.957] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bd28 | out: hHeap=0xd20000) returned 1 [0107.957] GetProcessHeap () returned 0xd20000 [0107.957] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0107.957] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x299d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x299d9d0*=0x300, lpOverlapped=0x0) returned 1 [0107.958] GetProcessHeap () returned 0xd20000 [0107.958] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bd28 [0107.958] GetProcessHeap () returned 0xd20000 [0107.958] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0107.969] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.970] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.970] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.970] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.970] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.970] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.970] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.970] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.971] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.971] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.971] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.971] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.971] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.971] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.971] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.971] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.972] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.972] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.972] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.972] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.972] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.972] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.972] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.972] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.973] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.973] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.973] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.973] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.973] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.973] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.973] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.973] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.973] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.974] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.974] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.974] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.974] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.974] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.974] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.974] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.974] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.975] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.975] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.975] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.975] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.975] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.975] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.975] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.975] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.976] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.976] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.976] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.976] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.976] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.976] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.976] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.976] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.977] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.977] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.977] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.977] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.977] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.977] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.977] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.977] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.977] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.978] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.978] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.978] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.978] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.978] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0107.978] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.050] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.051] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.051] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.051] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.051] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.051] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.051] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.051] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.051] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.052] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.052] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.052] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.052] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.052] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.052] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.052] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.052] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.053] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.053] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.053] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.053] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.053] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.053] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.053] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.053] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.054] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.054] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.054] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.054] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.054] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.054] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.055] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.055] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.055] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.055] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.055] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.055] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.055] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.055] GetProcessHeap () returned 0xd20000 [0108.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bd28 | out: hHeap=0xd20000) returned 1 [0108.056] GetProcessHeap () returned 0xd20000 [0108.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0108.056] CloseHandle (hObject=0x230) returned 1 [0108.056] GetProcessHeap () returned 0xd20000 [0108.056] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd364c8 | out: hHeap=0xd20000) returned 1 [0108.056] FindNextFileW (in: hFindFile=0xd490e0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x44242e24, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44242e24, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x44242e24, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0108.056] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2=".") returned 1 [0108.057] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="..") returned 1 [0108.057] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="Indexed Locations.search-ms" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms") returned="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" [0108.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Indexed Locations.search-ms", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 28 [0108.057] GetProcessHeap () returned 0xd20000 [0108.057] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1c) returned 0xd42760 [0108.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Indexed Locations.search-ms", cchWideChar=-1, lpMultiByteStr=0xd42760, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Indexed Locations.search-ms", lpUsedDefaultChar=0x0) returned 28 [0108.058] lstrlenA (lpString="Indexed Locations.search-ms") returned 27 [0108.058] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0108.058] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0108.058] lstrlenA (lpString="Indexed Locations.search-ms") returned 27 [0108.058] lstrcmpiA (lpString1="xed Locations.search-ms", lpString2=".[ponce.lorena@aol.com]") returned 1 [0108.058] lstrlenA (lpString="Indexed Locations.search-ms") returned 27 [0108.058] lstrlenA (lpString=".dll") returned 4 [0108.058] lstrlenA (lpString=".dll") returned 4 [0108.058] lstrlenA (lpString="Indexed Locations.search-ms") returned 27 [0108.058] lstrcmpiA (lpString1="h-ms", lpString2=".dll") returned 1 [0108.058] lstrlenA (lpString="Indexed Locations.search-ms") returned 27 [0108.058] lstrlenA (lpString=".ini") returned 4 [0108.058] lstrlenA (lpString=".ini") returned 4 [0108.058] lstrlenA (lpString="Indexed Locations.search-ms") returned 27 [0108.058] lstrcmpiA (lpString1="h-ms", lpString2=".ini") returned 1 [0108.058] lstrlenA (lpString="Indexed Locations.search-ms") returned 27 [0108.058] lstrlenA (lpString=".inc") returned 4 [0108.058] lstrlenA (lpString=".inc") returned 4 [0108.058] lstrlenA (lpString="Indexed Locations.search-ms") returned 27 [0108.059] lstrcmpiA (lpString1="h-ms", lpString2=".inc") returned 1 [0108.059] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="HOW_RECOVER.html") returned 1 [0108.059] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0108.059] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0108.059] lstrcmpiW (lpString1="Indexed Locations.search-ms", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0108.059] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", dwFileAttributes=0x22) returned 1 [0108.059] GetProcessHeap () returned 0xd20000 [0108.059] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd426c0 [0108.060] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\indexed locations.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0108.060] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=248) returned 1 [0108.060] GetProcessHeap () returned 0xd20000 [0108.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4be18 [0108.060] GetProcessHeap () returned 0xd20000 [0108.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0108.060] lstrlenW (lpString="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms") returned 52 [0108.060] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0108.060] GetProcessHeap () returned 0xd20000 [0108.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0108.060] GetProcessHeap () returned 0xd20000 [0108.060] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x388) returned 0xd4f268 [0108.060] lstrlenA (lpString="rsa_encrypt") returned 11 [0108.061] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0108.063] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0108.063] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0108.063] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0108.063] GetProcessHeap () returned 0xd20000 [0108.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0108.063] lstrlenA (lpString="010001") returned 6 [0108.063] GetProcessHeap () returned 0xd20000 [0108.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cdc8 [0108.063] GetProcessHeap () returned 0xd20000 [0108.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0108.063] GetProcessHeap () returned 0xd20000 [0108.063] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0108.063] GetProcessHeap () returned 0xd20000 [0108.063] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0108.064] GetProcessHeap () returned 0xd20000 [0108.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aee8 [0108.064] GetProcessHeap () returned 0xd20000 [0108.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45528 [0108.064] GetProcessHeap () returned 0xd20000 [0108.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3ce48 [0108.064] GetProcessHeap () returned 0xd20000 [0108.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0108.064] GetProcessHeap () returned 0xd20000 [0108.064] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0108.064] GetProcessHeap () returned 0xd20000 [0108.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0108.064] GetProcessHeap () returned 0xd20000 [0108.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0108.064] GetProcessHeap () returned 0xd20000 [0108.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd452f8 [0108.064] GetProcessHeap () returned 0xd20000 [0108.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0108.064] GetProcessHeap () returned 0xd20000 [0108.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446a8 [0108.064] GetProcessHeap () returned 0xd20000 [0108.064] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aca8 [0108.065] GetProcessHeap () returned 0xd20000 [0108.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0108.065] GetProcessHeap () returned 0xd20000 [0108.065] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0108.065] GetProcessHeap () returned 0xd20000 [0108.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aca8 | out: hHeap=0xd20000) returned 1 [0108.065] GetProcessHeap () returned 0xd20000 [0108.065] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce68 [0108.065] GetProcessHeap () returned 0xd20000 [0108.065] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44618 [0108.065] GetProcessHeap () returned 0xd20000 [0108.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0108.065] GetProcessHeap () returned 0xd20000 [0108.065] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce68 | out: hHeap=0xd20000) returned 1 [0108.065] GetProcessHeap () returned 0xd20000 [0108.065] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0108.065] GetProcessHeap () returned 0xd20000 [0108.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0108.066] GetProcessHeap () returned 0xd20000 [0108.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0108.066] GetProcessHeap () returned 0xd20000 [0108.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0108.066] GetProcessHeap () returned 0xd20000 [0108.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b7e8 [0108.066] GetProcessHeap () returned 0xd20000 [0108.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44618 | out: hHeap=0xd20000) returned 1 [0108.066] GetProcessHeap () returned 0xd20000 [0108.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0108.066] GetProcessHeap () returned 0xd20000 [0108.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0108.066] GetProcessHeap () returned 0xd20000 [0108.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0108.066] GetProcessHeap () returned 0xd20000 [0108.066] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0108.066] GetProcessHeap () returned 0xd20000 [0108.066] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0108.067] GetProcessHeap () returned 0xd20000 [0108.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0108.067] GetProcessHeap () returned 0xd20000 [0108.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf28 [0108.067] GetProcessHeap () returned 0xd20000 [0108.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf28 | out: hHeap=0xd20000) returned 1 [0108.067] GetProcessHeap () returned 0xd20000 [0108.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0108.067] GetProcessHeap () returned 0xd20000 [0108.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0108.067] GetProcessHeap () returned 0xd20000 [0108.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf78 [0108.067] GetProcessHeap () returned 0xd20000 [0108.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf78 | out: hHeap=0xd20000) returned 1 [0108.067] GetProcessHeap () returned 0xd20000 [0108.067] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0108.067] GetProcessHeap () returned 0xd20000 [0108.067] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0108.067] GetProcessHeap () returned 0xd20000 [0108.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf78 [0108.068] GetProcessHeap () returned 0xd20000 [0108.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf78 | out: hHeap=0xd20000) returned 1 [0108.068] GetProcessHeap () returned 0xd20000 [0108.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0108.068] GetProcessHeap () returned 0xd20000 [0108.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0108.068] GetProcessHeap () returned 0xd20000 [0108.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0108.068] GetProcessHeap () returned 0xd20000 [0108.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0108.068] GetProcessHeap () returned 0xd20000 [0108.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf78 [0108.068] GetProcessHeap () returned 0xd20000 [0108.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf78 | out: hHeap=0xd20000) returned 1 [0108.068] GetProcessHeap () returned 0xd20000 [0108.068] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0108.068] GetProcessHeap () returned 0xd20000 [0108.068] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0108.069] GetProcessHeap () returned 0xd20000 [0108.069] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0108.069] GetProcessHeap () returned 0xd20000 [0108.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0108.069] GetProcessHeap () returned 0xd20000 [0108.069] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf78 [0108.069] GetProcessHeap () returned 0xd20000 [0108.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf78 | out: hHeap=0xd20000) returned 1 [0108.069] GetProcessHeap () returned 0xd20000 [0108.069] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0108.069] GetProcessHeap () returned 0xd20000 [0108.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0108.069] GetProcessHeap () returned 0xd20000 [0108.069] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf78 [0108.069] GetProcessHeap () returned 0xd20000 [0108.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf78 | out: hHeap=0xd20000) returned 1 [0108.069] GetProcessHeap () returned 0xd20000 [0108.069] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0108.069] GetProcessHeap () returned 0xd20000 [0108.069] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0108.070] GetProcessHeap () returned 0xd20000 [0108.070] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0108.070] GetProcessHeap () returned 0xd20000 [0108.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0108.070] GetProcessHeap () returned 0xd20000 [0108.070] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0108.070] GetProcessHeap () returned 0xd20000 [0108.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0108.070] GetProcessHeap () returned 0xd20000 [0108.070] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0108.070] GetProcessHeap () returned 0xd20000 [0108.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0108.070] GetProcessHeap () returned 0xd20000 [0108.070] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0108.070] GetProcessHeap () returned 0xd20000 [0108.070] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0108.070] GetProcessHeap () returned 0xd20000 [0108.070] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0108.070] GetProcessHeap () returned 0xd20000 [0108.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0108.071] GetProcessHeap () returned 0xd20000 [0108.071] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce68 [0108.071] GetProcessHeap () returned 0xd20000 [0108.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce68 | out: hHeap=0xd20000) returned 1 [0108.071] GetProcessHeap () returned 0xd20000 [0108.071] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0108.071] GetProcessHeap () returned 0xd20000 [0108.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0108.071] GetProcessHeap () returned 0xd20000 [0108.071] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0108.071] GetProcessHeap () returned 0xd20000 [0108.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0108.071] GetProcessHeap () returned 0xd20000 [0108.071] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0108.071] GetProcessHeap () returned 0xd20000 [0108.071] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0108.071] GetProcessHeap () returned 0xd20000 [0108.071] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0108.071] GetProcessHeap () returned 0xd20000 [0108.072] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0108.072] GetProcessHeap () returned 0xd20000 [0108.072] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0108.072] GetProcessHeap () returned 0xd20000 [0108.072] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0108.072] GetProcessHeap () returned 0xd20000 [0108.072] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0108.072] GetProcessHeap () returned 0xd20000 [0108.072] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0108.072] GetProcessHeap () returned 0xd20000 [0108.072] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0108.072] GetProcessHeap () returned 0xd20000 [0108.072] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0108.072] GetProcessHeap () returned 0xd20000 [0108.072] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0108.072] GetProcessHeap () returned 0xd20000 [0108.072] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0108.072] GetProcessHeap () returned 0xd20000 [0108.072] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0108.072] GetProcessHeap () returned 0xd20000 [0108.072] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0108.073] GetProcessHeap () returned 0xd20000 [0108.073] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0108.073] GetProcessHeap () returned 0xd20000 [0108.073] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0108.073] GetProcessHeap () returned 0xd20000 [0108.073] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf78 [0108.073] GetProcessHeap () returned 0xd20000 [0108.073] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf78 | out: hHeap=0xd20000) returned 1 [0108.073] GetProcessHeap () returned 0xd20000 [0108.073] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0108.073] GetProcessHeap () returned 0xd20000 [0108.073] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0108.073] GetProcessHeap () returned 0xd20000 [0108.073] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0108.073] GetProcessHeap () returned 0xd20000 [0108.073] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0108.074] GetProcessHeap () returned 0xd20000 [0108.074] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0108.074] GetProcessHeap () returned 0xd20000 [0108.074] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0108.074] GetProcessHeap () returned 0xd20000 [0108.074] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0108.074] GetProcessHeap () returned 0xd20000 [0108.074] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0108.074] GetProcessHeap () returned 0xd20000 [0108.074] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0108.074] GetProcessHeap () returned 0xd20000 [0108.074] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0108.074] GetProcessHeap () returned 0xd20000 [0108.074] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0108.074] GetProcessHeap () returned 0xd20000 [0108.074] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0108.075] GetProcessHeap () returned 0xd20000 [0108.075] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0108.075] GetProcessHeap () returned 0xd20000 [0108.075] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0108.075] GetProcessHeap () returned 0xd20000 [0108.075] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0108.075] GetProcessHeap () returned 0xd20000 [0108.075] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0108.075] GetProcessHeap () returned 0xd20000 [0108.075] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0108.075] GetProcessHeap () returned 0xd20000 [0108.075] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0108.075] GetProcessHeap () returned 0xd20000 [0108.075] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce38 [0108.075] GetProcessHeap () returned 0xd20000 [0108.075] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce38 | out: hHeap=0xd20000) returned 1 [0108.075] GetProcessHeap () returned 0xd20000 [0108.075] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0108.075] GetProcessHeap () returned 0xd20000 [0108.075] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0108.076] GetProcessHeap () returned 0xd20000 [0108.076] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0108.076] GetProcessHeap () returned 0xd20000 [0108.076] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0108.076] GetProcessHeap () returned 0xd20000 [0108.076] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0108.076] GetProcessHeap () returned 0xd20000 [0108.076] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0108.076] GetProcessHeap () returned 0xd20000 [0108.076] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf78 [0108.076] GetProcessHeap () returned 0xd20000 [0108.076] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf78 | out: hHeap=0xd20000) returned 1 [0108.076] GetProcessHeap () returned 0xd20000 [0108.076] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0108.076] GetProcessHeap () returned 0xd20000 [0108.076] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0108.076] GetProcessHeap () returned 0xd20000 [0108.076] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0108.076] GetProcessHeap () returned 0xd20000 [0108.076] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0108.076] GetProcessHeap () returned 0xd20000 [0108.076] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0108.077] GetProcessHeap () returned 0xd20000 [0108.077] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0108.077] GetProcessHeap () returned 0xd20000 [0108.077] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce68 [0108.077] GetProcessHeap () returned 0xd20000 [0108.077] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce68 | out: hHeap=0xd20000) returned 1 [0108.077] GetProcessHeap () returned 0xd20000 [0108.077] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0108.077] GetProcessHeap () returned 0xd20000 [0108.077] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0108.077] GetProcessHeap () returned 0xd20000 [0108.077] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0108.077] GetProcessHeap () returned 0xd20000 [0108.077] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0108.077] GetProcessHeap () returned 0xd20000 [0108.077] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf28 [0108.077] GetProcessHeap () returned 0xd20000 [0108.077] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf28 | out: hHeap=0xd20000) returned 1 [0108.077] GetProcessHeap () returned 0xd20000 [0108.077] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0108.077] GetProcessHeap () returned 0xd20000 [0108.078] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0108.078] GetProcessHeap () returned 0xd20000 [0108.078] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0108.078] GetProcessHeap () returned 0xd20000 [0108.078] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0108.078] GetProcessHeap () returned 0xd20000 [0108.078] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0108.078] GetProcessHeap () returned 0xd20000 [0108.078] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0108.078] GetProcessHeap () returned 0xd20000 [0108.078] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0108.078] GetProcessHeap () returned 0xd20000 [0108.078] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0108.078] GetProcessHeap () returned 0xd20000 [0108.078] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf28 [0108.078] GetProcessHeap () returned 0xd20000 [0108.078] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf28 | out: hHeap=0xd20000) returned 1 [0108.078] GetProcessHeap () returned 0xd20000 [0108.078] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce68 [0108.078] GetProcessHeap () returned 0xd20000 [0108.078] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce68 | out: hHeap=0xd20000) returned 1 [0108.079] GetProcessHeap () returned 0xd20000 [0108.079] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0108.079] GetProcessHeap () returned 0xd20000 [0108.079] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0108.079] GetProcessHeap () returned 0xd20000 [0108.079] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0108.079] GetProcessHeap () returned 0xd20000 [0108.079] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0108.079] GetProcessHeap () returned 0xd20000 [0108.079] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0108.079] GetProcessHeap () returned 0xd20000 [0108.079] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0108.079] GetProcessHeap () returned 0xd20000 [0108.079] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0108.079] GetProcessHeap () returned 0xd20000 [0108.079] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0108.079] GetProcessHeap () returned 0xd20000 [0108.079] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0108.079] GetProcessHeap () returned 0xd20000 [0108.080] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0108.080] GetProcessHeap () returned 0xd20000 [0108.080] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0108.080] GetProcessHeap () returned 0xd20000 [0108.080] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0108.080] GetProcessHeap () returned 0xd20000 [0108.080] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0108.080] GetProcessHeap () returned 0xd20000 [0108.080] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0108.080] GetProcessHeap () returned 0xd20000 [0108.080] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0108.080] GetProcessHeap () returned 0xd20000 [0108.080] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0108.080] GetProcessHeap () returned 0xd20000 [0108.080] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0108.080] GetProcessHeap () returned 0xd20000 [0108.080] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0108.080] GetProcessHeap () returned 0xd20000 [0108.080] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0108.080] GetProcessHeap () returned 0xd20000 [0108.080] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0108.081] GetProcessHeap () returned 0xd20000 [0108.081] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0108.081] GetProcessHeap () returned 0xd20000 [0108.081] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0108.081] GetProcessHeap () returned 0xd20000 [0108.081] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0108.081] GetProcessHeap () returned 0xd20000 [0108.081] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0108.081] GetProcessHeap () returned 0xd20000 [0108.081] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0108.081] GetProcessHeap () returned 0xd20000 [0108.081] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0108.081] GetProcessHeap () returned 0xd20000 [0108.081] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0108.081] GetProcessHeap () returned 0xd20000 [0108.081] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0108.081] GetProcessHeap () returned 0xd20000 [0108.081] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf08 [0108.081] GetProcessHeap () returned 0xd20000 [0108.081] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0108.081] GetProcessHeap () returned 0xd20000 [0108.082] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0108.082] GetProcessHeap () returned 0xd20000 [0108.082] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0108.082] GetProcessHeap () returned 0xd20000 [0108.082] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0108.082] GetProcessHeap () returned 0xd20000 [0108.082] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0108.082] GetProcessHeap () returned 0xd20000 [0108.082] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0108.082] GetProcessHeap () returned 0xd20000 [0108.082] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0108.082] GetProcessHeap () returned 0xd20000 [0108.082] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0108.082] GetProcessHeap () returned 0xd20000 [0108.082] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0108.082] GetProcessHeap () returned 0xd20000 [0108.082] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce38 [0108.082] GetProcessHeap () returned 0xd20000 [0108.082] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce38 | out: hHeap=0xd20000) returned 1 [0108.082] GetProcessHeap () returned 0xd20000 [0108.082] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf28 [0108.083] GetProcessHeap () returned 0xd20000 [0108.083] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf28 | out: hHeap=0xd20000) returned 1 [0108.083] GetProcessHeap () returned 0xd20000 [0108.083] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0108.083] GetProcessHeap () returned 0xd20000 [0108.083] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0108.083] GetProcessHeap () returned 0xd20000 [0108.083] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0108.083] GetProcessHeap () returned 0xd20000 [0108.083] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0108.083] GetProcessHeap () returned 0xd20000 [0108.083] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0108.083] GetProcessHeap () returned 0xd20000 [0108.083] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0108.083] GetProcessHeap () returned 0xd20000 [0108.083] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0108.083] GetProcessHeap () returned 0xd20000 [0108.083] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0108.083] GetProcessHeap () returned 0xd20000 [0108.083] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0108.084] GetProcessHeap () returned 0xd20000 [0108.084] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0108.084] GetProcessHeap () returned 0xd20000 [0108.084] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0108.084] GetProcessHeap () returned 0xd20000 [0108.084] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0108.084] GetProcessHeap () returned 0xd20000 [0108.084] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446a8 | out: hHeap=0xd20000) returned 1 [0108.084] GetProcessHeap () returned 0xd20000 [0108.084] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aee8 | out: hHeap=0xd20000) returned 1 [0108.084] GetProcessHeap () returned 0xd20000 [0108.084] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0108.084] GetProcessHeap () returned 0xd20000 [0108.084] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0108.084] GetProcessHeap () returned 0xd20000 [0108.084] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0108.084] GetProcessHeap () returned 0xd20000 [0108.084] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0108.084] GetProcessHeap () returned 0xd20000 [0108.084] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0108.085] WriteFile (in: hFile=0x230, lpBuffer=0xd4f268*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f268*, lpNumberOfBytesWritten=0x299d864*=0x388, lpOverlapped=0x0) returned 1 [0108.091] GetProcessHeap () returned 0xd20000 [0108.092] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4f268, Size=0x30) returned 0xd4f268 [0108.092] GetProcessHeap () returned 0xd20000 [0108.092] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0108.092] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0108.092] GetProcessHeap () returned 0xd20000 [0108.092] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x100) returned 0xd2fbe0 [0108.092] ReadFile (in: hFile=0x230, lpBuffer=0xd2fbe0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd2fbe0*, lpNumberOfBytesRead=0x299d7e8*=0x100, lpOverlapped=0x0) returned 1 [0108.092] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0108.092] WriteFile (in: hFile=0x230, lpBuffer=0xd2fbe0*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd2fbe0*, lpNumberOfBytesWritten=0x299d7e4*=0x100, lpOverlapped=0x0) returned 1 [0108.094] GetProcessHeap () returned 0xd20000 [0108.094] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2fbe0 | out: hHeap=0xd20000) returned 1 [0108.094] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0108.094] WriteFile (in: hFile=0x230, lpBuffer=0xd4f268*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f268*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0108.095] CloseHandle (hObject=0x230) returned 1 [0108.101] GetProcessHeap () returned 0xd20000 [0108.101] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd426c0 | out: hHeap=0xd20000) returned 1 [0108.101] GetProcessHeap () returned 0xd20000 [0108.101] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4be18 | out: hHeap=0xd20000) returned 1 [0108.101] GetProcessHeap () returned 0xd20000 [0108.101] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0108.101] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms") returned="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" [0108.101] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms.[ponce.lorena@aol.com]" [0108.101] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\fd1hvy\\searches\\indexed locations.search-ms"), lpNewFileName="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\searches\\indexed locations.search-ms.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0108.102] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Searches\\Indexed Locations.search-ms" | out: pszPath="C:\\Users\\FD1HVy\\Searches") returned 1 [0108.102] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Searches" | out: pszPath="C:\\Users\\FD1HVy\\Searches\\") returned="" [0108.102] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Searches\\HOW_RECOVER.html" [0108.102] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\searches\\how_recover.html")) returned 0x20 [0108.102] GetProcessHeap () returned 0xd20000 [0108.102] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42760 | out: hHeap=0xd20000) returned 1 [0108.102] FindNextFileW (in: hFindFile=0xd490e0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 1 [0108.102] lstrcmpiW (lpString1="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", lpString2=".") returned 1 [0108.102] lstrcmpiW (lpString1="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", lpString2="..") returned 1 [0108.102] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms") returned="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" [0108.102] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 75 [0108.102] GetProcessHeap () returned 0xd20000 [0108.102] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4b) returned 0xd2e898 [0108.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cchWideChar=-1, lpMultiByteStr=0xd2e898, cbMultiByte=75, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", lpUsedDefaultChar=0x0) returned 75 [0108.103] lstrlenA (lpString="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms") returned 74 [0108.103] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0108.103] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0108.103] lstrlenA (lpString="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms") returned 74 [0108.103] lstrcmpiA (lpString1="00}-.searchconnector-ms", lpString2=".[ponce.lorena@aol.com]") returned 1 [0108.103] lstrlenA (lpString="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms") returned 74 [0108.103] lstrlenA (lpString=".dll") returned 4 [0108.103] lstrlenA (lpString=".dll") returned 4 [0108.103] lstrlenA (lpString="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms") returned 74 [0108.103] lstrcmpiA (lpString1="r-ms", lpString2=".dll") returned 1 [0108.103] lstrlenA (lpString="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms") returned 74 [0108.103] lstrlenA (lpString=".ini") returned 4 [0108.103] lstrlenA (lpString=".ini") returned 4 [0108.103] lstrlenA (lpString="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms") returned 74 [0108.103] lstrcmpiA (lpString1="r-ms", lpString2=".ini") returned 1 [0108.104] lstrlenA (lpString="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms") returned 74 [0108.104] lstrlenA (lpString=".inc") returned 4 [0108.104] lstrlenA (lpString=".inc") returned 4 [0108.104] lstrlenA (lpString="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms") returned 74 [0108.104] lstrcmpiA (lpString1="r-ms", lpString2=".inc") returned 1 [0108.104] lstrcmpiW (lpString1="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", lpString2="HOW_RECOVER.html") returned 1 [0108.104] lstrcmpiW (lpString1="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0108.104] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0108.104] lstrcmpiW (lpString1="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0108.104] GetProcessHeap () returned 0xd20000 [0108.104] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42760 [0108.104] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0108.126] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=855) returned 1 [0108.126] GetProcessHeap () returned 0xd20000 [0108.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bf80 [0108.126] GetProcessHeap () returned 0xd20000 [0108.126] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0108.126] lstrlenW (lpString="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms") returned 99 [0108.126] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0108.127] GetProcessHeap () returned 0xd20000 [0108.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0108.127] GetProcessHeap () returned 0xd20000 [0108.127] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x389) returned 0xd4f2a0 [0108.127] lstrlenA (lpString="rsa_encrypt") returned 11 [0108.127] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0108.129] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0108.129] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0108.129] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0108.129] GetProcessHeap () returned 0xd20000 [0108.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0108.129] lstrlenA (lpString="010001") returned 6 [0108.129] GetProcessHeap () returned 0xd20000 [0108.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cf08 [0108.129] GetProcessHeap () returned 0xd20000 [0108.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0108.129] GetProcessHeap () returned 0xd20000 [0108.129] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aa68 [0108.129] GetProcessHeap () returned 0xd20000 [0108.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0108.130] GetProcessHeap () returned 0xd20000 [0108.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b7e8 [0108.130] GetProcessHeap () returned 0xd20000 [0108.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44920 [0108.130] GetProcessHeap () returned 0xd20000 [0108.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cf28 [0108.130] GetProcessHeap () returned 0xd20000 [0108.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0108.130] GetProcessHeap () returned 0xd20000 [0108.130] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf28 | out: hHeap=0xd20000) returned 1 [0108.130] GetProcessHeap () returned 0xd20000 [0108.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0108.130] GetProcessHeap () returned 0xd20000 [0108.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0108.130] GetProcessHeap () returned 0xd20000 [0108.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd45528 [0108.130] GetProcessHeap () returned 0xd20000 [0108.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0108.130] GetProcessHeap () returned 0xd20000 [0108.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44408 [0108.130] GetProcessHeap () returned 0xd20000 [0108.130] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aca8 [0108.131] GetProcessHeap () returned 0xd20000 [0108.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0108.131] GetProcessHeap () returned 0xd20000 [0108.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0108.131] GetProcessHeap () returned 0xd20000 [0108.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aca8 | out: hHeap=0xd20000) returned 1 [0108.131] GetProcessHeap () returned 0xd20000 [0108.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0108.131] GetProcessHeap () returned 0xd20000 [0108.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44630 [0108.131] GetProcessHeap () returned 0xd20000 [0108.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0108.131] GetProcessHeap () returned 0xd20000 [0108.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0108.131] GetProcessHeap () returned 0xd20000 [0108.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce58 [0108.131] GetProcessHeap () returned 0xd20000 [0108.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce58 | out: hHeap=0xd20000) returned 1 [0108.131] GetProcessHeap () returned 0xd20000 [0108.131] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0108.131] GetProcessHeap () returned 0xd20000 [0108.131] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0108.132] GetProcessHeap () returned 0xd20000 [0108.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b008 [0108.132] GetProcessHeap () returned 0xd20000 [0108.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44630 | out: hHeap=0xd20000) returned 1 [0108.132] GetProcessHeap () returned 0xd20000 [0108.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0108.132] GetProcessHeap () returned 0xd20000 [0108.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b008 | out: hHeap=0xd20000) returned 1 [0108.132] GetProcessHeap () returned 0xd20000 [0108.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0108.132] GetProcessHeap () returned 0xd20000 [0108.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0108.132] GetProcessHeap () returned 0xd20000 [0108.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0108.132] GetProcessHeap () returned 0xd20000 [0108.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0108.132] GetProcessHeap () returned 0xd20000 [0108.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0108.132] GetProcessHeap () returned 0xd20000 [0108.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0108.132] GetProcessHeap () returned 0xd20000 [0108.132] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0108.133] GetProcessHeap () returned 0xd20000 [0108.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0108.133] GetProcessHeap () returned 0xd20000 [0108.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0108.133] GetProcessHeap () returned 0xd20000 [0108.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0108.133] GetProcessHeap () returned 0xd20000 [0108.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0108.133] GetProcessHeap () returned 0xd20000 [0108.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0108.133] GetProcessHeap () returned 0xd20000 [0108.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf78 [0108.133] GetProcessHeap () returned 0xd20000 [0108.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf78 | out: hHeap=0xd20000) returned 1 [0108.133] GetProcessHeap () returned 0xd20000 [0108.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce68 [0108.133] GetProcessHeap () returned 0xd20000 [0108.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce68 | out: hHeap=0xd20000) returned 1 [0108.133] GetProcessHeap () returned 0xd20000 [0108.133] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0108.133] GetProcessHeap () returned 0xd20000 [0108.133] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0108.133] GetProcessHeap () returned 0xd20000 [0108.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0108.134] GetProcessHeap () returned 0xd20000 [0108.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0108.134] GetProcessHeap () returned 0xd20000 [0108.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0108.134] GetProcessHeap () returned 0xd20000 [0108.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0108.134] GetProcessHeap () returned 0xd20000 [0108.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0108.134] GetProcessHeap () returned 0xd20000 [0108.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0108.134] GetProcessHeap () returned 0xd20000 [0108.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce38 [0108.134] GetProcessHeap () returned 0xd20000 [0108.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce38 | out: hHeap=0xd20000) returned 1 [0108.134] GetProcessHeap () returned 0xd20000 [0108.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0108.134] GetProcessHeap () returned 0xd20000 [0108.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0108.134] GetProcessHeap () returned 0xd20000 [0108.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0108.134] GetProcessHeap () returned 0xd20000 [0108.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0108.135] GetProcessHeap () returned 0xd20000 [0108.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0108.135] GetProcessHeap () returned 0xd20000 [0108.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0108.135] GetProcessHeap () returned 0xd20000 [0108.135] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0108.135] GetProcessHeap () returned 0xd20000 [0108.135] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0108.136] GetProcessHeap () returned 0xd20000 [0108.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0108.136] GetProcessHeap () returned 0xd20000 [0108.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0108.136] GetProcessHeap () returned 0xd20000 [0108.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0108.136] GetProcessHeap () returned 0xd20000 [0108.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0108.136] GetProcessHeap () returned 0xd20000 [0108.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0108.136] GetProcessHeap () returned 0xd20000 [0108.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0108.136] GetProcessHeap () returned 0xd20000 [0108.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf78 [0108.136] GetProcessHeap () returned 0xd20000 [0108.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf78 | out: hHeap=0xd20000) returned 1 [0108.136] GetProcessHeap () returned 0xd20000 [0108.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0108.136] GetProcessHeap () returned 0xd20000 [0108.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0108.136] GetProcessHeap () returned 0xd20000 [0108.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0108.136] GetProcessHeap () returned 0xd20000 [0108.136] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0108.136] GetProcessHeap () returned 0xd20000 [0108.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0108.137] GetProcessHeap () returned 0xd20000 [0108.137] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0108.137] GetProcessHeap () returned 0xd20000 [0108.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0108.137] GetProcessHeap () returned 0xd20000 [0108.137] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0108.137] GetProcessHeap () returned 0xd20000 [0108.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0108.137] GetProcessHeap () returned 0xd20000 [0108.137] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0108.137] GetProcessHeap () returned 0xd20000 [0108.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0108.137] GetProcessHeap () returned 0xd20000 [0108.137] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0108.137] GetProcessHeap () returned 0xd20000 [0108.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf78 [0108.137] GetProcessHeap () returned 0xd20000 [0108.137] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf78 | out: hHeap=0xd20000) returned 1 [0108.137] GetProcessHeap () returned 0xd20000 [0108.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0108.137] GetProcessHeap () returned 0xd20000 [0108.137] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0108.137] GetProcessHeap () returned 0xd20000 [0108.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0108.138] GetProcessHeap () returned 0xd20000 [0108.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0108.138] GetProcessHeap () returned 0xd20000 [0108.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf28 [0108.138] GetProcessHeap () returned 0xd20000 [0108.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf28 | out: hHeap=0xd20000) returned 1 [0108.138] GetProcessHeap () returned 0xd20000 [0108.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0108.138] GetProcessHeap () returned 0xd20000 [0108.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0108.138] GetProcessHeap () returned 0xd20000 [0108.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0108.138] GetProcessHeap () returned 0xd20000 [0108.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0108.138] GetProcessHeap () returned 0xd20000 [0108.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0108.138] GetProcessHeap () returned 0xd20000 [0108.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0108.138] GetProcessHeap () returned 0xd20000 [0108.138] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdf8 [0108.138] GetProcessHeap () returned 0xd20000 [0108.138] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdf8 | out: hHeap=0xd20000) returned 1 [0108.138] GetProcessHeap () returned 0xd20000 [0108.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0108.139] GetProcessHeap () returned 0xd20000 [0108.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0108.139] GetProcessHeap () returned 0xd20000 [0108.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0108.139] GetProcessHeap () returned 0xd20000 [0108.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0108.139] GetProcessHeap () returned 0xd20000 [0108.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0108.139] GetProcessHeap () returned 0xd20000 [0108.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0108.139] GetProcessHeap () returned 0xd20000 [0108.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0108.139] GetProcessHeap () returned 0xd20000 [0108.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0108.139] GetProcessHeap () returned 0xd20000 [0108.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce98 [0108.139] GetProcessHeap () returned 0xd20000 [0108.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce98 | out: hHeap=0xd20000) returned 1 [0108.139] GetProcessHeap () returned 0xd20000 [0108.139] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf28 [0108.139] GetProcessHeap () returned 0xd20000 [0108.139] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf28 | out: hHeap=0xd20000) returned 1 [0108.139] GetProcessHeap () returned 0xd20000 [0108.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0108.140] GetProcessHeap () returned 0xd20000 [0108.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0108.140] GetProcessHeap () returned 0xd20000 [0108.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0108.140] GetProcessHeap () returned 0xd20000 [0108.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0108.140] GetProcessHeap () returned 0xd20000 [0108.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0108.140] GetProcessHeap () returned 0xd20000 [0108.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0108.140] GetProcessHeap () returned 0xd20000 [0108.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdd8 [0108.140] GetProcessHeap () returned 0xd20000 [0108.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdd8 | out: hHeap=0xd20000) returned 1 [0108.140] GetProcessHeap () returned 0xd20000 [0108.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0108.140] GetProcessHeap () returned 0xd20000 [0108.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0108.140] GetProcessHeap () returned 0xd20000 [0108.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cee8 [0108.140] GetProcessHeap () returned 0xd20000 [0108.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cee8 | out: hHeap=0xd20000) returned 1 [0108.141] GetProcessHeap () returned 0xd20000 [0108.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf38 [0108.141] GetProcessHeap () returned 0xd20000 [0108.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf38 | out: hHeap=0xd20000) returned 1 [0108.141] GetProcessHeap () returned 0xd20000 [0108.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce18 [0108.141] GetProcessHeap () returned 0xd20000 [0108.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce18 | out: hHeap=0xd20000) returned 1 [0108.141] GetProcessHeap () returned 0xd20000 [0108.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0108.141] GetProcessHeap () returned 0xd20000 [0108.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0108.141] GetProcessHeap () returned 0xd20000 [0108.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0108.141] GetProcessHeap () returned 0xd20000 [0108.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0108.141] GetProcessHeap () returned 0xd20000 [0108.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce38 [0108.141] GetProcessHeap () returned 0xd20000 [0108.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce38 | out: hHeap=0xd20000) returned 1 [0108.141] GetProcessHeap () returned 0xd20000 [0108.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0108.141] GetProcessHeap () returned 0xd20000 [0108.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0108.142] GetProcessHeap () returned 0xd20000 [0108.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0108.142] GetProcessHeap () returned 0xd20000 [0108.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0108.142] GetProcessHeap () returned 0xd20000 [0108.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce68 [0108.142] GetProcessHeap () returned 0xd20000 [0108.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce68 | out: hHeap=0xd20000) returned 1 [0108.142] GetProcessHeap () returned 0xd20000 [0108.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce38 [0108.142] GetProcessHeap () returned 0xd20000 [0108.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce38 | out: hHeap=0xd20000) returned 1 [0108.142] GetProcessHeap () returned 0xd20000 [0108.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cde8 [0108.142] GetProcessHeap () returned 0xd20000 [0108.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cde8 | out: hHeap=0xd20000) returned 1 [0108.142] GetProcessHeap () returned 0xd20000 [0108.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf78 [0108.142] GetProcessHeap () returned 0xd20000 [0108.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf78 | out: hHeap=0xd20000) returned 1 [0108.142] GetProcessHeap () returned 0xd20000 [0108.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0108.142] GetProcessHeap () returned 0xd20000 [0108.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0108.143] GetProcessHeap () returned 0xd20000 [0108.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0108.143] GetProcessHeap () returned 0xd20000 [0108.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0108.143] GetProcessHeap () returned 0xd20000 [0108.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0108.143] GetProcessHeap () returned 0xd20000 [0108.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0108.143] GetProcessHeap () returned 0xd20000 [0108.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0108.143] GetProcessHeap () returned 0xd20000 [0108.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0108.143] GetProcessHeap () returned 0xd20000 [0108.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0108.143] GetProcessHeap () returned 0xd20000 [0108.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0108.143] GetProcessHeap () returned 0xd20000 [0108.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0108.143] GetProcessHeap () returned 0xd20000 [0108.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0108.143] GetProcessHeap () returned 0xd20000 [0108.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0108.144] GetProcessHeap () returned 0xd20000 [0108.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0108.144] GetProcessHeap () returned 0xd20000 [0108.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0108.144] GetProcessHeap () returned 0xd20000 [0108.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0108.144] GetProcessHeap () returned 0xd20000 [0108.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ceb8 [0108.144] GetProcessHeap () returned 0xd20000 [0108.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ceb8 | out: hHeap=0xd20000) returned 1 [0108.144] GetProcessHeap () returned 0xd20000 [0108.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0108.144] GetProcessHeap () returned 0xd20000 [0108.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0108.144] GetProcessHeap () returned 0xd20000 [0108.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf88 [0108.144] GetProcessHeap () returned 0xd20000 [0108.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf88 | out: hHeap=0xd20000) returned 1 [0108.144] GetProcessHeap () returned 0xd20000 [0108.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf18 [0108.144] GetProcessHeap () returned 0xd20000 [0108.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf18 | out: hHeap=0xd20000) returned 1 [0108.144] GetProcessHeap () returned 0xd20000 [0108.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce28 [0108.145] GetProcessHeap () returned 0xd20000 [0108.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce28 | out: hHeap=0xd20000) returned 1 [0108.145] GetProcessHeap () returned 0xd20000 [0108.145] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cea8 [0108.145] GetProcessHeap () returned 0xd20000 [0108.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cea8 | out: hHeap=0xd20000) returned 1 [0108.145] GetProcessHeap () returned 0xd20000 [0108.145] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce38 [0108.145] GetProcessHeap () returned 0xd20000 [0108.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce38 | out: hHeap=0xd20000) returned 1 [0108.145] GetProcessHeap () returned 0xd20000 [0108.145] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0108.145] GetProcessHeap () returned 0xd20000 [0108.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0108.145] GetProcessHeap () returned 0xd20000 [0108.145] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cef8 [0108.145] GetProcessHeap () returned 0xd20000 [0108.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cef8 | out: hHeap=0xd20000) returned 1 [0108.145] GetProcessHeap () returned 0xd20000 [0108.145] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf58 [0108.145] GetProcessHeap () returned 0xd20000 [0108.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf58 | out: hHeap=0xd20000) returned 1 [0108.145] GetProcessHeap () returned 0xd20000 [0108.145] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cec8 [0108.146] GetProcessHeap () returned 0xd20000 [0108.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cec8 | out: hHeap=0xd20000) returned 1 [0108.146] GetProcessHeap () returned 0xd20000 [0108.146] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cdc8 [0108.146] GetProcessHeap () returned 0xd20000 [0108.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cdc8 | out: hHeap=0xd20000) returned 1 [0108.146] GetProcessHeap () returned 0xd20000 [0108.146] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce88 [0108.146] GetProcessHeap () returned 0xd20000 [0108.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce88 | out: hHeap=0xd20000) returned 1 [0108.146] GetProcessHeap () returned 0xd20000 [0108.146] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce78 [0108.146] GetProcessHeap () returned 0xd20000 [0108.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce78 | out: hHeap=0xd20000) returned 1 [0108.146] GetProcessHeap () returned 0xd20000 [0108.146] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ced8 [0108.146] GetProcessHeap () returned 0xd20000 [0108.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ced8 | out: hHeap=0xd20000) returned 1 [0108.146] GetProcessHeap () returned 0xd20000 [0108.146] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce08 [0108.146] GetProcessHeap () returned 0xd20000 [0108.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce08 | out: hHeap=0xd20000) returned 1 [0108.146] GetProcessHeap () returned 0xd20000 [0108.146] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf68 [0108.147] GetProcessHeap () returned 0xd20000 [0108.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf68 | out: hHeap=0xd20000) returned 1 [0108.147] GetProcessHeap () returned 0xd20000 [0108.147] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cf48 [0108.147] GetProcessHeap () returned 0xd20000 [0108.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf48 | out: hHeap=0xd20000) returned 1 [0108.147] GetProcessHeap () returned 0xd20000 [0108.147] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3ce48 [0108.147] GetProcessHeap () returned 0xd20000 [0108.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ce48 | out: hHeap=0xd20000) returned 1 [0108.147] GetProcessHeap () returned 0xd20000 [0108.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0108.147] GetProcessHeap () returned 0xd20000 [0108.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0108.147] GetProcessHeap () returned 0xd20000 [0108.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0108.147] GetProcessHeap () returned 0xd20000 [0108.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0108.147] GetProcessHeap () returned 0xd20000 [0108.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44408 | out: hHeap=0xd20000) returned 1 [0108.147] GetProcessHeap () returned 0xd20000 [0108.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0108.147] GetProcessHeap () returned 0xd20000 [0108.148] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0108.148] GetProcessHeap () returned 0xd20000 [0108.148] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aa68 | out: hHeap=0xd20000) returned 1 [0108.148] GetProcessHeap () returned 0xd20000 [0108.148] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0108.148] GetProcessHeap () returned 0xd20000 [0108.148] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cf08 | out: hHeap=0xd20000) returned 1 [0108.148] GetProcessHeap () returned 0xd20000 [0108.148] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0108.148] WriteFile (in: hFile=0x230, lpBuffer=0xd4f2a0*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f2a0*, lpNumberOfBytesWritten=0x299d864*=0x389, lpOverlapped=0x0) returned 1 [0108.228] GetProcessHeap () returned 0xd20000 [0108.228] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4f2a0, Size=0x30) returned 0xd4f2a0 [0108.228] GetProcessHeap () returned 0xd20000 [0108.228] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0108.228] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0108.253] GetProcessHeap () returned 0xd20000 [0108.253] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x360) returned 0xd4f2d8 [0108.253] ReadFile (in: hFile=0x230, lpBuffer=0xd4f2d8, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4f2d8*, lpNumberOfBytesRead=0x299d7e8*=0x360, lpOverlapped=0x0) returned 1 [0108.253] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0108.253] WriteFile (in: hFile=0x230, lpBuffer=0xd4f2d8*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4f2d8*, lpNumberOfBytesWritten=0x299d7e4*=0x360, lpOverlapped=0x0) returned 1 [0108.259] GetProcessHeap () returned 0xd20000 [0108.259] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4f2d8 | out: hHeap=0xd20000) returned 1 [0108.259] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0108.259] WriteFile (in: hFile=0x230, lpBuffer=0xd4f2a0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f2a0*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0108.260] CloseHandle (hObject=0x230) returned 1 [0108.265] GetProcessHeap () returned 0xd20000 [0108.265] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42760 | out: hHeap=0xd20000) returned 1 [0108.265] GetProcessHeap () returned 0xd20000 [0108.265] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bf80 | out: hHeap=0xd20000) returned 1 [0108.265] GetProcessHeap () returned 0xd20000 [0108.265] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0108.265] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms") returned="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" [0108.265] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.[ponce.lorena@aol.com]" [0108.265] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms"), lpNewFileName="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\searches\\winrt--{s-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0108.266] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Searches\\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms" | out: pszPath="C:\\Users\\FD1HVy\\Searches") returned 1 [0108.266] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Searches" | out: pszPath="C:\\Users\\FD1HVy\\Searches\\") returned="" [0108.266] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Searches\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Searches\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Searches\\HOW_RECOVER.html" [0108.266] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Searches\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\searches\\how_recover.html")) returned 0x20 [0108.266] GetProcessHeap () returned 0xd20000 [0108.266] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2e898 | out: hHeap=0xd20000) returned 1 [0108.267] FindNextFileW (in: hFindFile=0xd490e0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b71b019, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b71b019, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x2b71b019, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms", cAlternateFileName="WINRT-~1.SEA")) returned 0 [0108.267] FindClose (in: hFindFile=0xd490e0 | out: hFindFile=0xd490e0) returned 1 [0108.267] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Users\\FD1HVy\\Saved Games\\" | out: lpString1="C:\\Users\\FD1HVy\\Saved Games\\") returned="C:\\Users\\FD1HVy\\Saved Games\\" [0108.267] GetProcessHeap () returned 0xd20000 [0108.267] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd32218 | out: hHeap=0xd20000) returned 1 [0108.267] GetProcessHeap () returned 0xd20000 [0108.267] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.267] lstrlenW (lpString="C:\\Users\\FD1HVy\\Saved Games\\") returned 28 [0108.267] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Saved Games\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Saved Games\\*") returned="C:\\Users\\FD1HVy\\Saved Games\\*" [0108.267] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Saved Games\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd48fe0 [0108.267] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0108.268] FindNextFileW (in: hFindFile=0xd48fe0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.268] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0108.268] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0108.268] FindNextFileW (in: hFindFile=0xd48fe0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0108.268] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0108.268] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0108.268] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Saved Games\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini") returned="C:\\Users\\FD1HVy\\Saved Games\\desktop.ini" [0108.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0108.268] GetProcessHeap () returned 0xd20000 [0108.268] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd445d0 [0108.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0xd445d0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0108.268] lstrlenA (lpString="desktop.ini") returned 11 [0108.268] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0108.268] lstrlenA (lpString="desktop.ini") returned 11 [0108.268] lstrlenA (lpString=".dll") returned 4 [0108.268] lstrlenA (lpString=".dll") returned 4 [0108.268] lstrlenA (lpString="desktop.ini") returned 11 [0108.268] lstrcmpiA (lpString1=".ini", lpString2=".dll") returned 1 [0108.269] lstrlenA (lpString="desktop.ini") returned 11 [0108.269] lstrlenA (lpString=".ini") returned 4 [0108.269] lstrlenA (lpString=".ini") returned 4 [0108.269] lstrlenA (lpString="desktop.ini") returned 11 [0108.269] lstrcmpiA (lpString1=".ini", lpString2=".ini") returned 0 [0108.269] GetProcessHeap () returned 0xd20000 [0108.269] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445d0 | out: hHeap=0xd20000) returned 1 [0108.269] FindNextFileW (in: hFindFile=0xd48fe0, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0108.269] FindClose (in: hFindFile=0xd48fe0 | out: hFindFile=0xd48fe0) returned 1 [0108.269] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Users\\FD1HVy\\Recent\\" | out: lpString1="C:\\Users\\FD1HVy\\Recent\\") returned="C:\\Users\\FD1HVy\\Recent\\" [0108.269] GetProcessHeap () returned 0xd20000 [0108.269] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3fdd0 | out: hHeap=0xd20000) returned 1 [0108.269] GetProcessHeap () returned 0xd20000 [0108.269] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.269] lstrlenW (lpString="C:\\Users\\FD1HVy\\Recent\\") returned 23 [0108.269] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Recent\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Recent\\*") returned="C:\\Users\\FD1HVy\\Recent\\*" [0108.270] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Recent\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0xffffffff [0108.270] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Users\\FD1HVy\\PrintHood\\" | out: lpString1="C:\\Users\\FD1HVy\\PrintHood\\") returned="C:\\Users\\FD1HVy\\PrintHood\\" [0108.270] GetProcessHeap () returned 0xd20000 [0108.270] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd490a0 | out: hHeap=0xd20000) returned 1 [0108.270] GetProcessHeap () returned 0xd20000 [0108.270] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.270] lstrlenW (lpString="C:\\Users\\FD1HVy\\PrintHood\\") returned 26 [0108.270] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\PrintHood\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\PrintHood\\*") returned="C:\\Users\\FD1HVy\\PrintHood\\*" [0108.270] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\PrintHood\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441f699e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441f699e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0xffffffff [0108.270] lstrcpyW (in: lpString1=0x299df84, lpString2="C:\\Users\\FD1HVy\\Pictures\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\") returned="C:\\Users\\FD1HVy\\Pictures\\" [0108.270] GetProcessHeap () returned 0xd20000 [0108.270] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd49320 | out: hHeap=0xd20000) returned 1 [0108.271] GetProcessHeap () returned 0xd20000 [0108.271] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.271] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\") returned 25 [0108.271] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="*" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\*") returned="C:\\Users\\FD1HVy\\Pictures\\*" [0108.271] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\*", lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x52d4c825, ftLastAccessTime.dwHighDateTime=0x1d5c395, ftLastWriteTime.dwLowDateTime=0x52d4c825, ftLastWriteTime.dwHighDateTime=0x1d5c395, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xd49120 [0108.271] lstrcmpiW (lpString1=".", lpString2=".") returned 0 [0108.271] FindNextFileW (in: hFindFile=0xd49120, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x52d4c825, ftLastAccessTime.dwHighDateTime=0x1d5c395, ftLastWriteTime.dwLowDateTime=0x52d4c825, ftLastWriteTime.dwHighDateTime=0x1d5c395, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.271] lstrcmpiW (lpString1="..", lpString2=".") returned 1 [0108.271] lstrcmpiW (lpString1="..", lpString2="..") returned 0 [0108.271] FindNextFileW (in: hFindFile=0xd49120, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe525be60, ftCreationTime.dwHighDateTime=0x1d4c936, ftLastAccessTime.dwLowDateTime=0x5e81e270, ftLastAccessTime.dwHighDateTime=0x1d4d0b7, ftLastWriteTime.dwLowDateTime=0x5e81e270, ftLastWriteTime.dwHighDateTime=0x1d4d0b7, nFileSizeHigh=0x0, nFileSizeLow=0x312c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="0csOb.png", cAlternateFileName="")) returned 1 [0108.271] lstrcmpiW (lpString1="0csOb.png", lpString2=".") returned 1 [0108.271] lstrcmpiW (lpString1="0csOb.png", lpString2="..") returned 1 [0108.271] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="0csOb.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\0csOb.png") returned="C:\\Users\\FD1HVy\\Pictures\\0csOb.png" [0108.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0csOb.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0108.272] GetProcessHeap () returned 0xd20000 [0108.272] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xa) returned 0xd44468 [0108.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="0csOb.png", cchWideChar=-1, lpMultiByteStr=0xd44468, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0csOb.png", lpUsedDefaultChar=0x0) returned 10 [0108.272] lstrlenA (lpString="0csOb.png") returned 9 [0108.272] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0108.272] lstrlenA (lpString="0csOb.png") returned 9 [0108.272] lstrlenA (lpString=".dll") returned 4 [0108.272] lstrlenA (lpString=".dll") returned 4 [0108.272] lstrlenA (lpString="0csOb.png") returned 9 [0108.272] lstrcmpiA (lpString1=".png", lpString2=".dll") returned 1 [0108.272] lstrlenA (lpString="0csOb.png") returned 9 [0108.272] lstrlenA (lpString=".ini") returned 4 [0108.272] lstrlenA (lpString=".ini") returned 4 [0108.272] lstrlenA (lpString="0csOb.png") returned 9 [0108.272] lstrcmpiA (lpString1=".png", lpString2=".ini") returned 1 [0108.272] lstrlenA (lpString="0csOb.png") returned 9 [0108.272] lstrlenA (lpString=".inc") returned 4 [0108.272] lstrlenA (lpString=".inc") returned 4 [0108.272] lstrlenA (lpString="0csOb.png") returned 9 [0108.272] lstrcmpiA (lpString1=".png", lpString2=".inc") returned 1 [0108.273] lstrcmpiW (lpString1="0csOb.png", lpString2="HOW_RECOVER.html") returned -1 [0108.273] lstrcmpiW (lpString1="0csOb.png", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0108.273] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0108.273] lstrcmpiW (lpString1="0csOb.png", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0108.273] GetProcessHeap () returned 0xd20000 [0108.273] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd425a8 [0108.273] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\0csOb.png" (normalized: "c:\\users\\fd1hvy\\pictures\\0csob.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0108.273] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=12588) returned 1 [0108.273] GetProcessHeap () returned 0xd20000 [0108.273] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bf08 [0108.273] GetProcessHeap () returned 0xd20000 [0108.273] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0108.273] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\0csOb.png") returned 34 [0108.273] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0108.274] GetProcessHeap () returned 0xd20000 [0108.274] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0108.274] GetProcessHeap () returned 0xd20000 [0108.274] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4f2d8 [0108.274] lstrlenA (lpString="rsa_encrypt") returned 11 [0108.274] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0108.277] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0108.277] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0108.277] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0108.278] GetProcessHeap () returned 0xd20000 [0108.278] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0108.278] lstrlenA (lpString="010001") returned 6 [0108.278] GetProcessHeap () returned 0xd20000 [0108.278] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd98 [0108.278] GetProcessHeap () returned 0xd20000 [0108.278] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0108.278] GetProcessHeap () returned 0xd20000 [0108.278] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b2d8 [0108.278] GetProcessHeap () returned 0xd20000 [0108.278] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0108.278] GetProcessHeap () returned 0xd20000 [0108.278] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b488 [0108.278] GetProcessHeap () returned 0xd20000 [0108.278] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44d80 [0108.278] GetProcessHeap () returned 0xd20000 [0108.278] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc18 [0108.278] GetProcessHeap () returned 0xd20000 [0108.278] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0108.278] GetProcessHeap () returned 0xd20000 [0108.278] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.279] GetProcessHeap () returned 0xd20000 [0108.279] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0108.279] GetProcessHeap () returned 0xd20000 [0108.279] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0108.279] GetProcessHeap () returned 0xd20000 [0108.279] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd452f8 [0108.279] GetProcessHeap () returned 0xd20000 [0108.279] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.279] GetProcessHeap () returned 0xd20000 [0108.279] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446c0 [0108.279] GetProcessHeap () returned 0xd20000 [0108.279] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b638 [0108.279] GetProcessHeap () returned 0xd20000 [0108.279] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0108.279] GetProcessHeap () returned 0xd20000 [0108.279] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0108.279] GetProcessHeap () returned 0xd20000 [0108.279] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b638 | out: hHeap=0xd20000) returned 1 [0108.279] GetProcessHeap () returned 0xd20000 [0108.279] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.279] GetProcessHeap () returned 0xd20000 [0108.280] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44498 [0108.280] GetProcessHeap () returned 0xd20000 [0108.280] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.280] GetProcessHeap () returned 0xd20000 [0108.280] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.280] GetProcessHeap () returned 0xd20000 [0108.280] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.280] GetProcessHeap () returned 0xd20000 [0108.280] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.280] GetProcessHeap () returned 0xd20000 [0108.280] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.280] GetProcessHeap () returned 0xd20000 [0108.280] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.280] GetProcessHeap () returned 0xd20000 [0108.280] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4aee8 [0108.280] GetProcessHeap () returned 0xd20000 [0108.280] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44498 | out: hHeap=0xd20000) returned 1 [0108.280] GetProcessHeap () returned 0xd20000 [0108.280] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0108.280] GetProcessHeap () returned 0xd20000 [0108.280] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aee8 | out: hHeap=0xd20000) returned 1 [0108.280] GetProcessHeap () returned 0xd20000 [0108.281] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.281] GetProcessHeap () returned 0xd20000 [0108.281] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.281] GetProcessHeap () returned 0xd20000 [0108.281] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.281] GetProcessHeap () returned 0xd20000 [0108.281] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.281] GetProcessHeap () returned 0xd20000 [0108.281] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.281] GetProcessHeap () returned 0xd20000 [0108.281] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.281] GetProcessHeap () returned 0xd20000 [0108.281] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.281] GetProcessHeap () returned 0xd20000 [0108.281] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.281] GetProcessHeap () returned 0xd20000 [0108.281] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.281] GetProcessHeap () returned 0xd20000 [0108.281] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.281] GetProcessHeap () returned 0xd20000 [0108.282] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.282] GetProcessHeap () returned 0xd20000 [0108.282] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.282] GetProcessHeap () returned 0xd20000 [0108.282] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.282] GetProcessHeap () returned 0xd20000 [0108.282] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.282] GetProcessHeap () returned 0xd20000 [0108.282] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.282] GetProcessHeap () returned 0xd20000 [0108.282] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.282] GetProcessHeap () returned 0xd20000 [0108.282] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.282] GetProcessHeap () returned 0xd20000 [0108.282] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.282] GetProcessHeap () returned 0xd20000 [0108.282] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.282] GetProcessHeap () returned 0xd20000 [0108.282] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.283] GetProcessHeap () returned 0xd20000 [0108.283] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.283] GetProcessHeap () returned 0xd20000 [0108.283] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.283] GetProcessHeap () returned 0xd20000 [0108.283] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.283] GetProcessHeap () returned 0xd20000 [0108.283] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.283] GetProcessHeap () returned 0xd20000 [0108.283] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.283] GetProcessHeap () returned 0xd20000 [0108.283] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.283] GetProcessHeap () returned 0xd20000 [0108.283] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.283] GetProcessHeap () returned 0xd20000 [0108.283] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.284] GetProcessHeap () returned 0xd20000 [0108.284] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.284] GetProcessHeap () returned 0xd20000 [0108.284] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.284] GetProcessHeap () returned 0xd20000 [0108.284] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.284] GetProcessHeap () returned 0xd20000 [0108.284] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.284] GetProcessHeap () returned 0xd20000 [0108.284] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.284] GetProcessHeap () returned 0xd20000 [0108.284] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.284] GetProcessHeap () returned 0xd20000 [0108.284] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.284] GetProcessHeap () returned 0xd20000 [0108.284] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.284] GetProcessHeap () returned 0xd20000 [0108.284] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.284] GetProcessHeap () returned 0xd20000 [0108.284] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.284] GetProcessHeap () returned 0xd20000 [0108.284] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.285] GetProcessHeap () returned 0xd20000 [0108.285] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.285] GetProcessHeap () returned 0xd20000 [0108.285] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.285] GetProcessHeap () returned 0xd20000 [0108.285] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.285] GetProcessHeap () returned 0xd20000 [0108.285] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.285] GetProcessHeap () returned 0xd20000 [0108.285] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.285] GetProcessHeap () returned 0xd20000 [0108.285] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.285] GetProcessHeap () returned 0xd20000 [0108.285] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.285] GetProcessHeap () returned 0xd20000 [0108.285] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.285] GetProcessHeap () returned 0xd20000 [0108.285] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.286] GetProcessHeap () returned 0xd20000 [0108.286] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.286] GetProcessHeap () returned 0xd20000 [0108.286] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.286] GetProcessHeap () returned 0xd20000 [0108.286] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.286] GetProcessHeap () returned 0xd20000 [0108.286] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.286] GetProcessHeap () returned 0xd20000 [0108.286] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.286] GetProcessHeap () returned 0xd20000 [0108.286] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.286] GetProcessHeap () returned 0xd20000 [0108.286] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.286] GetProcessHeap () returned 0xd20000 [0108.286] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.286] GetProcessHeap () returned 0xd20000 [0108.286] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.286] GetProcessHeap () returned 0xd20000 [0108.286] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.287] GetProcessHeap () returned 0xd20000 [0108.287] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.287] GetProcessHeap () returned 0xd20000 [0108.287] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.287] GetProcessHeap () returned 0xd20000 [0108.287] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.287] GetProcessHeap () returned 0xd20000 [0108.287] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.287] GetProcessHeap () returned 0xd20000 [0108.287] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.287] GetProcessHeap () returned 0xd20000 [0108.287] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.287] GetProcessHeap () returned 0xd20000 [0108.287] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.287] GetProcessHeap () returned 0xd20000 [0108.287] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.287] GetProcessHeap () returned 0xd20000 [0108.287] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.287] GetProcessHeap () returned 0xd20000 [0108.287] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.287] GetProcessHeap () returned 0xd20000 [0108.287] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.288] GetProcessHeap () returned 0xd20000 [0108.288] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.288] GetProcessHeap () returned 0xd20000 [0108.288] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.288] GetProcessHeap () returned 0xd20000 [0108.288] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.288] GetProcessHeap () returned 0xd20000 [0108.288] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.288] GetProcessHeap () returned 0xd20000 [0108.288] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.288] GetProcessHeap () returned 0xd20000 [0108.288] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.288] GetProcessHeap () returned 0xd20000 [0108.288] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.288] GetProcessHeap () returned 0xd20000 [0108.288] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.288] GetProcessHeap () returned 0xd20000 [0108.288] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.288] GetProcessHeap () returned 0xd20000 [0108.288] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.288] GetProcessHeap () returned 0xd20000 [0108.288] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.288] GetProcessHeap () returned 0xd20000 [0108.289] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.289] GetProcessHeap () returned 0xd20000 [0108.289] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.289] GetProcessHeap () returned 0xd20000 [0108.289] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.289] GetProcessHeap () returned 0xd20000 [0108.289] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.289] GetProcessHeap () returned 0xd20000 [0108.289] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.289] GetProcessHeap () returned 0xd20000 [0108.289] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.289] GetProcessHeap () returned 0xd20000 [0108.289] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.289] GetProcessHeap () returned 0xd20000 [0108.289] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.289] GetProcessHeap () returned 0xd20000 [0108.289] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.289] GetProcessHeap () returned 0xd20000 [0108.289] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.289] GetProcessHeap () returned 0xd20000 [0108.289] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.289] GetProcessHeap () returned 0xd20000 [0108.289] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.290] GetProcessHeap () returned 0xd20000 [0108.290] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.290] GetProcessHeap () returned 0xd20000 [0108.290] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.290] GetProcessHeap () returned 0xd20000 [0108.290] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.290] GetProcessHeap () returned 0xd20000 [0108.290] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.290] GetProcessHeap () returned 0xd20000 [0108.290] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.290] GetProcessHeap () returned 0xd20000 [0108.290] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.290] GetProcessHeap () returned 0xd20000 [0108.290] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.290] GetProcessHeap () returned 0xd20000 [0108.290] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.290] GetProcessHeap () returned 0xd20000 [0108.290] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.290] GetProcessHeap () returned 0xd20000 [0108.290] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.290] GetProcessHeap () returned 0xd20000 [0108.290] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.291] GetProcessHeap () returned 0xd20000 [0108.291] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.291] GetProcessHeap () returned 0xd20000 [0108.291] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.291] GetProcessHeap () returned 0xd20000 [0108.291] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.291] GetProcessHeap () returned 0xd20000 [0108.291] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.291] GetProcessHeap () returned 0xd20000 [0108.291] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.291] GetProcessHeap () returned 0xd20000 [0108.291] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.291] GetProcessHeap () returned 0xd20000 [0108.292] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.292] GetProcessHeap () returned 0xd20000 [0108.292] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.292] GetProcessHeap () returned 0xd20000 [0108.292] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.292] GetProcessHeap () returned 0xd20000 [0108.292] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.292] GetProcessHeap () returned 0xd20000 [0108.292] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.292] GetProcessHeap () returned 0xd20000 [0108.292] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.292] GetProcessHeap () returned 0xd20000 [0108.292] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.292] GetProcessHeap () returned 0xd20000 [0108.292] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.292] GetProcessHeap () returned 0xd20000 [0108.292] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.292] GetProcessHeap () returned 0xd20000 [0108.292] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.292] GetProcessHeap () returned 0xd20000 [0108.292] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.292] GetProcessHeap () returned 0xd20000 [0108.292] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.293] GetProcessHeap () returned 0xd20000 [0108.293] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.293] GetProcessHeap () returned 0xd20000 [0108.293] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.293] GetProcessHeap () returned 0xd20000 [0108.293] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.293] GetProcessHeap () returned 0xd20000 [0108.293] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.293] GetProcessHeap () returned 0xd20000 [0108.293] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.293] GetProcessHeap () returned 0xd20000 [0108.293] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.293] GetProcessHeap () returned 0xd20000 [0108.293] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.293] GetProcessHeap () returned 0xd20000 [0108.293] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.293] GetProcessHeap () returned 0xd20000 [0108.293] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.293] GetProcessHeap () returned 0xd20000 [0108.293] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.293] GetProcessHeap () returned 0xd20000 [0108.293] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.293] GetProcessHeap () returned 0xd20000 [0108.294] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.294] GetProcessHeap () returned 0xd20000 [0108.294] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.294] GetProcessHeap () returned 0xd20000 [0108.294] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.294] GetProcessHeap () returned 0xd20000 [0108.294] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.294] GetProcessHeap () returned 0xd20000 [0108.294] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.294] GetProcessHeap () returned 0xd20000 [0108.294] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.294] GetProcessHeap () returned 0xd20000 [0108.294] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.294] GetProcessHeap () returned 0xd20000 [0108.294] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.294] GetProcessHeap () returned 0xd20000 [0108.294] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.294] GetProcessHeap () returned 0xd20000 [0108.294] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.294] GetProcessHeap () returned 0xd20000 [0108.294] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.294] GetProcessHeap () returned 0xd20000 [0108.295] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.295] GetProcessHeap () returned 0xd20000 [0108.295] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.295] GetProcessHeap () returned 0xd20000 [0108.295] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.295] GetProcessHeap () returned 0xd20000 [0108.295] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.295] GetProcessHeap () returned 0xd20000 [0108.295] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.295] GetProcessHeap () returned 0xd20000 [0108.295] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.295] GetProcessHeap () returned 0xd20000 [0108.295] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.295] GetProcessHeap () returned 0xd20000 [0108.295] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.295] GetProcessHeap () returned 0xd20000 [0108.295] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.295] GetProcessHeap () returned 0xd20000 [0108.295] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.295] GetProcessHeap () returned 0xd20000 [0108.296] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.296] GetProcessHeap () returned 0xd20000 [0108.296] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.296] GetProcessHeap () returned 0xd20000 [0108.296] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.296] GetProcessHeap () returned 0xd20000 [0108.296] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.296] GetProcessHeap () returned 0xd20000 [0108.296] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.296] GetProcessHeap () returned 0xd20000 [0108.296] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.296] GetProcessHeap () returned 0xd20000 [0108.296] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.296] GetProcessHeap () returned 0xd20000 [0108.296] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.296] GetProcessHeap () returned 0xd20000 [0108.296] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.296] GetProcessHeap () returned 0xd20000 [0108.296] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.296] GetProcessHeap () returned 0xd20000 [0108.296] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.296] GetProcessHeap () returned 0xd20000 [0108.296] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.297] GetProcessHeap () returned 0xd20000 [0108.297] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.297] GetProcessHeap () returned 0xd20000 [0108.297] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.297] GetProcessHeap () returned 0xd20000 [0108.297] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.297] GetProcessHeap () returned 0xd20000 [0108.297] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.297] GetProcessHeap () returned 0xd20000 [0108.297] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.297] GetProcessHeap () returned 0xd20000 [0108.297] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0108.297] GetProcessHeap () returned 0xd20000 [0108.297] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0108.297] GetProcessHeap () returned 0xd20000 [0108.297] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0108.297] GetProcessHeap () returned 0xd20000 [0108.297] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0108.297] GetProcessHeap () returned 0xd20000 [0108.297] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446c0 | out: hHeap=0xd20000) returned 1 [0108.298] GetProcessHeap () returned 0xd20000 [0108.298] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b488 | out: hHeap=0xd20000) returned 1 [0108.298] GetProcessHeap () returned 0xd20000 [0108.298] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0108.298] GetProcessHeap () returned 0xd20000 [0108.298] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b2d8 | out: hHeap=0xd20000) returned 1 [0108.298] GetProcessHeap () returned 0xd20000 [0108.298] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0108.298] GetProcessHeap () returned 0xd20000 [0108.298] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.298] GetProcessHeap () returned 0xd20000 [0108.298] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0108.298] WriteFile (in: hFile=0x230, lpBuffer=0xd4f2d8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f2d8*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0108.314] GetProcessHeap () returned 0xd20000 [0108.314] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4f2d8, Size=0x30) returned 0xd4f2d8 [0108.314] GetProcessHeap () returned 0xd20000 [0108.314] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0108.314] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0108.314] GetProcessHeap () returned 0xd20000 [0108.314] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x312c) returned 0xd4f310 [0108.315] ReadFile (in: hFile=0x230, lpBuffer=0xd4f310, nNumberOfBytesToRead=0x312c, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4f310*, lpNumberOfBytesRead=0x299d7e8*=0x312c, lpOverlapped=0x0) returned 1 [0108.316] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0108.316] WriteFile (in: hFile=0x230, lpBuffer=0xd4f310*, nNumberOfBytesToWrite=0x312c, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4f310*, lpNumberOfBytesWritten=0x299d7e4*=0x312c, lpOverlapped=0x0) returned 1 [0108.318] GetProcessHeap () returned 0xd20000 [0108.318] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4f310 | out: hHeap=0xd20000) returned 1 [0108.318] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0108.318] WriteFile (in: hFile=0x230, lpBuffer=0xd4f2d8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f2d8*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0108.322] CloseHandle (hObject=0x230) returned 1 [0108.326] GetProcessHeap () returned 0xd20000 [0108.326] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd425a8 | out: hHeap=0xd20000) returned 1 [0108.326] GetProcessHeap () returned 0xd20000 [0108.326] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bf08 | out: hHeap=0xd20000) returned 1 [0108.326] GetProcessHeap () returned 0xd20000 [0108.326] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0108.326] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\0csOb.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\0csOb.png") returned="C:\\Users\\FD1HVy\\Pictures\\0csOb.png" [0108.326] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\0csOb.png", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\0csOb.png.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Pictures\\0csOb.png.[ponce.lorena@aol.com]" [0108.327] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\0csOb.png" (normalized: "c:\\users\\fd1hvy\\pictures\\0csob.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\0csOb.png.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\pictures\\0csob.png.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0108.330] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\0csOb.png" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0108.330] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0108.330] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html" [0108.330] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_recover.html")) returned 0xffffffff [0108.331] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_recover.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x230 [0108.331] GetProcessHeap () returned 0xd20000 [0108.331] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4be18 [0108.331] GetProcessHeap () returned 0xd20000 [0108.331] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0108.351] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.353] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.353] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.354] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.354] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.354] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.354] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.354] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.354] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.354] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.355] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.355] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.355] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.355] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.355] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.355] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.355] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.356] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.356] GetProcessHeap () returned 0xd20000 [0108.356] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4be18 | out: hHeap=0xd20000) returned 1 [0108.356] GetProcessHeap () returned 0xd20000 [0108.356] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0108.356] WriteFile (in: hFile=0x230, lpBuffer=0x40c640*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x299d9d0, lpOverlapped=0x0 | out: lpBuffer=0x40c640*, lpNumberOfBytesWritten=0x299d9d0*=0x300, lpOverlapped=0x0) returned 1 [0108.362] GetProcessHeap () returned 0xd20000 [0108.362] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bff8 [0108.362] GetProcessHeap () returned 0xd20000 [0108.362] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0108.376] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.376] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.376] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.376] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.376] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.376] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.376] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.377] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.377] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.377] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.377] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.377] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.377] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.377] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.377] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.378] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.378] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.378] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.378] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.378] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.378] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.378] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.379] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.379] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.379] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.379] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.379] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.379] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.379] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.380] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.380] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.380] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.380] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.380] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.380] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.381] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.381] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.381] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.381] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.381] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.381] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.381] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.382] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.407] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.407] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.407] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.407] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.407] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.407] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.407] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.408] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.408] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.408] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.408] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.408] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.408] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.408] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.408] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.408] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.409] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.409] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.409] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.409] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.409] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.409] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.409] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.409] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.410] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.410] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.410] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.410] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.410] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.410] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.410] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.411] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.411] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.411] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.411] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.411] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.411] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.411] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.411] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.412] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.412] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.412] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.412] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.412] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.412] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.412] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.413] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.413] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.413] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.413] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.413] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.413] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.413] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.413] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.414] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.414] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.414] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.426] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.426] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.426] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.427] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.427] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.427] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.427] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.427] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.427] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.427] WriteFile (in: hFile=0x230, lpBuffer=0x299d7ec*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0x299d7ec*, lpNumberOfBytesWritten=0x299d7e8*=0x10, lpOverlapped=0x0) returned 1 [0108.428] GetProcessHeap () returned 0xd20000 [0108.428] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bff8 | out: hHeap=0xd20000) returned 1 [0108.428] GetProcessHeap () returned 0xd20000 [0108.428] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0108.428] CloseHandle (hObject=0x230) returned 1 [0108.428] GetProcessHeap () returned 0xd20000 [0108.428] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44468 | out: hHeap=0xd20000) returned 1 [0108.428] FindNextFileW (in: hFindFile=0xd49120, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef5d0820, ftCreationTime.dwHighDateTime=0x1d4cda0, ftLastAccessTime.dwLowDateTime=0x5e04e640, ftLastAccessTime.dwHighDateTime=0x1d4d5c5, ftLastWriteTime.dwLowDateTime=0x5e04e640, ftLastWriteTime.dwHighDateTime=0x1d4d5c5, nFileSizeHigh=0x0, nFileSizeLow=0xeeab, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1l8ks.png", cAlternateFileName="")) returned 1 [0108.428] lstrcmpiW (lpString1="1l8ks.png", lpString2=".") returned 1 [0108.428] lstrcmpiW (lpString1="1l8ks.png", lpString2="..") returned 1 [0108.429] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="1l8ks.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\1l8ks.png") returned="C:\\Users\\FD1HVy\\Pictures\\1l8ks.png" [0108.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1l8ks.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0108.429] GetProcessHeap () returned 0xd20000 [0108.429] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xa) returned 0xd44558 [0108.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1l8ks.png", cchWideChar=-1, lpMultiByteStr=0xd44558, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1l8ks.png", lpUsedDefaultChar=0x0) returned 10 [0108.429] lstrlenA (lpString="1l8ks.png") returned 9 [0108.429] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0108.429] lstrlenA (lpString="1l8ks.png") returned 9 [0108.429] lstrlenA (lpString=".dll") returned 4 [0108.429] lstrlenA (lpString=".dll") returned 4 [0108.429] lstrlenA (lpString="1l8ks.png") returned 9 [0108.429] lstrcmpiA (lpString1=".png", lpString2=".dll") returned 1 [0108.429] lstrlenA (lpString="1l8ks.png") returned 9 [0108.429] lstrlenA (lpString=".ini") returned 4 [0108.429] lstrlenA (lpString=".ini") returned 4 [0108.429] lstrlenA (lpString="1l8ks.png") returned 9 [0108.429] lstrcmpiA (lpString1=".png", lpString2=".ini") returned 1 [0108.429] lstrlenA (lpString="1l8ks.png") returned 9 [0108.430] lstrlenA (lpString=".inc") returned 4 [0108.430] lstrlenA (lpString=".inc") returned 4 [0108.430] lstrlenA (lpString="1l8ks.png") returned 9 [0108.430] lstrcmpiA (lpString1=".png", lpString2=".inc") returned 1 [0108.430] lstrcmpiW (lpString1="1l8ks.png", lpString2="HOW_RECOVER.html") returned -1 [0108.430] lstrcmpiW (lpString1="1l8ks.png", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0108.430] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0108.431] lstrcmpiW (lpString1="1l8ks.png", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0108.431] GetProcessHeap () returned 0xd20000 [0108.431] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd426e8 [0108.431] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\1l8ks.png" (normalized: "c:\\users\\fd1hvy\\pictures\\1l8ks.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0108.431] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=61099) returned 1 [0108.431] GetProcessHeap () returned 0xd20000 [0108.431] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c1d8 [0108.431] GetProcessHeap () returned 0xd20000 [0108.431] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0108.431] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\1l8ks.png") returned 34 [0108.431] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0108.432] GetProcessHeap () returned 0xd20000 [0108.432] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0108.432] GetProcessHeap () returned 0xd20000 [0108.432] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4f310 [0108.432] lstrlenA (lpString="rsa_encrypt") returned 11 [0108.432] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0108.434] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0108.434] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0108.434] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0108.434] GetProcessHeap () returned 0xd20000 [0108.434] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0108.434] lstrlenA (lpString="010001") returned 6 [0108.434] GetProcessHeap () returned 0xd20000 [0108.434] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc18 [0108.435] GetProcessHeap () returned 0xd20000 [0108.435] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0108.435] GetProcessHeap () returned 0xd20000 [0108.435] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b1b8 [0108.435] GetProcessHeap () returned 0xd20000 [0108.435] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0108.435] GetProcessHeap () returned 0xd20000 [0108.435] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b098 [0108.435] GetProcessHeap () returned 0xd20000 [0108.435] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44fb0 [0108.435] GetProcessHeap () returned 0xd20000 [0108.435] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc48 [0108.435] GetProcessHeap () returned 0xd20000 [0108.435] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44c68 [0108.435] GetProcessHeap () returned 0xd20000 [0108.435] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.435] GetProcessHeap () returned 0xd20000 [0108.435] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0108.435] GetProcessHeap () returned 0xd20000 [0108.435] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0108.435] GetProcessHeap () returned 0xd20000 [0108.436] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd45528 [0108.436] GetProcessHeap () returned 0xd20000 [0108.436] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.436] GetProcessHeap () returned 0xd20000 [0108.436] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444c8 [0108.436] GetProcessHeap () returned 0xd20000 [0108.436] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ad38 [0108.436] GetProcessHeap () returned 0xd20000 [0108.436] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0108.436] GetProcessHeap () returned 0xd20000 [0108.436] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0108.436] GetProcessHeap () returned 0xd20000 [0108.436] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ad38 | out: hHeap=0xd20000) returned 1 [0108.436] GetProcessHeap () returned 0xd20000 [0108.436] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.436] GetProcessHeap () returned 0xd20000 [0108.436] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44630 [0108.436] GetProcessHeap () returned 0xd20000 [0108.436] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.436] GetProcessHeap () returned 0xd20000 [0108.437] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.437] GetProcessHeap () returned 0xd20000 [0108.437] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.437] GetProcessHeap () returned 0xd20000 [0108.437] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.437] GetProcessHeap () returned 0xd20000 [0108.437] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.437] GetProcessHeap () returned 0xd20000 [0108.437] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.437] GetProcessHeap () returned 0xd20000 [0108.437] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4ad38 [0108.437] GetProcessHeap () returned 0xd20000 [0108.437] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44630 | out: hHeap=0xd20000) returned 1 [0108.437] GetProcessHeap () returned 0xd20000 [0108.437] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0108.437] GetProcessHeap () returned 0xd20000 [0108.437] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ad38 | out: hHeap=0xd20000) returned 1 [0108.437] GetProcessHeap () returned 0xd20000 [0108.437] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.437] GetProcessHeap () returned 0xd20000 [0108.438] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.438] GetProcessHeap () returned 0xd20000 [0108.438] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.438] GetProcessHeap () returned 0xd20000 [0108.438] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.438] GetProcessHeap () returned 0xd20000 [0108.438] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.438] GetProcessHeap () returned 0xd20000 [0108.438] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.438] GetProcessHeap () returned 0xd20000 [0108.438] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.438] GetProcessHeap () returned 0xd20000 [0108.438] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.438] GetProcessHeap () returned 0xd20000 [0108.438] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.438] GetProcessHeap () returned 0xd20000 [0108.438] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.438] GetProcessHeap () returned 0xd20000 [0108.438] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.438] GetProcessHeap () returned 0xd20000 [0108.439] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.439] GetProcessHeap () returned 0xd20000 [0108.439] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.439] GetProcessHeap () returned 0xd20000 [0108.439] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.439] GetProcessHeap () returned 0xd20000 [0108.439] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.439] GetProcessHeap () returned 0xd20000 [0108.439] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.439] GetProcessHeap () returned 0xd20000 [0108.439] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.439] GetProcessHeap () returned 0xd20000 [0108.439] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.439] GetProcessHeap () returned 0xd20000 [0108.439] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.439] GetProcessHeap () returned 0xd20000 [0108.439] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.439] GetProcessHeap () returned 0xd20000 [0108.440] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.440] GetProcessHeap () returned 0xd20000 [0108.440] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.440] GetProcessHeap () returned 0xd20000 [0108.440] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.440] GetProcessHeap () returned 0xd20000 [0108.440] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.440] GetProcessHeap () returned 0xd20000 [0108.440] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.440] GetProcessHeap () returned 0xd20000 [0108.440] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.440] GetProcessHeap () returned 0xd20000 [0108.440] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.440] GetProcessHeap () returned 0xd20000 [0108.440] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.440] GetProcessHeap () returned 0xd20000 [0108.440] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.440] GetProcessHeap () returned 0xd20000 [0108.440] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.441] GetProcessHeap () returned 0xd20000 [0108.441] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.441] GetProcessHeap () returned 0xd20000 [0108.441] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.441] GetProcessHeap () returned 0xd20000 [0108.441] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.441] GetProcessHeap () returned 0xd20000 [0108.441] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.441] GetProcessHeap () returned 0xd20000 [0108.441] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.441] GetProcessHeap () returned 0xd20000 [0108.441] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.441] GetProcessHeap () returned 0xd20000 [0108.441] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.441] GetProcessHeap () returned 0xd20000 [0108.441] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.441] GetProcessHeap () returned 0xd20000 [0108.441] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.441] GetProcessHeap () returned 0xd20000 [0108.442] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.442] GetProcessHeap () returned 0xd20000 [0108.442] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.442] GetProcessHeap () returned 0xd20000 [0108.442] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.442] GetProcessHeap () returned 0xd20000 [0108.442] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.442] GetProcessHeap () returned 0xd20000 [0108.442] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.442] GetProcessHeap () returned 0xd20000 [0108.442] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.442] GetProcessHeap () returned 0xd20000 [0108.442] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.442] GetProcessHeap () returned 0xd20000 [0108.442] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.442] GetProcessHeap () returned 0xd20000 [0108.442] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.442] GetProcessHeap () returned 0xd20000 [0108.443] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.443] GetProcessHeap () returned 0xd20000 [0108.443] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.443] GetProcessHeap () returned 0xd20000 [0108.443] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.443] GetProcessHeap () returned 0xd20000 [0108.443] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.443] GetProcessHeap () returned 0xd20000 [0108.443] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.443] GetProcessHeap () returned 0xd20000 [0108.443] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.443] GetProcessHeap () returned 0xd20000 [0108.443] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.443] GetProcessHeap () returned 0xd20000 [0108.443] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.443] GetProcessHeap () returned 0xd20000 [0108.443] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.443] GetProcessHeap () returned 0xd20000 [0108.443] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.444] GetProcessHeap () returned 0xd20000 [0108.444] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.444] GetProcessHeap () returned 0xd20000 [0108.444] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.444] GetProcessHeap () returned 0xd20000 [0108.444] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.444] GetProcessHeap () returned 0xd20000 [0108.444] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.444] GetProcessHeap () returned 0xd20000 [0108.444] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.444] GetProcessHeap () returned 0xd20000 [0108.444] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.444] GetProcessHeap () returned 0xd20000 [0108.444] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.444] GetProcessHeap () returned 0xd20000 [0108.444] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.444] GetProcessHeap () returned 0xd20000 [0108.444] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.444] GetProcessHeap () returned 0xd20000 [0108.445] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.445] GetProcessHeap () returned 0xd20000 [0108.445] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.445] GetProcessHeap () returned 0xd20000 [0108.445] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.445] GetProcessHeap () returned 0xd20000 [0108.445] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.445] GetProcessHeap () returned 0xd20000 [0108.445] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.445] GetProcessHeap () returned 0xd20000 [0108.445] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.445] GetProcessHeap () returned 0xd20000 [0108.445] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.462] GetProcessHeap () returned 0xd20000 [0108.462] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.462] GetProcessHeap () returned 0xd20000 [0108.462] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.462] GetProcessHeap () returned 0xd20000 [0108.462] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.462] GetProcessHeap () returned 0xd20000 [0108.462] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.462] GetProcessHeap () returned 0xd20000 [0108.462] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.462] GetProcessHeap () returned 0xd20000 [0108.462] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.462] GetProcessHeap () returned 0xd20000 [0108.462] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.463] GetProcessHeap () returned 0xd20000 [0108.463] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.463] GetProcessHeap () returned 0xd20000 [0108.463] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.463] GetProcessHeap () returned 0xd20000 [0108.463] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.463] GetProcessHeap () returned 0xd20000 [0108.463] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.463] GetProcessHeap () returned 0xd20000 [0108.463] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.463] GetProcessHeap () returned 0xd20000 [0108.463] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.463] GetProcessHeap () returned 0xd20000 [0108.463] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.463] GetProcessHeap () returned 0xd20000 [0108.463] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.463] GetProcessHeap () returned 0xd20000 [0108.463] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.463] GetProcessHeap () returned 0xd20000 [0108.463] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.464] GetProcessHeap () returned 0xd20000 [0108.464] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.464] GetProcessHeap () returned 0xd20000 [0108.464] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.464] GetProcessHeap () returned 0xd20000 [0108.464] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.464] GetProcessHeap () returned 0xd20000 [0108.464] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.464] GetProcessHeap () returned 0xd20000 [0108.464] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.464] GetProcessHeap () returned 0xd20000 [0108.464] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.464] GetProcessHeap () returned 0xd20000 [0108.464] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.464] GetProcessHeap () returned 0xd20000 [0108.464] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.464] GetProcessHeap () returned 0xd20000 [0108.464] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.464] GetProcessHeap () returned 0xd20000 [0108.464] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.465] GetProcessHeap () returned 0xd20000 [0108.465] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.465] GetProcessHeap () returned 0xd20000 [0108.465] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.465] GetProcessHeap () returned 0xd20000 [0108.465] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.465] GetProcessHeap () returned 0xd20000 [0108.465] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.465] GetProcessHeap () returned 0xd20000 [0108.465] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.465] GetProcessHeap () returned 0xd20000 [0108.465] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.465] GetProcessHeap () returned 0xd20000 [0108.465] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.465] GetProcessHeap () returned 0xd20000 [0108.465] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.465] GetProcessHeap () returned 0xd20000 [0108.465] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.465] GetProcessHeap () returned 0xd20000 [0108.465] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.466] GetProcessHeap () returned 0xd20000 [0108.466] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.466] GetProcessHeap () returned 0xd20000 [0108.466] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.466] GetProcessHeap () returned 0xd20000 [0108.466] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.466] GetProcessHeap () returned 0xd20000 [0108.466] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.466] GetProcessHeap () returned 0xd20000 [0108.466] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.466] GetProcessHeap () returned 0xd20000 [0108.466] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.466] GetProcessHeap () returned 0xd20000 [0108.466] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.466] GetProcessHeap () returned 0xd20000 [0108.466] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.466] GetProcessHeap () returned 0xd20000 [0108.466] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.466] GetProcessHeap () returned 0xd20000 [0108.466] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.466] GetProcessHeap () returned 0xd20000 [0108.467] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.467] GetProcessHeap () returned 0xd20000 [0108.467] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.467] GetProcessHeap () returned 0xd20000 [0108.467] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.467] GetProcessHeap () returned 0xd20000 [0108.467] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.467] GetProcessHeap () returned 0xd20000 [0108.467] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.467] GetProcessHeap () returned 0xd20000 [0108.467] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.467] GetProcessHeap () returned 0xd20000 [0108.467] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.467] GetProcessHeap () returned 0xd20000 [0108.467] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.467] GetProcessHeap () returned 0xd20000 [0108.467] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.467] GetProcessHeap () returned 0xd20000 [0108.467] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.467] GetProcessHeap () returned 0xd20000 [0108.468] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.468] GetProcessHeap () returned 0xd20000 [0108.468] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.468] GetProcessHeap () returned 0xd20000 [0108.468] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.468] GetProcessHeap () returned 0xd20000 [0108.468] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.468] GetProcessHeap () returned 0xd20000 [0108.468] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.468] GetProcessHeap () returned 0xd20000 [0108.468] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.468] GetProcessHeap () returned 0xd20000 [0108.468] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.468] GetProcessHeap () returned 0xd20000 [0108.468] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.468] GetProcessHeap () returned 0xd20000 [0108.468] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.468] GetProcessHeap () returned 0xd20000 [0108.468] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.469] GetProcessHeap () returned 0xd20000 [0108.469] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.469] GetProcessHeap () returned 0xd20000 [0108.469] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.469] GetProcessHeap () returned 0xd20000 [0108.469] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.469] GetProcessHeap () returned 0xd20000 [0108.469] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.469] GetProcessHeap () returned 0xd20000 [0108.469] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.469] GetProcessHeap () returned 0xd20000 [0108.469] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.469] GetProcessHeap () returned 0xd20000 [0108.469] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.469] GetProcessHeap () returned 0xd20000 [0108.469] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.469] GetProcessHeap () returned 0xd20000 [0108.469] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.469] GetProcessHeap () returned 0xd20000 [0108.469] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.470] GetProcessHeap () returned 0xd20000 [0108.470] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.470] GetProcessHeap () returned 0xd20000 [0108.470] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.470] GetProcessHeap () returned 0xd20000 [0108.470] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.470] GetProcessHeap () returned 0xd20000 [0108.470] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.470] GetProcessHeap () returned 0xd20000 [0108.470] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.470] GetProcessHeap () returned 0xd20000 [0108.470] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.470] GetProcessHeap () returned 0xd20000 [0108.470] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.470] GetProcessHeap () returned 0xd20000 [0108.470] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.470] GetProcessHeap () returned 0xd20000 [0108.470] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.470] GetProcessHeap () returned 0xd20000 [0108.470] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.470] GetProcessHeap () returned 0xd20000 [0108.471] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.471] GetProcessHeap () returned 0xd20000 [0108.471] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.471] GetProcessHeap () returned 0xd20000 [0108.471] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.471] GetProcessHeap () returned 0xd20000 [0108.471] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.471] GetProcessHeap () returned 0xd20000 [0108.471] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.471] GetProcessHeap () returned 0xd20000 [0108.471] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.471] GetProcessHeap () returned 0xd20000 [0108.471] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.471] GetProcessHeap () returned 0xd20000 [0108.471] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.471] GetProcessHeap () returned 0xd20000 [0108.471] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.471] GetProcessHeap () returned 0xd20000 [0108.471] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0108.471] GetProcessHeap () returned 0xd20000 [0108.472] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0108.472] GetProcessHeap () returned 0xd20000 [0108.472] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0108.472] GetProcessHeap () returned 0xd20000 [0108.472] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0108.472] GetProcessHeap () returned 0xd20000 [0108.472] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444c8 | out: hHeap=0xd20000) returned 1 [0108.472] GetProcessHeap () returned 0xd20000 [0108.472] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b098 | out: hHeap=0xd20000) returned 1 [0108.472] GetProcessHeap () returned 0xd20000 [0108.472] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0108.472] GetProcessHeap () returned 0xd20000 [0108.472] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b1b8 | out: hHeap=0xd20000) returned 1 [0108.472] GetProcessHeap () returned 0xd20000 [0108.472] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0108.472] GetProcessHeap () returned 0xd20000 [0108.472] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.472] GetProcessHeap () returned 0xd20000 [0108.473] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0108.473] WriteFile (in: hFile=0x230, lpBuffer=0xd4f310*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f310*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0108.477] GetProcessHeap () returned 0xd20000 [0108.477] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4f310, Size=0x30) returned 0xd4f310 [0108.477] GetProcessHeap () returned 0xd20000 [0108.477] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0108.477] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0108.477] GetProcessHeap () returned 0xd20000 [0108.477] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xeeab) returned 0xd4f348 [0108.479] ReadFile (in: hFile=0x230, lpBuffer=0xd4f348, nNumberOfBytesToRead=0xeeab, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4f348*, lpNumberOfBytesRead=0x299d7e8*=0xeeab, lpOverlapped=0x0) returned 1 [0108.481] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0108.481] WriteFile (in: hFile=0x230, lpBuffer=0xd4f348*, nNumberOfBytesToWrite=0xeeab, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4f348*, lpNumberOfBytesWritten=0x299d7e4*=0xeeab, lpOverlapped=0x0) returned 1 [0108.483] GetProcessHeap () returned 0xd20000 [0108.483] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4f348 | out: hHeap=0xd20000) returned 1 [0108.483] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0108.483] WriteFile (in: hFile=0x230, lpBuffer=0xd4f310*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f310*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0108.484] CloseHandle (hObject=0x230) returned 1 [0108.489] GetProcessHeap () returned 0xd20000 [0108.489] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd426e8 | out: hHeap=0xd20000) returned 1 [0108.489] GetProcessHeap () returned 0xd20000 [0108.489] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c1d8 | out: hHeap=0xd20000) returned 1 [0108.489] GetProcessHeap () returned 0xd20000 [0108.489] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0108.489] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\1l8ks.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\1l8ks.png") returned="C:\\Users\\FD1HVy\\Pictures\\1l8ks.png" [0108.489] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\1l8ks.png", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\1l8ks.png.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Pictures\\1l8ks.png.[ponce.lorena@aol.com]" [0108.489] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\1l8ks.png" (normalized: "c:\\users\\fd1hvy\\pictures\\1l8ks.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\1l8ks.png.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\pictures\\1l8ks.png.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0108.490] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\1l8ks.png" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0108.490] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0108.490] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html" [0108.490] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_recover.html")) returned 0x20 [0108.490] GetProcessHeap () returned 0xd20000 [0108.491] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44558 | out: hHeap=0xd20000) returned 1 [0108.491] FindNextFileW (in: hFindFile=0xd49120, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba5cd7f0, ftCreationTime.dwHighDateTime=0x1d4d461, ftLastAccessTime.dwLowDateTime=0x4bee9240, ftLastAccessTime.dwHighDateTime=0x1d4d1e1, ftLastWriteTime.dwLowDateTime=0x4bee9240, ftLastWriteTime.dwHighDateTime=0x1d4d1e1, nFileSizeHigh=0x0, nFileSizeLow=0x7d6c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="1QwzZkZC2qY97fG.gif", cAlternateFileName="1QWZZK~1.GIF")) returned 1 [0108.491] lstrcmpiW (lpString1="1QwzZkZC2qY97fG.gif", lpString2=".") returned 1 [0108.491] lstrcmpiW (lpString1="1QwzZkZC2qY97fG.gif", lpString2="..") returned 1 [0108.491] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="1QwzZkZC2qY97fG.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\1QwzZkZC2qY97fG.gif") returned="C:\\Users\\FD1HVy\\Pictures\\1QwzZkZC2qY97fG.gif" [0108.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1QwzZkZC2qY97fG.gif", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0108.491] GetProcessHeap () returned 0xd20000 [0108.491] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x14) returned 0xd36688 [0108.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="1QwzZkZC2qY97fG.gif", cchWideChar=-1, lpMultiByteStr=0xd36688, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="1QwzZkZC2qY97fG.gif", lpUsedDefaultChar=0x0) returned 20 [0108.491] lstrlenA (lpString="1QwzZkZC2qY97fG.gif") returned 19 [0108.491] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0108.491] lstrlenA (lpString="1QwzZkZC2qY97fG.gif") returned 19 [0108.491] lstrlenA (lpString=".dll") returned 4 [0108.491] lstrlenA (lpString=".dll") returned 4 [0108.491] lstrlenA (lpString="1QwzZkZC2qY97fG.gif") returned 19 [0108.491] lstrcmpiA (lpString1=".gif", lpString2=".dll") returned 1 [0108.491] lstrlenA (lpString="1QwzZkZC2qY97fG.gif") returned 19 [0108.492] lstrlenA (lpString=".ini") returned 4 [0108.492] lstrlenA (lpString=".ini") returned 4 [0108.492] lstrlenA (lpString="1QwzZkZC2qY97fG.gif") returned 19 [0108.492] lstrcmpiA (lpString1=".gif", lpString2=".ini") returned -1 [0108.492] lstrlenA (lpString="1QwzZkZC2qY97fG.gif") returned 19 [0108.492] lstrlenA (lpString=".inc") returned 4 [0108.492] lstrlenA (lpString=".inc") returned 4 [0108.492] lstrlenA (lpString="1QwzZkZC2qY97fG.gif") returned 19 [0108.492] lstrcmpiA (lpString1=".gif", lpString2=".inc") returned -1 [0108.492] lstrcmpiW (lpString1="1QwzZkZC2qY97fG.gif", lpString2="HOW_RECOVER.html") returned -1 [0108.492] lstrcmpiW (lpString1="1QwzZkZC2qY97fG.gif", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0108.493] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0108.493] lstrcmpiW (lpString1="1QwzZkZC2qY97fG.gif", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0108.493] GetProcessHeap () returned 0xd20000 [0108.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42620 [0108.493] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\1QwzZkZC2qY97fG.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\1qwzzkzc2qy97fg.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0108.493] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=32108) returned 1 [0108.493] GetProcessHeap () returned 0xd20000 [0108.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bd28 [0108.493] GetProcessHeap () returned 0xd20000 [0108.493] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0108.494] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\1QwzZkZC2qY97fG.gif") returned 44 [0108.494] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0108.494] GetProcessHeap () returned 0xd20000 [0108.494] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0108.494] GetProcessHeap () returned 0xd20000 [0108.494] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4f348 [0108.494] lstrlenA (lpString="rsa_encrypt") returned 11 [0108.494] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0108.497] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0108.497] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0108.497] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0108.497] GetProcessHeap () returned 0xd20000 [0108.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0108.497] lstrlenA (lpString="010001") returned 6 [0108.497] GetProcessHeap () returned 0xd20000 [0108.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc48 [0108.497] GetProcessHeap () returned 0xd20000 [0108.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0108.497] GetProcessHeap () returned 0xd20000 [0108.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b7e8 [0108.497] GetProcessHeap () returned 0xd20000 [0108.497] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0108.497] GetProcessHeap () returned 0xd20000 [0108.497] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4adc8 [0108.498] GetProcessHeap () returned 0xd20000 [0108.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44d80 [0108.498] GetProcessHeap () returned 0xd20000 [0108.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd98 [0108.498] GetProcessHeap () returned 0xd20000 [0108.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0108.498] GetProcessHeap () returned 0xd20000 [0108.498] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.498] GetProcessHeap () returned 0xd20000 [0108.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0108.498] GetProcessHeap () returned 0xd20000 [0108.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0108.498] GetProcessHeap () returned 0xd20000 [0108.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44920 [0108.498] GetProcessHeap () returned 0xd20000 [0108.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.498] GetProcessHeap () returned 0xd20000 [0108.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44510 [0108.498] GetProcessHeap () returned 0xd20000 [0108.498] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ae58 [0108.498] GetProcessHeap () returned 0xd20000 [0108.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0108.499] GetProcessHeap () returned 0xd20000 [0108.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0108.499] GetProcessHeap () returned 0xd20000 [0108.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ae58 | out: hHeap=0xd20000) returned 1 [0108.499] GetProcessHeap () returned 0xd20000 [0108.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.499] GetProcessHeap () returned 0xd20000 [0108.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446d8 [0108.499] GetProcessHeap () returned 0xd20000 [0108.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.499] GetProcessHeap () returned 0xd20000 [0108.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.499] GetProcessHeap () returned 0xd20000 [0108.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.499] GetProcessHeap () returned 0xd20000 [0108.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.499] GetProcessHeap () returned 0xd20000 [0108.499] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.499] GetProcessHeap () returned 0xd20000 [0108.499] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.500] GetProcessHeap () returned 0xd20000 [0108.500] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4ac18 [0108.500] GetProcessHeap () returned 0xd20000 [0108.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446d8 | out: hHeap=0xd20000) returned 1 [0108.500] GetProcessHeap () returned 0xd20000 [0108.500] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0108.500] GetProcessHeap () returned 0xd20000 [0108.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ac18 | out: hHeap=0xd20000) returned 1 [0108.500] GetProcessHeap () returned 0xd20000 [0108.500] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.500] GetProcessHeap () returned 0xd20000 [0108.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.500] GetProcessHeap () returned 0xd20000 [0108.500] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.500] GetProcessHeap () returned 0xd20000 [0108.500] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.500] GetProcessHeap () returned 0xd20000 [0108.500] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.500] GetProcessHeap () returned 0xd20000 [0108.501] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.501] GetProcessHeap () returned 0xd20000 [0108.501] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.501] GetProcessHeap () returned 0xd20000 [0108.501] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.501] GetProcessHeap () returned 0xd20000 [0108.501] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.501] GetProcessHeap () returned 0xd20000 [0108.501] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.501] GetProcessHeap () returned 0xd20000 [0108.501] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.501] GetProcessHeap () returned 0xd20000 [0108.501] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.501] GetProcessHeap () returned 0xd20000 [0108.501] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.501] GetProcessHeap () returned 0xd20000 [0108.501] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.501] GetProcessHeap () returned 0xd20000 [0108.501] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.501] GetProcessHeap () returned 0xd20000 [0108.502] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.502] GetProcessHeap () returned 0xd20000 [0108.502] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.502] GetProcessHeap () returned 0xd20000 [0108.502] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.502] GetProcessHeap () returned 0xd20000 [0108.502] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.502] GetProcessHeap () returned 0xd20000 [0108.502] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.503] GetProcessHeap () returned 0xd20000 [0108.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.503] GetProcessHeap () returned 0xd20000 [0108.503] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.503] GetProcessHeap () returned 0xd20000 [0108.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.503] GetProcessHeap () returned 0xd20000 [0108.503] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.503] GetProcessHeap () returned 0xd20000 [0108.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.503] GetProcessHeap () returned 0xd20000 [0108.503] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.503] GetProcessHeap () returned 0xd20000 [0108.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.503] GetProcessHeap () returned 0xd20000 [0108.503] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.503] GetProcessHeap () returned 0xd20000 [0108.503] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.503] GetProcessHeap () returned 0xd20000 [0108.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.504] GetProcessHeap () returned 0xd20000 [0108.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.504] GetProcessHeap () returned 0xd20000 [0108.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.504] GetProcessHeap () returned 0xd20000 [0108.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.504] GetProcessHeap () returned 0xd20000 [0108.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.504] GetProcessHeap () returned 0xd20000 [0108.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.504] GetProcessHeap () returned 0xd20000 [0108.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.504] GetProcessHeap () returned 0xd20000 [0108.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.504] GetProcessHeap () returned 0xd20000 [0108.504] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.504] GetProcessHeap () returned 0xd20000 [0108.504] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.504] GetProcessHeap () returned 0xd20000 [0108.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.505] GetProcessHeap () returned 0xd20000 [0108.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.505] GetProcessHeap () returned 0xd20000 [0108.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.505] GetProcessHeap () returned 0xd20000 [0108.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.505] GetProcessHeap () returned 0xd20000 [0108.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.505] GetProcessHeap () returned 0xd20000 [0108.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.505] GetProcessHeap () returned 0xd20000 [0108.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.505] GetProcessHeap () returned 0xd20000 [0108.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.505] GetProcessHeap () returned 0xd20000 [0108.505] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.505] GetProcessHeap () returned 0xd20000 [0108.505] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.506] GetProcessHeap () returned 0xd20000 [0108.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.506] GetProcessHeap () returned 0xd20000 [0108.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.506] GetProcessHeap () returned 0xd20000 [0108.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.506] GetProcessHeap () returned 0xd20000 [0108.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.506] GetProcessHeap () returned 0xd20000 [0108.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.506] GetProcessHeap () returned 0xd20000 [0108.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.506] GetProcessHeap () returned 0xd20000 [0108.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.506] GetProcessHeap () returned 0xd20000 [0108.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.506] GetProcessHeap () returned 0xd20000 [0108.506] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.506] GetProcessHeap () returned 0xd20000 [0108.506] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.507] GetProcessHeap () returned 0xd20000 [0108.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.507] GetProcessHeap () returned 0xd20000 [0108.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.507] GetProcessHeap () returned 0xd20000 [0108.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.507] GetProcessHeap () returned 0xd20000 [0108.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.507] GetProcessHeap () returned 0xd20000 [0108.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.507] GetProcessHeap () returned 0xd20000 [0108.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.507] GetProcessHeap () returned 0xd20000 [0108.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.507] GetProcessHeap () returned 0xd20000 [0108.507] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.507] GetProcessHeap () returned 0xd20000 [0108.507] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.508] GetProcessHeap () returned 0xd20000 [0108.508] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.508] GetProcessHeap () returned 0xd20000 [0108.508] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.508] GetProcessHeap () returned 0xd20000 [0108.509] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.509] GetProcessHeap () returned 0xd20000 [0108.509] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.510] GetProcessHeap () returned 0xd20000 [0108.510] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.510] GetProcessHeap () returned 0xd20000 [0108.510] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.510] GetProcessHeap () returned 0xd20000 [0108.510] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.510] GetProcessHeap () returned 0xd20000 [0108.510] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.510] GetProcessHeap () returned 0xd20000 [0108.510] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.510] GetProcessHeap () returned 0xd20000 [0108.510] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.510] GetProcessHeap () returned 0xd20000 [0108.510] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.511] GetProcessHeap () returned 0xd20000 [0108.511] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.511] GetProcessHeap () returned 0xd20000 [0108.511] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.511] GetProcessHeap () returned 0xd20000 [0108.511] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.511] GetProcessHeap () returned 0xd20000 [0108.511] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.511] GetProcessHeap () returned 0xd20000 [0108.511] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.511] GetProcessHeap () returned 0xd20000 [0108.511] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.511] GetProcessHeap () returned 0xd20000 [0108.511] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.511] GetProcessHeap () returned 0xd20000 [0108.511] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.511] GetProcessHeap () returned 0xd20000 [0108.511] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.511] GetProcessHeap () returned 0xd20000 [0108.512] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.512] GetProcessHeap () returned 0xd20000 [0108.512] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.512] GetProcessHeap () returned 0xd20000 [0108.512] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.512] GetProcessHeap () returned 0xd20000 [0108.512] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.512] GetProcessHeap () returned 0xd20000 [0108.512] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.512] GetProcessHeap () returned 0xd20000 [0108.512] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.512] GetProcessHeap () returned 0xd20000 [0108.512] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.512] GetProcessHeap () returned 0xd20000 [0108.512] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.512] GetProcessHeap () returned 0xd20000 [0108.512] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.512] GetProcessHeap () returned 0xd20000 [0108.512] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.512] GetProcessHeap () returned 0xd20000 [0108.513] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.513] GetProcessHeap () returned 0xd20000 [0108.513] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.513] GetProcessHeap () returned 0xd20000 [0108.513] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.513] GetProcessHeap () returned 0xd20000 [0108.513] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.513] GetProcessHeap () returned 0xd20000 [0108.513] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.513] GetProcessHeap () returned 0xd20000 [0108.513] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.513] GetProcessHeap () returned 0xd20000 [0108.513] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.513] GetProcessHeap () returned 0xd20000 [0108.513] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.513] GetProcessHeap () returned 0xd20000 [0108.513] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.513] GetProcessHeap () returned 0xd20000 [0108.513] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.513] GetProcessHeap () returned 0xd20000 [0108.514] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.514] GetProcessHeap () returned 0xd20000 [0108.514] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.514] GetProcessHeap () returned 0xd20000 [0108.514] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.514] GetProcessHeap () returned 0xd20000 [0108.514] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.514] GetProcessHeap () returned 0xd20000 [0108.514] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.514] GetProcessHeap () returned 0xd20000 [0108.514] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.514] GetProcessHeap () returned 0xd20000 [0108.514] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.514] GetProcessHeap () returned 0xd20000 [0108.514] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.514] GetProcessHeap () returned 0xd20000 [0108.514] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.514] GetProcessHeap () returned 0xd20000 [0108.514] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.514] GetProcessHeap () returned 0xd20000 [0108.514] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.515] GetProcessHeap () returned 0xd20000 [0108.515] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.515] GetProcessHeap () returned 0xd20000 [0108.515] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.515] GetProcessHeap () returned 0xd20000 [0108.515] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.515] GetProcessHeap () returned 0xd20000 [0108.515] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.515] GetProcessHeap () returned 0xd20000 [0108.515] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.515] GetProcessHeap () returned 0xd20000 [0108.515] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.515] GetProcessHeap () returned 0xd20000 [0108.515] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.515] GetProcessHeap () returned 0xd20000 [0108.515] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.515] GetProcessHeap () returned 0xd20000 [0108.515] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.515] GetProcessHeap () returned 0xd20000 [0108.515] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.516] GetProcessHeap () returned 0xd20000 [0108.516] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.516] GetProcessHeap () returned 0xd20000 [0108.516] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.516] GetProcessHeap () returned 0xd20000 [0108.516] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.516] GetProcessHeap () returned 0xd20000 [0108.516] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.516] GetProcessHeap () returned 0xd20000 [0108.516] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.516] GetProcessHeap () returned 0xd20000 [0108.516] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.516] GetProcessHeap () returned 0xd20000 [0108.516] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.516] GetProcessHeap () returned 0xd20000 [0108.516] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.516] GetProcessHeap () returned 0xd20000 [0108.516] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.516] GetProcessHeap () returned 0xd20000 [0108.517] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.517] GetProcessHeap () returned 0xd20000 [0108.517] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.517] GetProcessHeap () returned 0xd20000 [0108.517] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.517] GetProcessHeap () returned 0xd20000 [0108.517] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.517] GetProcessHeap () returned 0xd20000 [0108.517] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.517] GetProcessHeap () returned 0xd20000 [0108.517] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.517] GetProcessHeap () returned 0xd20000 [0108.517] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.517] GetProcessHeap () returned 0xd20000 [0108.517] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.517] GetProcessHeap () returned 0xd20000 [0108.517] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.517] GetProcessHeap () returned 0xd20000 [0108.517] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.518] GetProcessHeap () returned 0xd20000 [0108.518] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.518] GetProcessHeap () returned 0xd20000 [0108.518] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.518] GetProcessHeap () returned 0xd20000 [0108.518] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.518] GetProcessHeap () returned 0xd20000 [0108.518] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.518] GetProcessHeap () returned 0xd20000 [0108.518] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.518] GetProcessHeap () returned 0xd20000 [0108.518] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.518] GetProcessHeap () returned 0xd20000 [0108.518] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.518] GetProcessHeap () returned 0xd20000 [0108.518] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.518] GetProcessHeap () returned 0xd20000 [0108.518] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.518] GetProcessHeap () returned 0xd20000 [0108.518] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.519] GetProcessHeap () returned 0xd20000 [0108.519] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.519] GetProcessHeap () returned 0xd20000 [0108.519] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.519] GetProcessHeap () returned 0xd20000 [0108.519] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.519] GetProcessHeap () returned 0xd20000 [0108.519] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.519] GetProcessHeap () returned 0xd20000 [0108.519] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.519] GetProcessHeap () returned 0xd20000 [0108.519] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.519] GetProcessHeap () returned 0xd20000 [0108.519] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.519] GetProcessHeap () returned 0xd20000 [0108.519] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.519] GetProcessHeap () returned 0xd20000 [0108.519] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.519] GetProcessHeap () returned 0xd20000 [0108.519] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.520] GetProcessHeap () returned 0xd20000 [0108.520] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.520] GetProcessHeap () returned 0xd20000 [0108.520] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.520] GetProcessHeap () returned 0xd20000 [0108.520] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0108.520] GetProcessHeap () returned 0xd20000 [0108.520] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0108.520] GetProcessHeap () returned 0xd20000 [0108.520] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0108.520] GetProcessHeap () returned 0xd20000 [0108.520] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0108.520] GetProcessHeap () returned 0xd20000 [0108.520] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44510 | out: hHeap=0xd20000) returned 1 [0108.520] GetProcessHeap () returned 0xd20000 [0108.520] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4adc8 | out: hHeap=0xd20000) returned 1 [0108.520] GetProcessHeap () returned 0xd20000 [0108.520] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0108.521] GetProcessHeap () returned 0xd20000 [0108.521] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0108.521] GetProcessHeap () returned 0xd20000 [0108.521] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0108.521] GetProcessHeap () returned 0xd20000 [0108.521] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.521] GetProcessHeap () returned 0xd20000 [0108.521] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0108.521] WriteFile (in: hFile=0x230, lpBuffer=0xd4f348*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f348*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0108.525] GetProcessHeap () returned 0xd20000 [0108.525] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4f348, Size=0x30) returned 0xd4f348 [0108.525] GetProcessHeap () returned 0xd20000 [0108.525] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0108.525] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0108.525] GetProcessHeap () returned 0xd20000 [0108.525] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x7d6c) returned 0xd4f380 [0108.526] ReadFile (in: hFile=0x230, lpBuffer=0xd4f380, nNumberOfBytesToRead=0x7d6c, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4f380*, lpNumberOfBytesRead=0x299d7e8*=0x7d6c, lpOverlapped=0x0) returned 1 [0108.527] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0108.527] WriteFile (in: hFile=0x230, lpBuffer=0xd4f380*, nNumberOfBytesToWrite=0x7d6c, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4f380*, lpNumberOfBytesWritten=0x299d7e4*=0x7d6c, lpOverlapped=0x0) returned 1 [0108.529] GetProcessHeap () returned 0xd20000 [0108.529] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4f380 | out: hHeap=0xd20000) returned 1 [0108.529] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0108.529] WriteFile (in: hFile=0x230, lpBuffer=0xd4f348*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f348*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0108.531] CloseHandle (hObject=0x230) returned 1 [0108.539] GetProcessHeap () returned 0xd20000 [0108.540] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42620 | out: hHeap=0xd20000) returned 1 [0108.540] GetProcessHeap () returned 0xd20000 [0108.540] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bd28 | out: hHeap=0xd20000) returned 1 [0108.540] GetProcessHeap () returned 0xd20000 [0108.540] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0108.540] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\1QwzZkZC2qY97fG.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\1QwzZkZC2qY97fG.gif") returned="C:\\Users\\FD1HVy\\Pictures\\1QwzZkZC2qY97fG.gif" [0108.540] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\1QwzZkZC2qY97fG.gif", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\1QwzZkZC2qY97fG.gif.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Pictures\\1QwzZkZC2qY97fG.gif.[ponce.lorena@aol.com]" [0108.540] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\1QwzZkZC2qY97fG.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\1qwzzkzc2qy97fg.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\1QwzZkZC2qY97fG.gif.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\pictures\\1qwzzkzc2qy97fg.gif.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0108.541] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\1QwzZkZC2qY97fG.gif" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0108.541] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0108.541] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html" [0108.541] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_recover.html")) returned 0x20 [0108.541] GetProcessHeap () returned 0xd20000 [0108.541] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36688 | out: hHeap=0xd20000) returned 1 [0108.541] FindNextFileW (in: hFindFile=0xd49120, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b5add70, ftCreationTime.dwHighDateTime=0x1d4d121, ftLastAccessTime.dwLowDateTime=0x53a7e190, ftLastAccessTime.dwHighDateTime=0x1d4d096, ftLastWriteTime.dwLowDateTime=0x53a7e190, ftLastWriteTime.dwHighDateTime=0x1d4d096, nFileSizeHigh=0x0, nFileSizeLow=0x9c35, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2CgFKfuS.bmp", cAlternateFileName="")) returned 1 [0108.541] lstrcmpiW (lpString1="2CgFKfuS.bmp", lpString2=".") returned 1 [0108.541] lstrcmpiW (lpString1="2CgFKfuS.bmp", lpString2="..") returned 1 [0108.541] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="2CgFKfuS.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\2CgFKfuS.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\2CgFKfuS.bmp" [0108.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="2CgFKfuS.bmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0108.542] GetProcessHeap () returned 0xd20000 [0108.542] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xd) returned 0xd44468 [0108.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="2CgFKfuS.bmp", cchWideChar=-1, lpMultiByteStr=0xd44468, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2CgFKfuS.bmp", lpUsedDefaultChar=0x0) returned 13 [0108.542] lstrlenA (lpString="2CgFKfuS.bmp") returned 12 [0108.542] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0108.542] lstrlenA (lpString="2CgFKfuS.bmp") returned 12 [0108.542] lstrlenA (lpString=".dll") returned 4 [0108.542] lstrlenA (lpString=".dll") returned 4 [0108.542] lstrlenA (lpString="2CgFKfuS.bmp") returned 12 [0108.542] lstrcmpiA (lpString1=".bmp", lpString2=".dll") returned -1 [0108.542] lstrlenA (lpString="2CgFKfuS.bmp") returned 12 [0108.542] lstrlenA (lpString=".ini") returned 4 [0108.542] lstrlenA (lpString=".ini") returned 4 [0108.542] lstrlenA (lpString="2CgFKfuS.bmp") returned 12 [0108.542] lstrcmpiA (lpString1=".bmp", lpString2=".ini") returned -1 [0108.542] lstrlenA (lpString="2CgFKfuS.bmp") returned 12 [0108.542] lstrlenA (lpString=".inc") returned 4 [0108.542] lstrlenA (lpString=".inc") returned 4 [0108.542] lstrlenA (lpString="2CgFKfuS.bmp") returned 12 [0108.542] lstrcmpiA (lpString1=".bmp", lpString2=".inc") returned -1 [0108.543] lstrcmpiW (lpString1="2CgFKfuS.bmp", lpString2="HOW_RECOVER.html") returned -1 [0108.543] lstrcmpiW (lpString1="2CgFKfuS.bmp", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0108.543] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0108.543] lstrcmpiW (lpString1="2CgFKfuS.bmp", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0108.543] GetProcessHeap () returned 0xd20000 [0108.543] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42828 [0108.543] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\2CgFKfuS.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\2cgfkfus.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0108.543] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=39989) returned 1 [0108.543] GetProcessHeap () returned 0xd20000 [0108.543] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c250 [0108.543] GetProcessHeap () returned 0xd20000 [0108.543] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0108.543] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\2CgFKfuS.bmp") returned 37 [0108.543] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0108.544] GetProcessHeap () returned 0xd20000 [0108.544] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0108.544] GetProcessHeap () returned 0xd20000 [0108.544] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x38b) returned 0xd4f380 [0108.544] lstrlenA (lpString="rsa_encrypt") returned 11 [0108.544] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0108.546] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0108.546] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0108.546] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0108.546] GetProcessHeap () returned 0xd20000 [0108.546] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0108.546] lstrlenA (lpString="010001") returned 6 [0108.547] GetProcessHeap () returned 0xd20000 [0108.547] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd98 [0108.547] GetProcessHeap () returned 0xd20000 [0108.547] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0108.547] GetProcessHeap () returned 0xd20000 [0108.547] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b008 [0108.547] GetProcessHeap () returned 0xd20000 [0108.547] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0108.547] GetProcessHeap () returned 0xd20000 [0108.547] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4adc8 [0108.547] GetProcessHeap () returned 0xd20000 [0108.547] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44b50 [0108.547] GetProcessHeap () returned 0xd20000 [0108.547] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc18 [0108.547] GetProcessHeap () returned 0xd20000 [0108.547] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0108.547] GetProcessHeap () returned 0xd20000 [0108.548] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.548] GetProcessHeap () returned 0xd20000 [0108.548] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0108.548] GetProcessHeap () returned 0xd20000 [0108.548] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0108.548] GetProcessHeap () returned 0xd20000 [0108.548] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44a38 [0108.548] GetProcessHeap () returned 0xd20000 [0108.548] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.548] GetProcessHeap () returned 0xd20000 [0108.548] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444c8 [0108.548] GetProcessHeap () returned 0xd20000 [0108.548] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b638 [0108.548] GetProcessHeap () returned 0xd20000 [0108.548] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0108.548] GetProcessHeap () returned 0xd20000 [0108.548] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0108.548] GetProcessHeap () returned 0xd20000 [0108.548] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b638 | out: hHeap=0xd20000) returned 1 [0108.548] GetProcessHeap () returned 0xd20000 [0108.549] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.549] GetProcessHeap () returned 0xd20000 [0108.549] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44498 [0108.549] GetProcessHeap () returned 0xd20000 [0108.549] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.549] GetProcessHeap () returned 0xd20000 [0108.549] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.549] GetProcessHeap () returned 0xd20000 [0108.549] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.549] GetProcessHeap () returned 0xd20000 [0108.549] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.549] GetProcessHeap () returned 0xd20000 [0108.549] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.549] GetProcessHeap () returned 0xd20000 [0108.549] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.549] GetProcessHeap () returned 0xd20000 [0108.549] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4aaf8 [0108.549] GetProcessHeap () returned 0xd20000 [0108.549] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44498 | out: hHeap=0xd20000) returned 1 [0108.549] GetProcessHeap () returned 0xd20000 [0108.549] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0108.549] GetProcessHeap () returned 0xd20000 [0108.550] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aaf8 | out: hHeap=0xd20000) returned 1 [0108.550] GetProcessHeap () returned 0xd20000 [0108.550] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.550] GetProcessHeap () returned 0xd20000 [0108.550] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.550] GetProcessHeap () returned 0xd20000 [0108.550] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.550] GetProcessHeap () returned 0xd20000 [0108.550] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.550] GetProcessHeap () returned 0xd20000 [0108.550] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.550] GetProcessHeap () returned 0xd20000 [0108.550] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.550] GetProcessHeap () returned 0xd20000 [0108.550] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.550] GetProcessHeap () returned 0xd20000 [0108.550] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.550] GetProcessHeap () returned 0xd20000 [0108.550] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.550] GetProcessHeap () returned 0xd20000 [0108.551] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.551] GetProcessHeap () returned 0xd20000 [0108.551] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.551] GetProcessHeap () returned 0xd20000 [0108.551] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.551] GetProcessHeap () returned 0xd20000 [0108.551] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.551] GetProcessHeap () returned 0xd20000 [0108.551] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.551] GetProcessHeap () returned 0xd20000 [0108.551] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.551] GetProcessHeap () returned 0xd20000 [0108.551] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.551] GetProcessHeap () returned 0xd20000 [0108.551] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.551] GetProcessHeap () returned 0xd20000 [0108.551] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.551] GetProcessHeap () returned 0xd20000 [0108.551] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.551] GetProcessHeap () returned 0xd20000 [0108.552] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.552] GetProcessHeap () returned 0xd20000 [0108.552] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.552] GetProcessHeap () returned 0xd20000 [0108.552] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.552] GetProcessHeap () returned 0xd20000 [0108.552] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.552] GetProcessHeap () returned 0xd20000 [0108.552] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.552] GetProcessHeap () returned 0xd20000 [0108.552] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.552] GetProcessHeap () returned 0xd20000 [0108.552] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.552] GetProcessHeap () returned 0xd20000 [0108.552] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.552] GetProcessHeap () returned 0xd20000 [0108.552] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.552] GetProcessHeap () returned 0xd20000 [0108.552] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.553] GetProcessHeap () returned 0xd20000 [0108.553] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.553] GetProcessHeap () returned 0xd20000 [0108.553] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.553] GetProcessHeap () returned 0xd20000 [0108.553] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.553] GetProcessHeap () returned 0xd20000 [0108.553] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.553] GetProcessHeap () returned 0xd20000 [0108.553] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.553] GetProcessHeap () returned 0xd20000 [0108.553] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.553] GetProcessHeap () returned 0xd20000 [0108.553] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.553] GetProcessHeap () returned 0xd20000 [0108.553] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.553] GetProcessHeap () returned 0xd20000 [0108.553] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.553] GetProcessHeap () returned 0xd20000 [0108.553] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.554] GetProcessHeap () returned 0xd20000 [0108.554] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.554] GetProcessHeap () returned 0xd20000 [0108.554] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.554] GetProcessHeap () returned 0xd20000 [0108.554] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.554] GetProcessHeap () returned 0xd20000 [0108.554] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.554] GetProcessHeap () returned 0xd20000 [0108.554] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.554] GetProcessHeap () returned 0xd20000 [0108.554] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.554] GetProcessHeap () returned 0xd20000 [0108.554] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.554] GetProcessHeap () returned 0xd20000 [0108.554] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.554] GetProcessHeap () returned 0xd20000 [0108.554] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.555] GetProcessHeap () returned 0xd20000 [0108.555] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.555] GetProcessHeap () returned 0xd20000 [0108.555] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.555] GetProcessHeap () returned 0xd20000 [0108.555] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.555] GetProcessHeap () returned 0xd20000 [0108.555] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.555] GetProcessHeap () returned 0xd20000 [0108.555] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.555] GetProcessHeap () returned 0xd20000 [0108.555] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.556] GetProcessHeap () returned 0xd20000 [0108.556] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.556] GetProcessHeap () returned 0xd20000 [0108.556] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.556] GetProcessHeap () returned 0xd20000 [0108.556] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.556] GetProcessHeap () returned 0xd20000 [0108.556] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.556] GetProcessHeap () returned 0xd20000 [0108.556] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.556] GetProcessHeap () returned 0xd20000 [0108.556] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.556] GetProcessHeap () returned 0xd20000 [0108.556] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.556] GetProcessHeap () returned 0xd20000 [0108.556] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.556] GetProcessHeap () returned 0xd20000 [0108.556] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.556] GetProcessHeap () returned 0xd20000 [0108.556] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.557] GetProcessHeap () returned 0xd20000 [0108.557] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.557] GetProcessHeap () returned 0xd20000 [0108.557] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.557] GetProcessHeap () returned 0xd20000 [0108.557] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.557] GetProcessHeap () returned 0xd20000 [0108.557] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.557] GetProcessHeap () returned 0xd20000 [0108.557] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.557] GetProcessHeap () returned 0xd20000 [0108.557] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.557] GetProcessHeap () returned 0xd20000 [0108.557] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.557] GetProcessHeap () returned 0xd20000 [0108.557] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.557] GetProcessHeap () returned 0xd20000 [0108.557] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.557] GetProcessHeap () returned 0xd20000 [0108.557] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.557] GetProcessHeap () returned 0xd20000 [0108.557] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.558] GetProcessHeap () returned 0xd20000 [0108.558] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.558] GetProcessHeap () returned 0xd20000 [0108.558] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.558] GetProcessHeap () returned 0xd20000 [0108.558] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.558] GetProcessHeap () returned 0xd20000 [0108.558] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.558] GetProcessHeap () returned 0xd20000 [0108.558] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.558] GetProcessHeap () returned 0xd20000 [0108.558] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.558] GetProcessHeap () returned 0xd20000 [0108.558] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.558] GetProcessHeap () returned 0xd20000 [0108.558] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.558] GetProcessHeap () returned 0xd20000 [0108.558] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.558] GetProcessHeap () returned 0xd20000 [0108.558] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.558] GetProcessHeap () returned 0xd20000 [0108.558] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.559] GetProcessHeap () returned 0xd20000 [0108.559] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.559] GetProcessHeap () returned 0xd20000 [0108.559] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.559] GetProcessHeap () returned 0xd20000 [0108.559] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.559] GetProcessHeap () returned 0xd20000 [0108.559] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.559] GetProcessHeap () returned 0xd20000 [0108.559] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.559] GetProcessHeap () returned 0xd20000 [0108.559] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.559] GetProcessHeap () returned 0xd20000 [0108.559] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.559] GetProcessHeap () returned 0xd20000 [0108.559] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.559] GetProcessHeap () returned 0xd20000 [0108.559] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.559] GetProcessHeap () returned 0xd20000 [0108.559] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.560] GetProcessHeap () returned 0xd20000 [0108.560] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.560] GetProcessHeap () returned 0xd20000 [0108.560] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.560] GetProcessHeap () returned 0xd20000 [0108.560] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.560] GetProcessHeap () returned 0xd20000 [0108.560] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.560] GetProcessHeap () returned 0xd20000 [0108.560] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.560] GetProcessHeap () returned 0xd20000 [0108.560] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.560] GetProcessHeap () returned 0xd20000 [0108.560] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.560] GetProcessHeap () returned 0xd20000 [0108.560] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.560] GetProcessHeap () returned 0xd20000 [0108.560] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.560] GetProcessHeap () returned 0xd20000 [0108.560] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.561] GetProcessHeap () returned 0xd20000 [0108.561] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.561] GetProcessHeap () returned 0xd20000 [0108.561] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.561] GetProcessHeap () returned 0xd20000 [0108.561] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.561] GetProcessHeap () returned 0xd20000 [0108.561] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.561] GetProcessHeap () returned 0xd20000 [0108.561] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.561] GetProcessHeap () returned 0xd20000 [0108.561] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.561] GetProcessHeap () returned 0xd20000 [0108.561] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.561] GetProcessHeap () returned 0xd20000 [0108.561] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.561] GetProcessHeap () returned 0xd20000 [0108.561] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.561] GetProcessHeap () returned 0xd20000 [0108.561] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.562] GetProcessHeap () returned 0xd20000 [0108.562] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.562] GetProcessHeap () returned 0xd20000 [0108.562] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.562] GetProcessHeap () returned 0xd20000 [0108.562] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.562] GetProcessHeap () returned 0xd20000 [0108.562] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.562] GetProcessHeap () returned 0xd20000 [0108.562] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.562] GetProcessHeap () returned 0xd20000 [0108.562] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.562] GetProcessHeap () returned 0xd20000 [0108.562] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.562] GetProcessHeap () returned 0xd20000 [0108.562] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.562] GetProcessHeap () returned 0xd20000 [0108.562] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.562] GetProcessHeap () returned 0xd20000 [0108.562] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.562] GetProcessHeap () returned 0xd20000 [0108.563] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.563] GetProcessHeap () returned 0xd20000 [0108.563] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.563] GetProcessHeap () returned 0xd20000 [0108.563] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.563] GetProcessHeap () returned 0xd20000 [0108.563] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.563] GetProcessHeap () returned 0xd20000 [0108.563] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.563] GetProcessHeap () returned 0xd20000 [0108.563] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.563] GetProcessHeap () returned 0xd20000 [0108.563] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.563] GetProcessHeap () returned 0xd20000 [0108.563] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.563] GetProcessHeap () returned 0xd20000 [0108.563] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.563] GetProcessHeap () returned 0xd20000 [0108.563] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.563] GetProcessHeap () returned 0xd20000 [0108.564] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.564] GetProcessHeap () returned 0xd20000 [0108.564] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.564] GetProcessHeap () returned 0xd20000 [0108.564] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.564] GetProcessHeap () returned 0xd20000 [0108.564] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.564] GetProcessHeap () returned 0xd20000 [0108.564] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.564] GetProcessHeap () returned 0xd20000 [0108.564] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.564] GetProcessHeap () returned 0xd20000 [0108.564] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.564] GetProcessHeap () returned 0xd20000 [0108.564] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.564] GetProcessHeap () returned 0xd20000 [0108.564] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.564] GetProcessHeap () returned 0xd20000 [0108.564] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.564] GetProcessHeap () returned 0xd20000 [0108.565] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.565] GetProcessHeap () returned 0xd20000 [0108.565] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.565] GetProcessHeap () returned 0xd20000 [0108.565] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.565] GetProcessHeap () returned 0xd20000 [0108.565] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.565] GetProcessHeap () returned 0xd20000 [0108.565] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.565] GetProcessHeap () returned 0xd20000 [0108.565] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.565] GetProcessHeap () returned 0xd20000 [0108.565] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.565] GetProcessHeap () returned 0xd20000 [0108.565] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.565] GetProcessHeap () returned 0xd20000 [0108.565] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.565] GetProcessHeap () returned 0xd20000 [0108.565] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.565] GetProcessHeap () returned 0xd20000 [0108.565] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.566] GetProcessHeap () returned 0xd20000 [0108.566] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.566] GetProcessHeap () returned 0xd20000 [0108.566] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.566] GetProcessHeap () returned 0xd20000 [0108.566] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.566] GetProcessHeap () returned 0xd20000 [0108.566] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.566] GetProcessHeap () returned 0xd20000 [0108.566] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.566] GetProcessHeap () returned 0xd20000 [0108.566] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.566] GetProcessHeap () returned 0xd20000 [0108.566] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.566] GetProcessHeap () returned 0xd20000 [0108.566] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.566] GetProcessHeap () returned 0xd20000 [0108.566] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.566] GetProcessHeap () returned 0xd20000 [0108.566] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.567] GetProcessHeap () returned 0xd20000 [0108.567] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.567] GetProcessHeap () returned 0xd20000 [0108.567] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.567] GetProcessHeap () returned 0xd20000 [0108.567] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.567] GetProcessHeap () returned 0xd20000 [0108.567] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0108.567] GetProcessHeap () returned 0xd20000 [0108.567] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0108.567] GetProcessHeap () returned 0xd20000 [0108.567] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0108.567] GetProcessHeap () returned 0xd20000 [0108.567] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0108.567] GetProcessHeap () returned 0xd20000 [0108.567] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444c8 | out: hHeap=0xd20000) returned 1 [0108.567] GetProcessHeap () returned 0xd20000 [0108.567] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4adc8 | out: hHeap=0xd20000) returned 1 [0108.568] GetProcessHeap () returned 0xd20000 [0108.568] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0108.568] GetProcessHeap () returned 0xd20000 [0108.568] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b008 | out: hHeap=0xd20000) returned 1 [0108.568] GetProcessHeap () returned 0xd20000 [0108.568] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0108.568] GetProcessHeap () returned 0xd20000 [0108.568] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.568] GetProcessHeap () returned 0xd20000 [0108.568] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0108.568] WriteFile (in: hFile=0x230, lpBuffer=0xd4f380*, nNumberOfBytesToWrite=0x38b, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f380*, lpNumberOfBytesWritten=0x299d864*=0x38b, lpOverlapped=0x0) returned 1 [0108.574] GetProcessHeap () returned 0xd20000 [0108.574] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4f380, Size=0x30) returned 0xd4f380 [0108.574] GetProcessHeap () returned 0xd20000 [0108.575] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0108.575] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0108.575] GetProcessHeap () returned 0xd20000 [0108.575] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x9c40) returned 0xd4f3b8 [0108.575] ReadFile (in: hFile=0x230, lpBuffer=0xd4f3b8, nNumberOfBytesToRead=0x9c40, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4f3b8*, lpNumberOfBytesRead=0x299d7e8*=0x9c40, lpOverlapped=0x0) returned 1 [0108.576] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0108.576] WriteFile (in: hFile=0x230, lpBuffer=0xd4f3b8*, nNumberOfBytesToWrite=0x9c40, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4f3b8*, lpNumberOfBytesWritten=0x299d7e4*=0x9c40, lpOverlapped=0x0) returned 1 [0108.578] GetProcessHeap () returned 0xd20000 [0108.579] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4f3b8 | out: hHeap=0xd20000) returned 1 [0108.579] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0108.579] WriteFile (in: hFile=0x230, lpBuffer=0xd4f380*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f380*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0108.580] CloseHandle (hObject=0x230) returned 1 [0108.585] GetProcessHeap () returned 0xd20000 [0108.585] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42828 | out: hHeap=0xd20000) returned 1 [0108.585] GetProcessHeap () returned 0xd20000 [0108.585] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c250 | out: hHeap=0xd20000) returned 1 [0108.586] GetProcessHeap () returned 0xd20000 [0108.586] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0108.586] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\2CgFKfuS.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\2CgFKfuS.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\2CgFKfuS.bmp" [0108.586] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\2CgFKfuS.bmp", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\2CgFKfuS.bmp.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Pictures\\2CgFKfuS.bmp.[ponce.lorena@aol.com]" [0108.586] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\2CgFKfuS.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\2cgfkfus.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\2CgFKfuS.bmp.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\pictures\\2cgfkfus.bmp.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0108.587] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\2CgFKfuS.bmp" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0108.587] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0108.587] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html" [0108.587] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_recover.html")) returned 0x20 [0108.588] GetProcessHeap () returned 0xd20000 [0108.588] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44468 | out: hHeap=0xd20000) returned 1 [0108.588] FindNextFileW (in: hFindFile=0xd49120, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb336d390, ftCreationTime.dwHighDateTime=0x1d4cb1a, ftLastAccessTime.dwLowDateTime=0x2a487c70, ftLastAccessTime.dwHighDateTime=0x1d4d38d, ftLastWriteTime.dwLowDateTime=0x2a487c70, ftLastWriteTime.dwHighDateTime=0x1d4d38d, nFileSizeHigh=0x0, nFileSizeLow=0x9c9c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2_zz.bmp", cAlternateFileName="")) returned 1 [0108.588] lstrcmpiW (lpString1="2_zz.bmp", lpString2=".") returned 1 [0108.588] lstrcmpiW (lpString1="2_zz.bmp", lpString2="..") returned 1 [0108.588] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="2_zz.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\2_zz.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\2_zz.bmp" [0108.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="2_zz.bmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0108.588] GetProcessHeap () returned 0xd20000 [0108.588] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x9) returned 0xd446c0 [0108.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="2_zz.bmp", cchWideChar=-1, lpMultiByteStr=0xd446c0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2_zz.bmp", lpUsedDefaultChar=0x0) returned 9 [0108.588] lstrlenA (lpString="2_zz.bmp") returned 8 [0108.588] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0108.588] lstrlenA (lpString="2_zz.bmp") returned 8 [0108.588] lstrlenA (lpString=".dll") returned 4 [0108.588] lstrlenA (lpString=".dll") returned 4 [0108.588] lstrlenA (lpString="2_zz.bmp") returned 8 [0108.588] lstrcmpiA (lpString1=".bmp", lpString2=".dll") returned -1 [0108.589] lstrlenA (lpString="2_zz.bmp") returned 8 [0108.589] lstrlenA (lpString=".ini") returned 4 [0108.589] lstrlenA (lpString=".ini") returned 4 [0108.589] lstrlenA (lpString="2_zz.bmp") returned 8 [0108.589] lstrcmpiA (lpString1=".bmp", lpString2=".ini") returned -1 [0108.589] lstrlenA (lpString="2_zz.bmp") returned 8 [0108.589] lstrlenA (lpString=".inc") returned 4 [0108.589] lstrlenA (lpString=".inc") returned 4 [0108.589] lstrlenA (lpString="2_zz.bmp") returned 8 [0108.589] lstrcmpiA (lpString1=".bmp", lpString2=".inc") returned -1 [0108.589] lstrcmpiW (lpString1="2_zz.bmp", lpString2="HOW_RECOVER.html") returned -1 [0108.589] lstrcmpiW (lpString1="2_zz.bmp", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0108.589] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0108.589] lstrcmpiW (lpString1="2_zz.bmp", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0108.589] GetProcessHeap () returned 0xd20000 [0108.589] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42828 [0108.589] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\2_zz.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\2_zz.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0108.590] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=40092) returned 1 [0108.590] GetProcessHeap () returned 0xd20000 [0108.590] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4be90 [0108.590] GetProcessHeap () returned 0xd20000 [0108.590] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0108.590] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\2_zz.bmp") returned 33 [0108.590] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0108.590] GetProcessHeap () returned 0xd20000 [0108.590] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0108.590] GetProcessHeap () returned 0xd20000 [0108.590] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x384) returned 0xd4f3b8 [0108.591] lstrlenA (lpString="rsa_encrypt") returned 11 [0108.591] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0108.593] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0108.593] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0108.593] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0108.593] GetProcessHeap () returned 0xd20000 [0108.593] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0108.593] lstrlenA (lpString="010001") returned 6 [0108.593] GetProcessHeap () returned 0xd20000 [0108.593] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd98 [0108.594] GetProcessHeap () returned 0xd20000 [0108.594] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0108.594] GetProcessHeap () returned 0xd20000 [0108.594] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b488 [0108.594] GetProcessHeap () returned 0xd20000 [0108.594] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0108.594] GetProcessHeap () returned 0xd20000 [0108.594] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ac18 [0108.594] GetProcessHeap () returned 0xd20000 [0108.594] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45410 [0108.594] GetProcessHeap () returned 0xd20000 [0108.594] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc18 [0108.594] GetProcessHeap () returned 0xd20000 [0108.594] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0108.594] GetProcessHeap () returned 0xd20000 [0108.594] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.594] GetProcessHeap () returned 0xd20000 [0108.594] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0108.594] GetProcessHeap () returned 0xd20000 [0108.595] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0108.595] GetProcessHeap () returned 0xd20000 [0108.595] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44fb0 [0108.595] GetProcessHeap () returned 0xd20000 [0108.595] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.595] GetProcessHeap () returned 0xd20000 [0108.595] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44570 [0108.595] GetProcessHeap () returned 0xd20000 [0108.595] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b7e8 [0108.595] GetProcessHeap () returned 0xd20000 [0108.595] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0108.595] GetProcessHeap () returned 0xd20000 [0108.595] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0108.595] GetProcessHeap () returned 0xd20000 [0108.595] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0108.595] GetProcessHeap () returned 0xd20000 [0108.595] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.595] GetProcessHeap () returned 0xd20000 [0108.595] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44510 [0108.595] GetProcessHeap () returned 0xd20000 [0108.595] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.596] GetProcessHeap () returned 0xd20000 [0108.596] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.596] GetProcessHeap () returned 0xd20000 [0108.596] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.596] GetProcessHeap () returned 0xd20000 [0108.596] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.596] GetProcessHeap () returned 0xd20000 [0108.596] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.596] GetProcessHeap () returned 0xd20000 [0108.596] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.596] GetProcessHeap () returned 0xd20000 [0108.596] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b878 [0108.596] GetProcessHeap () returned 0xd20000 [0108.596] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44510 | out: hHeap=0xd20000) returned 1 [0108.596] GetProcessHeap () returned 0xd20000 [0108.596] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0108.596] GetProcessHeap () returned 0xd20000 [0108.596] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b878 | out: hHeap=0xd20000) returned 1 [0108.596] GetProcessHeap () returned 0xd20000 [0108.596] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.597] GetProcessHeap () returned 0xd20000 [0108.597] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.597] GetProcessHeap () returned 0xd20000 [0108.597] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.597] GetProcessHeap () returned 0xd20000 [0108.597] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.597] GetProcessHeap () returned 0xd20000 [0108.597] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.597] GetProcessHeap () returned 0xd20000 [0108.597] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.597] GetProcessHeap () returned 0xd20000 [0108.597] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.597] GetProcessHeap () returned 0xd20000 [0108.597] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.597] GetProcessHeap () returned 0xd20000 [0108.597] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.597] GetProcessHeap () returned 0xd20000 [0108.597] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.597] GetProcessHeap () returned 0xd20000 [0108.597] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.598] GetProcessHeap () returned 0xd20000 [0108.598] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.598] GetProcessHeap () returned 0xd20000 [0108.598] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.598] GetProcessHeap () returned 0xd20000 [0108.598] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.598] GetProcessHeap () returned 0xd20000 [0108.598] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.598] GetProcessHeap () returned 0xd20000 [0108.598] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.598] GetProcessHeap () returned 0xd20000 [0108.598] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.598] GetProcessHeap () returned 0xd20000 [0108.598] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.598] GetProcessHeap () returned 0xd20000 [0108.598] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.598] GetProcessHeap () returned 0xd20000 [0108.598] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.598] GetProcessHeap () returned 0xd20000 [0108.598] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.599] GetProcessHeap () returned 0xd20000 [0108.599] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.599] GetProcessHeap () returned 0xd20000 [0108.599] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.599] GetProcessHeap () returned 0xd20000 [0108.599] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.599] GetProcessHeap () returned 0xd20000 [0108.599] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.599] GetProcessHeap () returned 0xd20000 [0108.599] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.599] GetProcessHeap () returned 0xd20000 [0108.599] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.599] GetProcessHeap () returned 0xd20000 [0108.599] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.599] GetProcessHeap () returned 0xd20000 [0108.599] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.599] GetProcessHeap () returned 0xd20000 [0108.599] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.599] GetProcessHeap () returned 0xd20000 [0108.599] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.600] GetProcessHeap () returned 0xd20000 [0108.600] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.600] GetProcessHeap () returned 0xd20000 [0108.600] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.600] GetProcessHeap () returned 0xd20000 [0108.600] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.600] GetProcessHeap () returned 0xd20000 [0108.600] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.600] GetProcessHeap () returned 0xd20000 [0108.600] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.600] GetProcessHeap () returned 0xd20000 [0108.600] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.600] GetProcessHeap () returned 0xd20000 [0108.600] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.600] GetProcessHeap () returned 0xd20000 [0108.600] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.600] GetProcessHeap () returned 0xd20000 [0108.600] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.600] GetProcessHeap () returned 0xd20000 [0108.600] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.601] GetProcessHeap () returned 0xd20000 [0108.601] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.601] GetProcessHeap () returned 0xd20000 [0108.601] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.601] GetProcessHeap () returned 0xd20000 [0108.601] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.601] GetProcessHeap () returned 0xd20000 [0108.601] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.601] GetProcessHeap () returned 0xd20000 [0108.601] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.601] GetProcessHeap () returned 0xd20000 [0108.601] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.601] GetProcessHeap () returned 0xd20000 [0108.601] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.601] GetProcessHeap () returned 0xd20000 [0108.601] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.601] GetProcessHeap () returned 0xd20000 [0108.601] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.601] GetProcessHeap () returned 0xd20000 [0108.601] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.601] GetProcessHeap () returned 0xd20000 [0108.602] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.602] GetProcessHeap () returned 0xd20000 [0108.602] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.602] GetProcessHeap () returned 0xd20000 [0108.602] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.602] GetProcessHeap () returned 0xd20000 [0108.602] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.602] GetProcessHeap () returned 0xd20000 [0108.603] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.603] GetProcessHeap () returned 0xd20000 [0108.603] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.603] GetProcessHeap () returned 0xd20000 [0108.603] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.603] GetProcessHeap () returned 0xd20000 [0108.603] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.603] GetProcessHeap () returned 0xd20000 [0108.603] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.603] GetProcessHeap () returned 0xd20000 [0108.603] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.603] GetProcessHeap () returned 0xd20000 [0108.603] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.603] GetProcessHeap () returned 0xd20000 [0108.603] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.603] GetProcessHeap () returned 0xd20000 [0108.603] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.603] GetProcessHeap () returned 0xd20000 [0108.603] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.604] GetProcessHeap () returned 0xd20000 [0108.604] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.604] GetProcessHeap () returned 0xd20000 [0108.604] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.604] GetProcessHeap () returned 0xd20000 [0108.604] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.604] GetProcessHeap () returned 0xd20000 [0108.604] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.604] GetProcessHeap () returned 0xd20000 [0108.604] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.604] GetProcessHeap () returned 0xd20000 [0108.604] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.604] GetProcessHeap () returned 0xd20000 [0108.604] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.604] GetProcessHeap () returned 0xd20000 [0108.604] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.604] GetProcessHeap () returned 0xd20000 [0108.604] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.604] GetProcessHeap () returned 0xd20000 [0108.604] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.604] GetProcessHeap () returned 0xd20000 [0108.605] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.605] GetProcessHeap () returned 0xd20000 [0108.605] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.605] GetProcessHeap () returned 0xd20000 [0108.605] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.605] GetProcessHeap () returned 0xd20000 [0108.605] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.605] GetProcessHeap () returned 0xd20000 [0108.605] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.605] GetProcessHeap () returned 0xd20000 [0108.605] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.605] GetProcessHeap () returned 0xd20000 [0108.605] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.605] GetProcessHeap () returned 0xd20000 [0108.605] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.605] GetProcessHeap () returned 0xd20000 [0108.605] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.605] GetProcessHeap () returned 0xd20000 [0108.605] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.605] GetProcessHeap () returned 0xd20000 [0108.605] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.606] GetProcessHeap () returned 0xd20000 [0108.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.606] GetProcessHeap () returned 0xd20000 [0108.606] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.606] GetProcessHeap () returned 0xd20000 [0108.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.606] GetProcessHeap () returned 0xd20000 [0108.606] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.606] GetProcessHeap () returned 0xd20000 [0108.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.606] GetProcessHeap () returned 0xd20000 [0108.606] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.606] GetProcessHeap () returned 0xd20000 [0108.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.606] GetProcessHeap () returned 0xd20000 [0108.606] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.606] GetProcessHeap () returned 0xd20000 [0108.606] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.606] GetProcessHeap () returned 0xd20000 [0108.606] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.607] GetProcessHeap () returned 0xd20000 [0108.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.607] GetProcessHeap () returned 0xd20000 [0108.607] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.607] GetProcessHeap () returned 0xd20000 [0108.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.607] GetProcessHeap () returned 0xd20000 [0108.607] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.607] GetProcessHeap () returned 0xd20000 [0108.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.607] GetProcessHeap () returned 0xd20000 [0108.607] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.607] GetProcessHeap () returned 0xd20000 [0108.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.607] GetProcessHeap () returned 0xd20000 [0108.607] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.607] GetProcessHeap () returned 0xd20000 [0108.607] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.607] GetProcessHeap () returned 0xd20000 [0108.608] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.608] GetProcessHeap () returned 0xd20000 [0108.608] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.608] GetProcessHeap () returned 0xd20000 [0108.608] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.608] GetProcessHeap () returned 0xd20000 [0108.608] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.608] GetProcessHeap () returned 0xd20000 [0108.608] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.608] GetProcessHeap () returned 0xd20000 [0108.608] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.608] GetProcessHeap () returned 0xd20000 [0108.608] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.608] GetProcessHeap () returned 0xd20000 [0108.608] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.608] GetProcessHeap () returned 0xd20000 [0108.608] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.608] GetProcessHeap () returned 0xd20000 [0108.608] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.608] GetProcessHeap () returned 0xd20000 [0108.608] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.609] GetProcessHeap () returned 0xd20000 [0108.609] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.609] GetProcessHeap () returned 0xd20000 [0108.609] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.609] GetProcessHeap () returned 0xd20000 [0108.609] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.609] GetProcessHeap () returned 0xd20000 [0108.609] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.609] GetProcessHeap () returned 0xd20000 [0108.609] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.609] GetProcessHeap () returned 0xd20000 [0108.609] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.609] GetProcessHeap () returned 0xd20000 [0108.609] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.609] GetProcessHeap () returned 0xd20000 [0108.609] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.609] GetProcessHeap () returned 0xd20000 [0108.609] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.609] GetProcessHeap () returned 0xd20000 [0108.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.610] GetProcessHeap () returned 0xd20000 [0108.610] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.610] GetProcessHeap () returned 0xd20000 [0108.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.610] GetProcessHeap () returned 0xd20000 [0108.610] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.610] GetProcessHeap () returned 0xd20000 [0108.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.610] GetProcessHeap () returned 0xd20000 [0108.610] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.610] GetProcessHeap () returned 0xd20000 [0108.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.610] GetProcessHeap () returned 0xd20000 [0108.610] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.610] GetProcessHeap () returned 0xd20000 [0108.610] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.610] GetProcessHeap () returned 0xd20000 [0108.610] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.610] GetProcessHeap () returned 0xd20000 [0108.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.611] GetProcessHeap () returned 0xd20000 [0108.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.611] GetProcessHeap () returned 0xd20000 [0108.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.611] GetProcessHeap () returned 0xd20000 [0108.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.611] GetProcessHeap () returned 0xd20000 [0108.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.611] GetProcessHeap () returned 0xd20000 [0108.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.611] GetProcessHeap () returned 0xd20000 [0108.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.611] GetProcessHeap () returned 0xd20000 [0108.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.611] GetProcessHeap () returned 0xd20000 [0108.611] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.611] GetProcessHeap () returned 0xd20000 [0108.611] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.612] GetProcessHeap () returned 0xd20000 [0108.612] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.612] GetProcessHeap () returned 0xd20000 [0108.612] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.612] GetProcessHeap () returned 0xd20000 [0108.612] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.612] GetProcessHeap () returned 0xd20000 [0108.612] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.612] GetProcessHeap () returned 0xd20000 [0108.612] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.612] GetProcessHeap () returned 0xd20000 [0108.612] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.612] GetProcessHeap () returned 0xd20000 [0108.612] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.612] GetProcessHeap () returned 0xd20000 [0108.612] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.612] GetProcessHeap () returned 0xd20000 [0108.612] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.612] GetProcessHeap () returned 0xd20000 [0108.612] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.613] GetProcessHeap () returned 0xd20000 [0108.613] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.613] GetProcessHeap () returned 0xd20000 [0108.613] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.613] GetProcessHeap () returned 0xd20000 [0108.613] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.613] GetProcessHeap () returned 0xd20000 [0108.613] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.613] GetProcessHeap () returned 0xd20000 [0108.613] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.613] GetProcessHeap () returned 0xd20000 [0108.613] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.613] GetProcessHeap () returned 0xd20000 [0108.613] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.613] GetProcessHeap () returned 0xd20000 [0108.613] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.613] GetProcessHeap () returned 0xd20000 [0108.613] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.613] GetProcessHeap () returned 0xd20000 [0108.613] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.614] GetProcessHeap () returned 0xd20000 [0108.614] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.614] GetProcessHeap () returned 0xd20000 [0108.614] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.614] GetProcessHeap () returned 0xd20000 [0108.614] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.614] GetProcessHeap () returned 0xd20000 [0108.614] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.614] GetProcessHeap () returned 0xd20000 [0108.614] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.614] GetProcessHeap () returned 0xd20000 [0108.614] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0108.614] GetProcessHeap () returned 0xd20000 [0108.614] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0108.614] GetProcessHeap () returned 0xd20000 [0108.614] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0108.614] GetProcessHeap () returned 0xd20000 [0108.614] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0108.614] GetProcessHeap () returned 0xd20000 [0108.614] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44570 | out: hHeap=0xd20000) returned 1 [0108.615] GetProcessHeap () returned 0xd20000 [0108.615] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ac18 | out: hHeap=0xd20000) returned 1 [0108.615] GetProcessHeap () returned 0xd20000 [0108.615] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0108.615] GetProcessHeap () returned 0xd20000 [0108.615] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b488 | out: hHeap=0xd20000) returned 1 [0108.615] GetProcessHeap () returned 0xd20000 [0108.615] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0108.615] GetProcessHeap () returned 0xd20000 [0108.615] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.615] GetProcessHeap () returned 0xd20000 [0108.615] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0108.615] WriteFile (in: hFile=0x230, lpBuffer=0xd4f3b8*, nNumberOfBytesToWrite=0x384, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f3b8*, lpNumberOfBytesWritten=0x299d864*=0x384, lpOverlapped=0x0) returned 1 [0108.619] GetProcessHeap () returned 0xd20000 [0108.619] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4f3b8, Size=0x30) returned 0xd4f3b8 [0108.619] GetProcessHeap () returned 0xd20000 [0108.619] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0108.620] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0108.620] GetProcessHeap () returned 0xd20000 [0108.620] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x9ca0) returned 0xd4f3f0 [0108.621] ReadFile (in: hFile=0x230, lpBuffer=0xd4f3f0, nNumberOfBytesToRead=0x9ca0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4f3f0*, lpNumberOfBytesRead=0x299d7e8*=0x9ca0, lpOverlapped=0x0) returned 1 [0108.622] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0108.622] WriteFile (in: hFile=0x230, lpBuffer=0xd4f3f0*, nNumberOfBytesToWrite=0x9ca0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4f3f0*, lpNumberOfBytesWritten=0x299d7e4*=0x9ca0, lpOverlapped=0x0) returned 1 [0108.624] GetProcessHeap () returned 0xd20000 [0108.624] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4f3f0 | out: hHeap=0xd20000) returned 1 [0108.624] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0108.624] WriteFile (in: hFile=0x230, lpBuffer=0xd4f3b8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f3b8*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0108.626] CloseHandle (hObject=0x230) returned 1 [0108.635] GetProcessHeap () returned 0xd20000 [0108.635] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42828 | out: hHeap=0xd20000) returned 1 [0108.635] GetProcessHeap () returned 0xd20000 [0108.635] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4be90 | out: hHeap=0xd20000) returned 1 [0108.635] GetProcessHeap () returned 0xd20000 [0108.635] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0108.635] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\2_zz.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\2_zz.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\2_zz.bmp" [0108.635] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\2_zz.bmp", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\2_zz.bmp.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Pictures\\2_zz.bmp.[ponce.lorena@aol.com]" [0108.635] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\2_zz.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\2_zz.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\2_zz.bmp.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\pictures\\2_zz.bmp.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0108.636] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\2_zz.bmp" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0108.636] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0108.636] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html" [0108.636] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_recover.html")) returned 0x20 [0108.636] GetProcessHeap () returned 0xd20000 [0108.636] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446c0 | out: hHeap=0xd20000) returned 1 [0108.636] FindNextFileW (in: hFindFile=0xd49120, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabf58ef0, ftCreationTime.dwHighDateTime=0x1d4d56f, ftLastAccessTime.dwLowDateTime=0xa07ae2e0, ftLastAccessTime.dwHighDateTime=0x1d4c648, ftLastWriteTime.dwLowDateTime=0xa07ae2e0, ftLastWriteTime.dwHighDateTime=0x1d4c648, nFileSizeHigh=0x0, nFileSizeLow=0x5ced, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="53jgL9AguLPJoi0V.bmp", cAlternateFileName="53JGL9~1.BMP")) returned 1 [0108.636] lstrcmpiW (lpString1="53jgL9AguLPJoi0V.bmp", lpString2=".") returned 1 [0108.636] lstrcmpiW (lpString1="53jgL9AguLPJoi0V.bmp", lpString2="..") returned 1 [0108.636] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="53jgL9AguLPJoi0V.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\53jgL9AguLPJoi0V.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\53jgL9AguLPJoi0V.bmp" [0108.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="53jgL9AguLPJoi0V.bmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0108.636] GetProcessHeap () returned 0xd20000 [0108.636] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x15) returned 0xd36568 [0108.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="53jgL9AguLPJoi0V.bmp", cchWideChar=-1, lpMultiByteStr=0xd36568, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="53jgL9AguLPJoi0V.bmp", lpUsedDefaultChar=0x0) returned 21 [0108.637] lstrlenA (lpString="53jgL9AguLPJoi0V.bmp") returned 20 [0108.637] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0108.637] lstrlenA (lpString="53jgL9AguLPJoi0V.bmp") returned 20 [0108.637] lstrlenA (lpString=".dll") returned 4 [0108.637] lstrlenA (lpString=".dll") returned 4 [0108.637] lstrlenA (lpString="53jgL9AguLPJoi0V.bmp") returned 20 [0108.637] lstrcmpiA (lpString1=".bmp", lpString2=".dll") returned -1 [0108.637] lstrlenA (lpString="53jgL9AguLPJoi0V.bmp") returned 20 [0108.637] lstrlenA (lpString=".ini") returned 4 [0108.637] lstrlenA (lpString=".ini") returned 4 [0108.637] lstrlenA (lpString="53jgL9AguLPJoi0V.bmp") returned 20 [0108.637] lstrcmpiA (lpString1=".bmp", lpString2=".ini") returned -1 [0108.637] lstrlenA (lpString="53jgL9AguLPJoi0V.bmp") returned 20 [0108.637] lstrlenA (lpString=".inc") returned 4 [0108.637] lstrlenA (lpString=".inc") returned 4 [0108.637] lstrlenA (lpString="53jgL9AguLPJoi0V.bmp") returned 20 [0108.637] lstrcmpiA (lpString1=".bmp", lpString2=".inc") returned -1 [0108.637] lstrcmpiW (lpString1="53jgL9AguLPJoi0V.bmp", lpString2="HOW_RECOVER.html") returned -1 [0108.637] lstrcmpiW (lpString1="53jgL9AguLPJoi0V.bmp", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0108.637] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0108.638] lstrcmpiW (lpString1="53jgL9AguLPJoi0V.bmp", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0108.638] GetProcessHeap () returned 0xd20000 [0108.638] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42418 [0108.638] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\53jgL9AguLPJoi0V.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\53jgl9agulpjoi0v.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0108.638] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=23789) returned 1 [0108.638] GetProcessHeap () returned 0xd20000 [0108.638] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4be90 [0108.638] GetProcessHeap () returned 0xd20000 [0108.638] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0108.638] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\53jgL9AguLPJoi0V.bmp") returned 45 [0108.638] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0108.638] GetProcessHeap () returned 0xd20000 [0108.638] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0108.638] GetProcessHeap () returned 0xd20000 [0108.638] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x383) returned 0xd4f3f0 [0108.639] lstrlenA (lpString="rsa_encrypt") returned 11 [0108.639] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0108.641] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0108.641] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0108.641] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0108.641] GetProcessHeap () returned 0xd20000 [0108.641] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0108.641] lstrlenA (lpString="010001") returned 6 [0108.641] GetProcessHeap () returned 0xd20000 [0108.641] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc48 [0108.641] GetProcessHeap () returned 0xd20000 [0108.641] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0108.641] GetProcessHeap () returned 0xd20000 [0108.641] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aca8 [0108.641] GetProcessHeap () returned 0xd20000 [0108.641] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0108.641] GetProcessHeap () returned 0xd20000 [0108.641] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0108.641] GetProcessHeap () returned 0xd20000 [0108.642] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44920 [0108.642] GetProcessHeap () returned 0xd20000 [0108.642] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc58 [0108.642] GetProcessHeap () returned 0xd20000 [0108.642] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0108.642] GetProcessHeap () returned 0xd20000 [0108.642] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.642] GetProcessHeap () returned 0xd20000 [0108.642] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0108.642] GetProcessHeap () returned 0xd20000 [0108.642] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0108.642] GetProcessHeap () returned 0xd20000 [0108.642] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd450c8 [0108.642] GetProcessHeap () returned 0xd20000 [0108.642] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.642] GetProcessHeap () returned 0xd20000 [0108.642] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44558 [0108.642] GetProcessHeap () returned 0xd20000 [0108.642] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b1b8 [0108.642] GetProcessHeap () returned 0xd20000 [0108.642] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0108.642] GetProcessHeap () returned 0xd20000 [0108.642] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0108.642] GetProcessHeap () returned 0xd20000 [0108.643] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b1b8 | out: hHeap=0xd20000) returned 1 [0108.643] GetProcessHeap () returned 0xd20000 [0108.643] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.643] GetProcessHeap () returned 0xd20000 [0108.643] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44690 [0108.643] GetProcessHeap () returned 0xd20000 [0108.643] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.643] GetProcessHeap () returned 0xd20000 [0108.643] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.643] GetProcessHeap () returned 0xd20000 [0108.643] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.643] GetProcessHeap () returned 0xd20000 [0108.643] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.643] GetProcessHeap () returned 0xd20000 [0108.643] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.643] GetProcessHeap () returned 0xd20000 [0108.643] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.643] GetProcessHeap () returned 0xd20000 [0108.643] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4a9d8 [0108.643] GetProcessHeap () returned 0xd20000 [0108.644] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44690 | out: hHeap=0xd20000) returned 1 [0108.644] GetProcessHeap () returned 0xd20000 [0108.644] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0108.644] GetProcessHeap () returned 0xd20000 [0108.644] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a9d8 | out: hHeap=0xd20000) returned 1 [0108.644] GetProcessHeap () returned 0xd20000 [0108.644] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.644] GetProcessHeap () returned 0xd20000 [0108.644] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.644] GetProcessHeap () returned 0xd20000 [0108.644] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.644] GetProcessHeap () returned 0xd20000 [0108.644] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.644] GetProcessHeap () returned 0xd20000 [0108.644] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.644] GetProcessHeap () returned 0xd20000 [0108.644] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.644] GetProcessHeap () returned 0xd20000 [0108.644] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.645] GetProcessHeap () returned 0xd20000 [0108.645] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.645] GetProcessHeap () returned 0xd20000 [0108.645] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.645] GetProcessHeap () returned 0xd20000 [0108.645] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.645] GetProcessHeap () returned 0xd20000 [0108.645] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.645] GetProcessHeap () returned 0xd20000 [0108.645] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.645] GetProcessHeap () returned 0xd20000 [0108.645] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.645] GetProcessHeap () returned 0xd20000 [0108.645] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.645] GetProcessHeap () returned 0xd20000 [0108.645] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.645] GetProcessHeap () returned 0xd20000 [0108.645] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.645] GetProcessHeap () returned 0xd20000 [0108.645] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.646] GetProcessHeap () returned 0xd20000 [0108.646] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.646] GetProcessHeap () returned 0xd20000 [0108.646] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.646] GetProcessHeap () returned 0xd20000 [0108.646] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.646] GetProcessHeap () returned 0xd20000 [0108.646] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.646] GetProcessHeap () returned 0xd20000 [0108.646] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.646] GetProcessHeap () returned 0xd20000 [0108.646] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.646] GetProcessHeap () returned 0xd20000 [0108.646] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.646] GetProcessHeap () returned 0xd20000 [0108.646] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.646] GetProcessHeap () returned 0xd20000 [0108.646] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.647] GetProcessHeap () returned 0xd20000 [0108.647] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.647] GetProcessHeap () returned 0xd20000 [0108.647] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.647] GetProcessHeap () returned 0xd20000 [0108.647] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.647] GetProcessHeap () returned 0xd20000 [0108.647] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.647] GetProcessHeap () returned 0xd20000 [0108.647] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.647] GetProcessHeap () returned 0xd20000 [0108.647] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.647] GetProcessHeap () returned 0xd20000 [0108.647] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.647] GetProcessHeap () returned 0xd20000 [0108.647] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.647] GetProcessHeap () returned 0xd20000 [0108.647] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.647] GetProcessHeap () returned 0xd20000 [0108.647] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.648] GetProcessHeap () returned 0xd20000 [0108.648] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.648] GetProcessHeap () returned 0xd20000 [0108.648] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.648] GetProcessHeap () returned 0xd20000 [0108.648] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.648] GetProcessHeap () returned 0xd20000 [0108.648] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.648] GetProcessHeap () returned 0xd20000 [0108.648] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.648] GetProcessHeap () returned 0xd20000 [0108.648] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.648] GetProcessHeap () returned 0xd20000 [0108.648] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.648] GetProcessHeap () returned 0xd20000 [0108.648] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.649] GetProcessHeap () returned 0xd20000 [0108.649] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.649] GetProcessHeap () returned 0xd20000 [0108.649] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.649] GetProcessHeap () returned 0xd20000 [0108.649] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.649] GetProcessHeap () returned 0xd20000 [0108.649] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.649] GetProcessHeap () returned 0xd20000 [0108.649] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.649] GetProcessHeap () returned 0xd20000 [0108.649] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.649] GetProcessHeap () returned 0xd20000 [0108.650] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.650] GetProcessHeap () returned 0xd20000 [0108.650] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.650] GetProcessHeap () returned 0xd20000 [0108.650] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.650] GetProcessHeap () returned 0xd20000 [0108.650] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.650] GetProcessHeap () returned 0xd20000 [0108.650] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.650] GetProcessHeap () returned 0xd20000 [0108.650] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.650] GetProcessHeap () returned 0xd20000 [0108.650] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.650] GetProcessHeap () returned 0xd20000 [0108.650] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.650] GetProcessHeap () returned 0xd20000 [0108.650] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.650] GetProcessHeap () returned 0xd20000 [0108.650] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.651] GetProcessHeap () returned 0xd20000 [0108.651] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.651] GetProcessHeap () returned 0xd20000 [0108.651] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.651] GetProcessHeap () returned 0xd20000 [0108.651] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.651] GetProcessHeap () returned 0xd20000 [0108.651] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.651] GetProcessHeap () returned 0xd20000 [0108.651] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.651] GetProcessHeap () returned 0xd20000 [0108.651] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.651] GetProcessHeap () returned 0xd20000 [0108.651] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.651] GetProcessHeap () returned 0xd20000 [0108.651] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.651] GetProcessHeap () returned 0xd20000 [0108.651] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.652] GetProcessHeap () returned 0xd20000 [0108.652] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.652] GetProcessHeap () returned 0xd20000 [0108.652] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.652] GetProcessHeap () returned 0xd20000 [0108.652] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.652] GetProcessHeap () returned 0xd20000 [0108.652] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.652] GetProcessHeap () returned 0xd20000 [0108.652] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.652] GetProcessHeap () returned 0xd20000 [0108.652] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.652] GetProcessHeap () returned 0xd20000 [0108.652] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.652] GetProcessHeap () returned 0xd20000 [0108.652] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.652] GetProcessHeap () returned 0xd20000 [0108.652] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.653] GetProcessHeap () returned 0xd20000 [0108.653] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.653] GetProcessHeap () returned 0xd20000 [0108.653] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.653] GetProcessHeap () returned 0xd20000 [0108.653] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.653] GetProcessHeap () returned 0xd20000 [0108.653] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.653] GetProcessHeap () returned 0xd20000 [0108.653] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.653] GetProcessHeap () returned 0xd20000 [0108.653] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.653] GetProcessHeap () returned 0xd20000 [0108.653] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.653] GetProcessHeap () returned 0xd20000 [0108.653] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.653] GetProcessHeap () returned 0xd20000 [0108.653] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.653] GetProcessHeap () returned 0xd20000 [0108.654] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.654] GetProcessHeap () returned 0xd20000 [0108.654] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.654] GetProcessHeap () returned 0xd20000 [0108.654] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.654] GetProcessHeap () returned 0xd20000 [0108.654] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.654] GetProcessHeap () returned 0xd20000 [0108.654] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.654] GetProcessHeap () returned 0xd20000 [0108.654] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.654] GetProcessHeap () returned 0xd20000 [0108.654] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.654] GetProcessHeap () returned 0xd20000 [0108.654] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.654] GetProcessHeap () returned 0xd20000 [0108.654] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.654] GetProcessHeap () returned 0xd20000 [0108.654] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.654] GetProcessHeap () returned 0xd20000 [0108.655] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.655] GetProcessHeap () returned 0xd20000 [0108.655] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.655] GetProcessHeap () returned 0xd20000 [0108.655] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.655] GetProcessHeap () returned 0xd20000 [0108.655] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.655] GetProcessHeap () returned 0xd20000 [0108.655] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.655] GetProcessHeap () returned 0xd20000 [0108.655] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.655] GetProcessHeap () returned 0xd20000 [0108.655] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.655] GetProcessHeap () returned 0xd20000 [0108.655] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.655] GetProcessHeap () returned 0xd20000 [0108.655] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.656] GetProcessHeap () returned 0xd20000 [0108.656] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.656] GetProcessHeap () returned 0xd20000 [0108.656] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.656] GetProcessHeap () returned 0xd20000 [0108.656] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.656] GetProcessHeap () returned 0xd20000 [0108.656] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.656] GetProcessHeap () returned 0xd20000 [0108.656] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.656] GetProcessHeap () returned 0xd20000 [0108.656] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.656] GetProcessHeap () returned 0xd20000 [0108.656] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.656] GetProcessHeap () returned 0xd20000 [0108.656] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.656] GetProcessHeap () returned 0xd20000 [0108.656] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.656] GetProcessHeap () returned 0xd20000 [0108.656] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.657] GetProcessHeap () returned 0xd20000 [0108.657] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.657] GetProcessHeap () returned 0xd20000 [0108.657] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.657] GetProcessHeap () returned 0xd20000 [0108.657] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.657] GetProcessHeap () returned 0xd20000 [0108.657] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.657] GetProcessHeap () returned 0xd20000 [0108.657] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.657] GetProcessHeap () returned 0xd20000 [0108.657] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.657] GetProcessHeap () returned 0xd20000 [0108.657] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.657] GetProcessHeap () returned 0xd20000 [0108.657] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.657] GetProcessHeap () returned 0xd20000 [0108.657] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.657] GetProcessHeap () returned 0xd20000 [0108.658] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.658] GetProcessHeap () returned 0xd20000 [0108.658] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.658] GetProcessHeap () returned 0xd20000 [0108.658] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.658] GetProcessHeap () returned 0xd20000 [0108.658] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.658] GetProcessHeap () returned 0xd20000 [0108.658] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.658] GetProcessHeap () returned 0xd20000 [0108.658] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.658] GetProcessHeap () returned 0xd20000 [0108.658] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.658] GetProcessHeap () returned 0xd20000 [0108.658] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.658] GetProcessHeap () returned 0xd20000 [0108.658] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.658] GetProcessHeap () returned 0xd20000 [0108.658] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.658] GetProcessHeap () returned 0xd20000 [0108.659] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.659] GetProcessHeap () returned 0xd20000 [0108.659] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.659] GetProcessHeap () returned 0xd20000 [0108.659] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.659] GetProcessHeap () returned 0xd20000 [0108.659] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.659] GetProcessHeap () returned 0xd20000 [0108.659] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.659] GetProcessHeap () returned 0xd20000 [0108.659] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.659] GetProcessHeap () returned 0xd20000 [0108.659] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.659] GetProcessHeap () returned 0xd20000 [0108.659] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.659] GetProcessHeap () returned 0xd20000 [0108.659] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.659] GetProcessHeap () returned 0xd20000 [0108.659] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.660] GetProcessHeap () returned 0xd20000 [0108.660] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.660] GetProcessHeap () returned 0xd20000 [0108.660] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.660] GetProcessHeap () returned 0xd20000 [0108.660] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.660] GetProcessHeap () returned 0xd20000 [0108.660] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.660] GetProcessHeap () returned 0xd20000 [0108.660] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.660] GetProcessHeap () returned 0xd20000 [0108.660] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.660] GetProcessHeap () returned 0xd20000 [0108.660] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.660] GetProcessHeap () returned 0xd20000 [0108.660] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.660] GetProcessHeap () returned 0xd20000 [0108.660] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.660] GetProcessHeap () returned 0xd20000 [0108.661] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.661] GetProcessHeap () returned 0xd20000 [0108.661] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.661] GetProcessHeap () returned 0xd20000 [0108.661] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.661] GetProcessHeap () returned 0xd20000 [0108.661] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.661] GetProcessHeap () returned 0xd20000 [0108.661] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.661] GetProcessHeap () returned 0xd20000 [0108.661] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.661] GetProcessHeap () returned 0xd20000 [0108.661] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.661] GetProcessHeap () returned 0xd20000 [0108.661] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.661] GetProcessHeap () returned 0xd20000 [0108.661] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.661] GetProcessHeap () returned 0xd20000 [0108.661] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.661] GetProcessHeap () returned 0xd20000 [0108.662] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.662] GetProcessHeap () returned 0xd20000 [0108.662] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.662] GetProcessHeap () returned 0xd20000 [0108.662] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.662] GetProcessHeap () returned 0xd20000 [0108.662] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.662] GetProcessHeap () returned 0xd20000 [0108.662] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.662] GetProcessHeap () returned 0xd20000 [0108.662] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.662] GetProcessHeap () returned 0xd20000 [0108.662] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0108.662] GetProcessHeap () returned 0xd20000 [0108.662] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0108.662] GetProcessHeap () returned 0xd20000 [0108.662] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0108.662] GetProcessHeap () returned 0xd20000 [0108.662] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0108.662] GetProcessHeap () returned 0xd20000 [0108.663] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44558 | out: hHeap=0xd20000) returned 1 [0108.663] GetProcessHeap () returned 0xd20000 [0108.663] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0108.663] GetProcessHeap () returned 0xd20000 [0108.663] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0108.663] GetProcessHeap () returned 0xd20000 [0108.663] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aca8 | out: hHeap=0xd20000) returned 1 [0108.663] GetProcessHeap () returned 0xd20000 [0108.663] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0108.663] GetProcessHeap () returned 0xd20000 [0108.663] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.663] GetProcessHeap () returned 0xd20000 [0108.663] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0108.663] WriteFile (in: hFile=0x230, lpBuffer=0xd4f3f0*, nNumberOfBytesToWrite=0x383, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f3f0*, lpNumberOfBytesWritten=0x299d864*=0x383, lpOverlapped=0x0) returned 1 [0108.667] GetProcessHeap () returned 0xd20000 [0108.667] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4f3f0, Size=0x30) returned 0xd4f3f0 [0108.667] GetProcessHeap () returned 0xd20000 [0108.667] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0108.667] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0108.668] GetProcessHeap () returned 0xd20000 [0108.668] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x5cf0) returned 0xd4f428 [0108.668] ReadFile (in: hFile=0x230, lpBuffer=0xd4f428, nNumberOfBytesToRead=0x5cf0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4f428*, lpNumberOfBytesRead=0x299d7e8*=0x5cf0, lpOverlapped=0x0) returned 1 [0108.668] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0108.668] WriteFile (in: hFile=0x230, lpBuffer=0xd4f428*, nNumberOfBytesToWrite=0x5cf0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4f428*, lpNumberOfBytesWritten=0x299d7e4*=0x5cf0, lpOverlapped=0x0) returned 1 [0108.670] GetProcessHeap () returned 0xd20000 [0108.670] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4f428 | out: hHeap=0xd20000) returned 1 [0108.671] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0108.671] WriteFile (in: hFile=0x230, lpBuffer=0xd4f3f0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f3f0*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0108.673] CloseHandle (hObject=0x230) returned 1 [0108.678] GetProcessHeap () returned 0xd20000 [0108.678] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42418 | out: hHeap=0xd20000) returned 1 [0108.678] GetProcessHeap () returned 0xd20000 [0108.678] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4be90 | out: hHeap=0xd20000) returned 1 [0108.678] GetProcessHeap () returned 0xd20000 [0108.678] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0108.678] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\53jgL9AguLPJoi0V.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\53jgL9AguLPJoi0V.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\53jgL9AguLPJoi0V.bmp" [0108.678] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\53jgL9AguLPJoi0V.bmp", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\53jgL9AguLPJoi0V.bmp.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Pictures\\53jgL9AguLPJoi0V.bmp.[ponce.lorena@aol.com]" [0108.678] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\53jgL9AguLPJoi0V.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\53jgl9agulpjoi0v.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\53jgL9AguLPJoi0V.bmp.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\pictures\\53jgl9agulpjoi0v.bmp.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0108.679] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\53jgL9AguLPJoi0V.bmp" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0108.679] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0108.679] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html" [0108.679] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_recover.html")) returned 0x20 [0108.679] GetProcessHeap () returned 0xd20000 [0108.679] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36568 | out: hHeap=0xd20000) returned 1 [0108.680] FindNextFileW (in: hFindFile=0xd49120, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60a0a8b0, ftCreationTime.dwHighDateTime=0x1d4c780, ftLastAccessTime.dwLowDateTime=0x5b0e3f40, ftLastAccessTime.dwHighDateTime=0x1d4cc74, ftLastWriteTime.dwLowDateTime=0x5b0e3f40, ftLastWriteTime.dwHighDateTime=0x1d4cc74, nFileSizeHigh=0x0, nFileSizeLow=0x4ac7, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5H22wIEHFFA.gif", cAlternateFileName="5H22WI~1.GIF")) returned 1 [0108.680] lstrcmpiW (lpString1="5H22wIEHFFA.gif", lpString2=".") returned 1 [0108.680] lstrcmpiW (lpString1="5H22wIEHFFA.gif", lpString2="..") returned 1 [0108.680] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="5H22wIEHFFA.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\5H22wIEHFFA.gif") returned="C:\\Users\\FD1HVy\\Pictures\\5H22wIEHFFA.gif" [0108.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="5H22wIEHFFA.gif", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0108.680] GetProcessHeap () returned 0xd20000 [0108.680] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x10) returned 0xd446c0 [0108.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="5H22wIEHFFA.gif", cchWideChar=-1, lpMultiByteStr=0xd446c0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5H22wIEHFFA.gif", lpUsedDefaultChar=0x0) returned 16 [0108.680] lstrlenA (lpString="5H22wIEHFFA.gif") returned 15 [0108.680] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0108.680] lstrlenA (lpString="5H22wIEHFFA.gif") returned 15 [0108.681] lstrlenA (lpString=".dll") returned 4 [0108.681] lstrlenA (lpString=".dll") returned 4 [0108.681] lstrlenA (lpString="5H22wIEHFFA.gif") returned 15 [0108.681] lstrcmpiA (lpString1=".gif", lpString2=".dll") returned 1 [0108.681] lstrlenA (lpString="5H22wIEHFFA.gif") returned 15 [0108.681] lstrlenA (lpString=".ini") returned 4 [0108.681] lstrlenA (lpString=".ini") returned 4 [0108.681] lstrlenA (lpString="5H22wIEHFFA.gif") returned 15 [0108.681] lstrcmpiA (lpString1=".gif", lpString2=".ini") returned -1 [0108.681] lstrlenA (lpString="5H22wIEHFFA.gif") returned 15 [0108.681] lstrlenA (lpString=".inc") returned 4 [0108.681] lstrlenA (lpString=".inc") returned 4 [0108.681] lstrlenA (lpString="5H22wIEHFFA.gif") returned 15 [0108.681] lstrcmpiA (lpString1=".gif", lpString2=".inc") returned -1 [0108.681] lstrcmpiW (lpString1="5H22wIEHFFA.gif", lpString2="HOW_RECOVER.html") returned -1 [0108.681] lstrcmpiW (lpString1="5H22wIEHFFA.gif", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0108.681] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0108.681] lstrcmpiW (lpString1="5H22wIEHFFA.gif", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0108.681] GetProcessHeap () returned 0xd20000 [0108.682] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42828 [0108.682] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5H22wIEHFFA.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\5h22wiehffa.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0108.682] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=19143) returned 1 [0108.682] GetProcessHeap () returned 0xd20000 [0108.682] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bf80 [0108.682] GetProcessHeap () returned 0xd20000 [0108.682] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0108.682] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\5H22wIEHFFA.gif") returned 40 [0108.682] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0108.682] GetProcessHeap () returned 0xd20000 [0108.682] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0108.683] GetProcessHeap () returned 0xd20000 [0108.683] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x389) returned 0xd4f428 [0108.683] lstrlenA (lpString="rsa_encrypt") returned 11 [0108.683] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0108.685] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0108.685] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0108.685] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0108.685] GetProcessHeap () returned 0xd20000 [0108.685] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0108.685] lstrlenA (lpString="010001") returned 6 [0108.685] GetProcessHeap () returned 0xd20000 [0108.685] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc18 [0108.686] GetProcessHeap () returned 0xd20000 [0108.686] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0108.686] GetProcessHeap () returned 0xd20000 [0108.686] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4a948 [0108.686] GetProcessHeap () returned 0xd20000 [0108.686] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0108.686] GetProcessHeap () returned 0xd20000 [0108.686] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4af78 [0108.686] GetProcessHeap () returned 0xd20000 [0108.686] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44a38 [0108.686] GetProcessHeap () returned 0xd20000 [0108.686] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc48 [0108.686] GetProcessHeap () returned 0xd20000 [0108.686] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0108.686] GetProcessHeap () returned 0xd20000 [0108.686] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.686] GetProcessHeap () returned 0xd20000 [0108.686] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0108.686] GetProcessHeap () returned 0xd20000 [0108.686] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0108.686] GetProcessHeap () returned 0xd20000 [0108.687] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44d80 [0108.687] GetProcessHeap () returned 0xd20000 [0108.687] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.687] GetProcessHeap () returned 0xd20000 [0108.687] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44438 [0108.687] GetProcessHeap () returned 0xd20000 [0108.687] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aee8 [0108.687] GetProcessHeap () returned 0xd20000 [0108.687] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0108.687] GetProcessHeap () returned 0xd20000 [0108.687] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0108.687] GetProcessHeap () returned 0xd20000 [0108.687] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aee8 | out: hHeap=0xd20000) returned 1 [0108.687] GetProcessHeap () returned 0xd20000 [0108.687] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.687] GetProcessHeap () returned 0xd20000 [0108.687] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44588 [0108.687] GetProcessHeap () returned 0xd20000 [0108.687] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.687] GetProcessHeap () returned 0xd20000 [0108.688] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.688] GetProcessHeap () returned 0xd20000 [0108.688] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.688] GetProcessHeap () returned 0xd20000 [0108.688] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.688] GetProcessHeap () returned 0xd20000 [0108.688] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.688] GetProcessHeap () returned 0xd20000 [0108.688] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.688] GetProcessHeap () returned 0xd20000 [0108.688] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b878 [0108.688] GetProcessHeap () returned 0xd20000 [0108.688] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44588 | out: hHeap=0xd20000) returned 1 [0108.688] GetProcessHeap () returned 0xd20000 [0108.688] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0108.688] GetProcessHeap () returned 0xd20000 [0108.688] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b878 | out: hHeap=0xd20000) returned 1 [0108.688] GetProcessHeap () returned 0xd20000 [0108.688] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.688] GetProcessHeap () returned 0xd20000 [0108.688] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.689] GetProcessHeap () returned 0xd20000 [0108.689] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.689] GetProcessHeap () returned 0xd20000 [0108.689] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.689] GetProcessHeap () returned 0xd20000 [0108.689] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.689] GetProcessHeap () returned 0xd20000 [0108.689] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.689] GetProcessHeap () returned 0xd20000 [0108.689] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.689] GetProcessHeap () returned 0xd20000 [0108.689] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.689] GetProcessHeap () returned 0xd20000 [0108.689] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.689] GetProcessHeap () returned 0xd20000 [0108.689] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.689] GetProcessHeap () returned 0xd20000 [0108.689] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.689] GetProcessHeap () returned 0xd20000 [0108.689] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.689] GetProcessHeap () returned 0xd20000 [0108.689] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.689] GetProcessHeap () returned 0xd20000 [0108.689] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.690] GetProcessHeap () returned 0xd20000 [0108.690] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.690] GetProcessHeap () returned 0xd20000 [0108.690] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.690] GetProcessHeap () returned 0xd20000 [0108.690] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.690] GetProcessHeap () returned 0xd20000 [0108.690] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.690] GetProcessHeap () returned 0xd20000 [0108.690] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.690] GetProcessHeap () returned 0xd20000 [0108.690] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.690] GetProcessHeap () returned 0xd20000 [0108.690] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.690] GetProcessHeap () returned 0xd20000 [0108.690] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.690] GetProcessHeap () returned 0xd20000 [0108.690] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.690] GetProcessHeap () returned 0xd20000 [0108.690] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.690] GetProcessHeap () returned 0xd20000 [0108.690] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.691] GetProcessHeap () returned 0xd20000 [0108.691] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.691] GetProcessHeap () returned 0xd20000 [0108.691] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.691] GetProcessHeap () returned 0xd20000 [0108.691] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.691] GetProcessHeap () returned 0xd20000 [0108.691] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.691] GetProcessHeap () returned 0xd20000 [0108.691] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.691] GetProcessHeap () returned 0xd20000 [0108.691] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.691] GetProcessHeap () returned 0xd20000 [0108.691] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.691] GetProcessHeap () returned 0xd20000 [0108.691] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.691] GetProcessHeap () returned 0xd20000 [0108.691] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.691] GetProcessHeap () returned 0xd20000 [0108.691] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.692] GetProcessHeap () returned 0xd20000 [0108.692] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.692] GetProcessHeap () returned 0xd20000 [0108.692] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.692] GetProcessHeap () returned 0xd20000 [0108.692] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.692] GetProcessHeap () returned 0xd20000 [0108.692] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.692] GetProcessHeap () returned 0xd20000 [0108.692] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.692] GetProcessHeap () returned 0xd20000 [0108.692] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.692] GetProcessHeap () returned 0xd20000 [0108.692] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.692] GetProcessHeap () returned 0xd20000 [0108.692] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.692] GetProcessHeap () returned 0xd20000 [0108.692] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.692] GetProcessHeap () returned 0xd20000 [0108.692] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.692] GetProcessHeap () returned 0xd20000 [0108.692] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.693] GetProcessHeap () returned 0xd20000 [0108.693] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.693] GetProcessHeap () returned 0xd20000 [0108.693] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.693] GetProcessHeap () returned 0xd20000 [0108.693] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.693] GetProcessHeap () returned 0xd20000 [0108.693] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.693] GetProcessHeap () returned 0xd20000 [0108.693] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.693] GetProcessHeap () returned 0xd20000 [0108.693] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.693] GetProcessHeap () returned 0xd20000 [0108.693] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.693] GetProcessHeap () returned 0xd20000 [0108.693] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.693] GetProcessHeap () returned 0xd20000 [0108.693] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.693] GetProcessHeap () returned 0xd20000 [0108.693] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.694] GetProcessHeap () returned 0xd20000 [0108.694] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.694] GetProcessHeap () returned 0xd20000 [0108.694] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.694] GetProcessHeap () returned 0xd20000 [0108.694] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.694] GetProcessHeap () returned 0xd20000 [0108.694] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.694] GetProcessHeap () returned 0xd20000 [0108.694] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.694] GetProcessHeap () returned 0xd20000 [0108.694] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.694] GetProcessHeap () returned 0xd20000 [0108.694] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.694] GetProcessHeap () returned 0xd20000 [0108.694] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.694] GetProcessHeap () returned 0xd20000 [0108.694] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.694] GetProcessHeap () returned 0xd20000 [0108.695] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.695] GetProcessHeap () returned 0xd20000 [0108.695] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.695] GetProcessHeap () returned 0xd20000 [0108.695] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.695] GetProcessHeap () returned 0xd20000 [0108.695] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.695] GetProcessHeap () returned 0xd20000 [0108.695] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.695] GetProcessHeap () returned 0xd20000 [0108.695] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.695] GetProcessHeap () returned 0xd20000 [0108.695] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.695] GetProcessHeap () returned 0xd20000 [0108.695] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.695] GetProcessHeap () returned 0xd20000 [0108.696] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.696] GetProcessHeap () returned 0xd20000 [0108.696] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.696] GetProcessHeap () returned 0xd20000 [0108.696] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.696] GetProcessHeap () returned 0xd20000 [0108.696] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.696] GetProcessHeap () returned 0xd20000 [0108.696] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.696] GetProcessHeap () returned 0xd20000 [0108.696] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.696] GetProcessHeap () returned 0xd20000 [0108.696] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.696] GetProcessHeap () returned 0xd20000 [0108.696] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.696] GetProcessHeap () returned 0xd20000 [0108.696] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.696] GetProcessHeap () returned 0xd20000 [0108.696] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.697] GetProcessHeap () returned 0xd20000 [0108.697] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.697] GetProcessHeap () returned 0xd20000 [0108.697] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.697] GetProcessHeap () returned 0xd20000 [0108.697] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.697] GetProcessHeap () returned 0xd20000 [0108.697] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.697] GetProcessHeap () returned 0xd20000 [0108.697] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.697] GetProcessHeap () returned 0xd20000 [0108.697] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.697] GetProcessHeap () returned 0xd20000 [0108.697] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.697] GetProcessHeap () returned 0xd20000 [0108.697] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.697] GetProcessHeap () returned 0xd20000 [0108.697] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.697] GetProcessHeap () returned 0xd20000 [0108.697] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.697] GetProcessHeap () returned 0xd20000 [0108.697] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.697] GetProcessHeap () returned 0xd20000 [0108.697] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.698] GetProcessHeap () returned 0xd20000 [0108.698] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.698] GetProcessHeap () returned 0xd20000 [0108.698] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.698] GetProcessHeap () returned 0xd20000 [0108.698] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.698] GetProcessHeap () returned 0xd20000 [0108.698] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.698] GetProcessHeap () returned 0xd20000 [0108.698] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.698] GetProcessHeap () returned 0xd20000 [0108.698] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.698] GetProcessHeap () returned 0xd20000 [0108.698] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.698] GetProcessHeap () returned 0xd20000 [0108.698] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.698] GetProcessHeap () returned 0xd20000 [0108.698] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.698] GetProcessHeap () returned 0xd20000 [0108.698] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.698] GetProcessHeap () returned 0xd20000 [0108.698] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.698] GetProcessHeap () returned 0xd20000 [0108.699] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.699] GetProcessHeap () returned 0xd20000 [0108.699] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.699] GetProcessHeap () returned 0xd20000 [0108.699] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.699] GetProcessHeap () returned 0xd20000 [0108.699] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.699] GetProcessHeap () returned 0xd20000 [0108.699] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.699] GetProcessHeap () returned 0xd20000 [0108.699] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.699] GetProcessHeap () returned 0xd20000 [0108.699] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.699] GetProcessHeap () returned 0xd20000 [0108.699] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.699] GetProcessHeap () returned 0xd20000 [0108.699] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.699] GetProcessHeap () returned 0xd20000 [0108.699] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.699] GetProcessHeap () returned 0xd20000 [0108.699] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.699] GetProcessHeap () returned 0xd20000 [0108.699] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.700] GetProcessHeap () returned 0xd20000 [0108.700] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.700] GetProcessHeap () returned 0xd20000 [0108.700] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.700] GetProcessHeap () returned 0xd20000 [0108.700] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.700] GetProcessHeap () returned 0xd20000 [0108.700] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.700] GetProcessHeap () returned 0xd20000 [0108.700] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.700] GetProcessHeap () returned 0xd20000 [0108.700] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.700] GetProcessHeap () returned 0xd20000 [0108.700] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.700] GetProcessHeap () returned 0xd20000 [0108.700] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.700] GetProcessHeap () returned 0xd20000 [0108.700] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.700] GetProcessHeap () returned 0xd20000 [0108.700] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.700] GetProcessHeap () returned 0xd20000 [0108.700] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.700] GetProcessHeap () returned 0xd20000 [0108.700] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.700] GetProcessHeap () returned 0xd20000 [0108.701] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.701] GetProcessHeap () returned 0xd20000 [0108.701] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.701] GetProcessHeap () returned 0xd20000 [0108.701] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.701] GetProcessHeap () returned 0xd20000 [0108.701] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.701] GetProcessHeap () returned 0xd20000 [0108.701] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.701] GetProcessHeap () returned 0xd20000 [0108.701] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.701] GetProcessHeap () returned 0xd20000 [0108.701] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.701] GetProcessHeap () returned 0xd20000 [0108.701] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.701] GetProcessHeap () returned 0xd20000 [0108.701] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.701] GetProcessHeap () returned 0xd20000 [0108.701] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.701] GetProcessHeap () returned 0xd20000 [0108.701] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.701] GetProcessHeap () returned 0xd20000 [0108.701] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.701] GetProcessHeap () returned 0xd20000 [0108.701] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.701] GetProcessHeap () returned 0xd20000 [0108.702] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.702] GetProcessHeap () returned 0xd20000 [0108.702] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.702] GetProcessHeap () returned 0xd20000 [0108.702] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.702] GetProcessHeap () returned 0xd20000 [0108.702] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.702] GetProcessHeap () returned 0xd20000 [0108.702] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.702] GetProcessHeap () returned 0xd20000 [0108.702] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.702] GetProcessHeap () returned 0xd20000 [0108.702] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.702] GetProcessHeap () returned 0xd20000 [0108.702] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.702] GetProcessHeap () returned 0xd20000 [0108.702] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.702] GetProcessHeap () returned 0xd20000 [0108.702] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.702] GetProcessHeap () returned 0xd20000 [0108.702] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.702] GetProcessHeap () returned 0xd20000 [0108.702] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.702] GetProcessHeap () returned 0xd20000 [0108.702] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.702] GetProcessHeap () returned 0xd20000 [0108.702] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.703] GetProcessHeap () returned 0xd20000 [0108.703] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.703] GetProcessHeap () returned 0xd20000 [0108.703] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.703] GetProcessHeap () returned 0xd20000 [0108.703] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.703] GetProcessHeap () returned 0xd20000 [0108.703] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.703] GetProcessHeap () returned 0xd20000 [0108.703] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.703] GetProcessHeap () returned 0xd20000 [0108.703] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.703] GetProcessHeap () returned 0xd20000 [0108.703] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.703] GetProcessHeap () returned 0xd20000 [0108.703] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.703] GetProcessHeap () returned 0xd20000 [0108.703] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.703] GetProcessHeap () returned 0xd20000 [0108.703] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.703] GetProcessHeap () returned 0xd20000 [0108.703] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.703] GetProcessHeap () returned 0xd20000 [0108.703] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.703] GetProcessHeap () returned 0xd20000 [0108.704] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.704] GetProcessHeap () returned 0xd20000 [0108.704] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0108.704] GetProcessHeap () returned 0xd20000 [0108.704] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0108.704] GetProcessHeap () returned 0xd20000 [0108.704] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0108.704] GetProcessHeap () returned 0xd20000 [0108.704] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0108.704] GetProcessHeap () returned 0xd20000 [0108.704] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44438 | out: hHeap=0xd20000) returned 1 [0108.704] GetProcessHeap () returned 0xd20000 [0108.704] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4af78 | out: hHeap=0xd20000) returned 1 [0108.704] GetProcessHeap () returned 0xd20000 [0108.704] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0108.704] GetProcessHeap () returned 0xd20000 [0108.704] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a948 | out: hHeap=0xd20000) returned 1 [0108.704] GetProcessHeap () returned 0xd20000 [0108.704] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0108.704] GetProcessHeap () returned 0xd20000 [0108.704] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.704] GetProcessHeap () returned 0xd20000 [0108.704] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0108.704] WriteFile (in: hFile=0x230, lpBuffer=0xd4f428*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f428*, lpNumberOfBytesWritten=0x299d864*=0x389, lpOverlapped=0x0) returned 1 [0108.707] GetProcessHeap () returned 0xd20000 [0108.707] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4f428, Size=0x30) returned 0xd4f428 [0108.707] GetProcessHeap () returned 0xd20000 [0108.707] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0108.707] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0108.707] GetProcessHeap () returned 0xd20000 [0108.707] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4ad0) returned 0xd4f460 [0108.707] ReadFile (in: hFile=0x230, lpBuffer=0xd4f460, nNumberOfBytesToRead=0x4ad0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4f460*, lpNumberOfBytesRead=0x299d7e8*=0x4ad0, lpOverlapped=0x0) returned 1 [0108.708] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0108.708] WriteFile (in: hFile=0x230, lpBuffer=0xd4f460*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4f460*, lpNumberOfBytesWritten=0x299d7e4*=0x4ad0, lpOverlapped=0x0) returned 1 [0108.709] GetProcessHeap () returned 0xd20000 [0108.709] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4f460 | out: hHeap=0xd20000) returned 1 [0108.710] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0108.710] WriteFile (in: hFile=0x230, lpBuffer=0xd4f428*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f428*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0108.711] CloseHandle (hObject=0x230) returned 1 [0108.715] GetProcessHeap () returned 0xd20000 [0108.715] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42828 | out: hHeap=0xd20000) returned 1 [0108.715] GetProcessHeap () returned 0xd20000 [0108.715] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bf80 | out: hHeap=0xd20000) returned 1 [0108.716] GetProcessHeap () returned 0xd20000 [0108.716] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0108.716] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\5H22wIEHFFA.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\5H22wIEHFFA.gif") returned="C:\\Users\\FD1HVy\\Pictures\\5H22wIEHFFA.gif" [0108.716] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\5H22wIEHFFA.gif", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\5H22wIEHFFA.gif.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Pictures\\5H22wIEHFFA.gif.[ponce.lorena@aol.com]" [0108.716] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\5H22wIEHFFA.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\5h22wiehffa.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\5H22wIEHFFA.gif.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\pictures\\5h22wiehffa.gif.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0108.717] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\5H22wIEHFFA.gif" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0108.717] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0108.717] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html" [0108.717] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_recover.html")) returned 0x20 [0108.717] GetProcessHeap () returned 0xd20000 [0108.717] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446c0 | out: hHeap=0xd20000) returned 1 [0108.717] FindNextFileW (in: hFindFile=0xd49120, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbed36720, ftCreationTime.dwHighDateTime=0x1d4cfdb, ftLastAccessTime.dwLowDateTime=0xb039e2b0, ftLastAccessTime.dwHighDateTime=0x1d4cd48, ftLastWriteTime.dwLowDateTime=0xb039e2b0, ftLastWriteTime.dwHighDateTime=0x1d4cd48, nFileSizeHigh=0x0, nFileSizeLow=0xedea, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="5mn-5rRd.png", cAlternateFileName="")) returned 1 [0108.717] lstrcmpiW (lpString1="5mn-5rRd.png", lpString2=".") returned 1 [0108.717] lstrcmpiW (lpString1="5mn-5rRd.png", lpString2="..") returned 1 [0108.717] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="5mn-5rRd.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\5mn-5rRd.png") returned="C:\\Users\\FD1HVy\\Pictures\\5mn-5rRd.png" [0108.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="5mn-5rRd.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0108.717] GetProcessHeap () returned 0xd20000 [0108.717] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xd) returned 0xd446a8 [0108.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="5mn-5rRd.png", cchWideChar=-1, lpMultiByteStr=0xd446a8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5mn-5rRd.png", lpUsedDefaultChar=0x0) returned 13 [0108.717] lstrlenA (lpString="5mn-5rRd.png") returned 12 [0108.718] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0108.718] lstrlenA (lpString="5mn-5rRd.png") returned 12 [0108.718] lstrlenA (lpString=".dll") returned 4 [0108.718] lstrlenA (lpString=".dll") returned 4 [0108.718] lstrlenA (lpString="5mn-5rRd.png") returned 12 [0108.718] lstrcmpiA (lpString1=".png", lpString2=".dll") returned 1 [0108.718] lstrlenA (lpString="5mn-5rRd.png") returned 12 [0108.718] lstrlenA (lpString=".ini") returned 4 [0108.718] lstrlenA (lpString=".ini") returned 4 [0108.718] lstrlenA (lpString="5mn-5rRd.png") returned 12 [0108.718] lstrcmpiA (lpString1=".png", lpString2=".ini") returned 1 [0108.718] lstrlenA (lpString="5mn-5rRd.png") returned 12 [0108.718] lstrlenA (lpString=".inc") returned 4 [0108.718] lstrlenA (lpString=".inc") returned 4 [0108.718] lstrlenA (lpString="5mn-5rRd.png") returned 12 [0108.718] lstrcmpiA (lpString1=".png", lpString2=".inc") returned 1 [0108.718] lstrcmpiW (lpString1="5mn-5rRd.png", lpString2="HOW_RECOVER.html") returned -1 [0108.718] lstrcmpiW (lpString1="5mn-5rRd.png", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0108.718] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0108.718] lstrcmpiW (lpString1="5mn-5rRd.png", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0108.719] GetProcessHeap () returned 0xd20000 [0108.719] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42490 [0108.719] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\5mn-5rRd.png" (normalized: "c:\\users\\fd1hvy\\pictures\\5mn-5rrd.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0108.719] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=60906) returned 1 [0108.719] GetProcessHeap () returned 0xd20000 [0108.719] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bd28 [0108.719] GetProcessHeap () returned 0xd20000 [0108.719] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0108.719] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\5mn-5rRd.png") returned 37 [0108.719] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0108.719] GetProcessHeap () returned 0xd20000 [0108.719] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0108.719] GetProcessHeap () returned 0xd20000 [0108.720] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4f460 [0108.720] lstrlenA (lpString="rsa_encrypt") returned 11 [0108.720] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0108.722] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0108.722] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0108.722] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0108.722] GetProcessHeap () returned 0xd20000 [0108.722] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0108.722] lstrlenA (lpString="010001") returned 6 [0108.722] GetProcessHeap () returned 0xd20000 [0108.722] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd98 [0108.722] GetProcessHeap () returned 0xd20000 [0108.722] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0108.722] GetProcessHeap () returned 0xd20000 [0108.722] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0108.723] GetProcessHeap () returned 0xd20000 [0108.723] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0108.723] GetProcessHeap () returned 0xd20000 [0108.723] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b6c8 [0108.723] GetProcessHeap () returned 0xd20000 [0108.723] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45528 [0108.723] GetProcessHeap () returned 0xd20000 [0108.723] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc18 [0108.723] GetProcessHeap () returned 0xd20000 [0108.723] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0108.723] GetProcessHeap () returned 0xd20000 [0108.723] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.723] GetProcessHeap () returned 0xd20000 [0108.723] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0108.723] GetProcessHeap () returned 0xd20000 [0108.723] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0108.723] GetProcessHeap () returned 0xd20000 [0108.723] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd451e0 [0108.723] GetProcessHeap () returned 0xd20000 [0108.723] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.723] GetProcessHeap () returned 0xd20000 [0108.724] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44498 [0108.724] GetProcessHeap () returned 0xd20000 [0108.724] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aee8 [0108.724] GetProcessHeap () returned 0xd20000 [0108.724] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0108.724] GetProcessHeap () returned 0xd20000 [0108.724] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0108.724] GetProcessHeap () returned 0xd20000 [0108.724] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aee8 | out: hHeap=0xd20000) returned 1 [0108.724] GetProcessHeap () returned 0xd20000 [0108.724] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.724] GetProcessHeap () returned 0xd20000 [0108.724] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446f0 [0108.724] GetProcessHeap () returned 0xd20000 [0108.724] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.724] GetProcessHeap () returned 0xd20000 [0108.724] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.724] GetProcessHeap () returned 0xd20000 [0108.724] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.724] GetProcessHeap () returned 0xd20000 [0108.724] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.725] GetProcessHeap () returned 0xd20000 [0108.725] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.725] GetProcessHeap () returned 0xd20000 [0108.725] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.725] GetProcessHeap () returned 0xd20000 [0108.725] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4ad38 [0108.725] GetProcessHeap () returned 0xd20000 [0108.725] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446f0 | out: hHeap=0xd20000) returned 1 [0108.725] GetProcessHeap () returned 0xd20000 [0108.725] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0108.725] GetProcessHeap () returned 0xd20000 [0108.725] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ad38 | out: hHeap=0xd20000) returned 1 [0108.725] GetProcessHeap () returned 0xd20000 [0108.725] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.725] GetProcessHeap () returned 0xd20000 [0108.725] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.725] GetProcessHeap () returned 0xd20000 [0108.725] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.725] GetProcessHeap () returned 0xd20000 [0108.725] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.725] GetProcessHeap () returned 0xd20000 [0108.726] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.726] GetProcessHeap () returned 0xd20000 [0108.726] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.726] GetProcessHeap () returned 0xd20000 [0108.726] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.726] GetProcessHeap () returned 0xd20000 [0108.726] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.726] GetProcessHeap () returned 0xd20000 [0108.726] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.726] GetProcessHeap () returned 0xd20000 [0108.726] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.726] GetProcessHeap () returned 0xd20000 [0108.726] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.726] GetProcessHeap () returned 0xd20000 [0108.726] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.726] GetProcessHeap () returned 0xd20000 [0108.726] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.726] GetProcessHeap () returned 0xd20000 [0108.726] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.727] GetProcessHeap () returned 0xd20000 [0108.727] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.727] GetProcessHeap () returned 0xd20000 [0108.727] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.727] GetProcessHeap () returned 0xd20000 [0108.727] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.727] GetProcessHeap () returned 0xd20000 [0108.727] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.727] GetProcessHeap () returned 0xd20000 [0108.727] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.727] GetProcessHeap () returned 0xd20000 [0108.727] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.728] GetProcessHeap () returned 0xd20000 [0108.728] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.728] GetProcessHeap () returned 0xd20000 [0108.728] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.728] GetProcessHeap () returned 0xd20000 [0108.728] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.728] GetProcessHeap () returned 0xd20000 [0108.728] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.728] GetProcessHeap () returned 0xd20000 [0108.728] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.728] GetProcessHeap () returned 0xd20000 [0108.728] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.728] GetProcessHeap () returned 0xd20000 [0108.728] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.728] GetProcessHeap () returned 0xd20000 [0108.728] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.728] GetProcessHeap () returned 0xd20000 [0108.728] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.728] GetProcessHeap () returned 0xd20000 [0108.728] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.728] GetProcessHeap () returned 0xd20000 [0108.729] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.729] GetProcessHeap () returned 0xd20000 [0108.729] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.729] GetProcessHeap () returned 0xd20000 [0108.729] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.729] GetProcessHeap () returned 0xd20000 [0108.729] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.729] GetProcessHeap () returned 0xd20000 [0108.729] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.729] GetProcessHeap () returned 0xd20000 [0108.729] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.729] GetProcessHeap () returned 0xd20000 [0108.729] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.729] GetProcessHeap () returned 0xd20000 [0108.729] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.729] GetProcessHeap () returned 0xd20000 [0108.729] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.729] GetProcessHeap () returned 0xd20000 [0108.729] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.729] GetProcessHeap () returned 0xd20000 [0108.729] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.730] GetProcessHeap () returned 0xd20000 [0108.730] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.730] GetProcessHeap () returned 0xd20000 [0108.730] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.730] GetProcessHeap () returned 0xd20000 [0108.730] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.730] GetProcessHeap () returned 0xd20000 [0108.730] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.730] GetProcessHeap () returned 0xd20000 [0108.730] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.730] GetProcessHeap () returned 0xd20000 [0108.730] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.730] GetProcessHeap () returned 0xd20000 [0108.730] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.730] GetProcessHeap () returned 0xd20000 [0108.730] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.730] GetProcessHeap () returned 0xd20000 [0108.730] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.730] GetProcessHeap () returned 0xd20000 [0108.730] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.731] GetProcessHeap () returned 0xd20000 [0108.731] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.731] GetProcessHeap () returned 0xd20000 [0108.731] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.731] GetProcessHeap () returned 0xd20000 [0108.731] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.731] GetProcessHeap () returned 0xd20000 [0108.731] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.731] GetProcessHeap () returned 0xd20000 [0108.731] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.731] GetProcessHeap () returned 0xd20000 [0108.731] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.731] GetProcessHeap () returned 0xd20000 [0108.731] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.731] GetProcessHeap () returned 0xd20000 [0108.731] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.731] GetProcessHeap () returned 0xd20000 [0108.731] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.731] GetProcessHeap () returned 0xd20000 [0108.731] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.731] GetProcessHeap () returned 0xd20000 [0108.732] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.732] GetProcessHeap () returned 0xd20000 [0108.732] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.732] GetProcessHeap () returned 0xd20000 [0108.732] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.732] GetProcessHeap () returned 0xd20000 [0108.732] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.732] GetProcessHeap () returned 0xd20000 [0108.732] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.732] GetProcessHeap () returned 0xd20000 [0108.732] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.732] GetProcessHeap () returned 0xd20000 [0108.732] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.732] GetProcessHeap () returned 0xd20000 [0108.732] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.732] GetProcessHeap () returned 0xd20000 [0108.732] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.732] GetProcessHeap () returned 0xd20000 [0108.732] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.732] GetProcessHeap () returned 0xd20000 [0108.732] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.733] GetProcessHeap () returned 0xd20000 [0108.733] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.733] GetProcessHeap () returned 0xd20000 [0108.733] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.733] GetProcessHeap () returned 0xd20000 [0108.733] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.733] GetProcessHeap () returned 0xd20000 [0108.733] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.733] GetProcessHeap () returned 0xd20000 [0108.733] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.733] GetProcessHeap () returned 0xd20000 [0108.733] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.733] GetProcessHeap () returned 0xd20000 [0108.733] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.733] GetProcessHeap () returned 0xd20000 [0108.733] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.733] GetProcessHeap () returned 0xd20000 [0108.733] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.733] GetProcessHeap () returned 0xd20000 [0108.733] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.733] GetProcessHeap () returned 0xd20000 [0108.734] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.734] GetProcessHeap () returned 0xd20000 [0108.734] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.734] GetProcessHeap () returned 0xd20000 [0108.734] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.734] GetProcessHeap () returned 0xd20000 [0108.734] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.734] GetProcessHeap () returned 0xd20000 [0108.734] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.734] GetProcessHeap () returned 0xd20000 [0108.734] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.734] GetProcessHeap () returned 0xd20000 [0108.734] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.734] GetProcessHeap () returned 0xd20000 [0108.734] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.734] GetProcessHeap () returned 0xd20000 [0108.734] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.734] GetProcessHeap () returned 0xd20000 [0108.734] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.734] GetProcessHeap () returned 0xd20000 [0108.734] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.734] GetProcessHeap () returned 0xd20000 [0108.735] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.735] GetProcessHeap () returned 0xd20000 [0108.735] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.735] GetProcessHeap () returned 0xd20000 [0108.735] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.735] GetProcessHeap () returned 0xd20000 [0108.735] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.735] GetProcessHeap () returned 0xd20000 [0108.735] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.735] GetProcessHeap () returned 0xd20000 [0108.735] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.735] GetProcessHeap () returned 0xd20000 [0108.735] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.735] GetProcessHeap () returned 0xd20000 [0108.735] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.735] GetProcessHeap () returned 0xd20000 [0108.735] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.735] GetProcessHeap () returned 0xd20000 [0108.735] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.736] GetProcessHeap () returned 0xd20000 [0108.736] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.736] GetProcessHeap () returned 0xd20000 [0108.736] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.736] GetProcessHeap () returned 0xd20000 [0108.736] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.736] GetProcessHeap () returned 0xd20000 [0108.736] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.736] GetProcessHeap () returned 0xd20000 [0108.736] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.736] GetProcessHeap () returned 0xd20000 [0108.736] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.736] GetProcessHeap () returned 0xd20000 [0108.736] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.736] GetProcessHeap () returned 0xd20000 [0108.736] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.736] GetProcessHeap () returned 0xd20000 [0108.736] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.736] GetProcessHeap () returned 0xd20000 [0108.737] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.737] GetProcessHeap () returned 0xd20000 [0108.737] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.737] GetProcessHeap () returned 0xd20000 [0108.737] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.737] GetProcessHeap () returned 0xd20000 [0108.737] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.737] GetProcessHeap () returned 0xd20000 [0108.737] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.737] GetProcessHeap () returned 0xd20000 [0108.737] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.737] GetProcessHeap () returned 0xd20000 [0108.737] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.737] GetProcessHeap () returned 0xd20000 [0108.737] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.737] GetProcessHeap () returned 0xd20000 [0108.737] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.737] GetProcessHeap () returned 0xd20000 [0108.737] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.738] GetProcessHeap () returned 0xd20000 [0108.738] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.738] GetProcessHeap () returned 0xd20000 [0108.738] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.738] GetProcessHeap () returned 0xd20000 [0108.738] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.738] GetProcessHeap () returned 0xd20000 [0108.738] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.738] GetProcessHeap () returned 0xd20000 [0108.738] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.738] GetProcessHeap () returned 0xd20000 [0108.738] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.738] GetProcessHeap () returned 0xd20000 [0108.738] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.738] GetProcessHeap () returned 0xd20000 [0108.738] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.738] GetProcessHeap () returned 0xd20000 [0108.738] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.738] GetProcessHeap () returned 0xd20000 [0108.738] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.739] GetProcessHeap () returned 0xd20000 [0108.739] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.739] GetProcessHeap () returned 0xd20000 [0108.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.739] GetProcessHeap () returned 0xd20000 [0108.739] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.739] GetProcessHeap () returned 0xd20000 [0108.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.739] GetProcessHeap () returned 0xd20000 [0108.739] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.739] GetProcessHeap () returned 0xd20000 [0108.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.739] GetProcessHeap () returned 0xd20000 [0108.739] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.739] GetProcessHeap () returned 0xd20000 [0108.739] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.740] GetProcessHeap () returned 0xd20000 [0108.740] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.740] GetProcessHeap () returned 0xd20000 [0108.740] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.740] GetProcessHeap () returned 0xd20000 [0108.740] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.740] GetProcessHeap () returned 0xd20000 [0108.740] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.740] GetProcessHeap () returned 0xd20000 [0108.740] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.740] GetProcessHeap () returned 0xd20000 [0108.740] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.740] GetProcessHeap () returned 0xd20000 [0108.740] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.740] GetProcessHeap () returned 0xd20000 [0108.740] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.740] GetProcessHeap () returned 0xd20000 [0108.740] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.740] GetProcessHeap () returned 0xd20000 [0108.741] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.741] GetProcessHeap () returned 0xd20000 [0108.741] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.741] GetProcessHeap () returned 0xd20000 [0108.741] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.741] GetProcessHeap () returned 0xd20000 [0108.741] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.741] GetProcessHeap () returned 0xd20000 [0108.741] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.741] GetProcessHeap () returned 0xd20000 [0108.741] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.741] GetProcessHeap () returned 0xd20000 [0108.741] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.741] GetProcessHeap () returned 0xd20000 [0108.741] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.741] GetProcessHeap () returned 0xd20000 [0108.741] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.741] GetProcessHeap () returned 0xd20000 [0108.741] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.741] GetProcessHeap () returned 0xd20000 [0108.742] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.742] GetProcessHeap () returned 0xd20000 [0108.742] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.742] GetProcessHeap () returned 0xd20000 [0108.742] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.742] GetProcessHeap () returned 0xd20000 [0108.742] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.742] GetProcessHeap () returned 0xd20000 [0108.742] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.743] GetProcessHeap () returned 0xd20000 [0108.743] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.743] GetProcessHeap () returned 0xd20000 [0108.743] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.743] GetProcessHeap () returned 0xd20000 [0108.743] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.743] GetProcessHeap () returned 0xd20000 [0108.743] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.743] GetProcessHeap () returned 0xd20000 [0108.743] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.743] GetProcessHeap () returned 0xd20000 [0108.743] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.743] GetProcessHeap () returned 0xd20000 [0108.743] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0108.743] GetProcessHeap () returned 0xd20000 [0108.743] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0108.743] GetProcessHeap () returned 0xd20000 [0108.743] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0108.744] GetProcessHeap () returned 0xd20000 [0108.744] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0108.744] GetProcessHeap () returned 0xd20000 [0108.744] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44498 | out: hHeap=0xd20000) returned 1 [0108.744] GetProcessHeap () returned 0xd20000 [0108.744] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b6c8 | out: hHeap=0xd20000) returned 1 [0108.744] GetProcessHeap () returned 0xd20000 [0108.744] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0108.744] GetProcessHeap () returned 0xd20000 [0108.744] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0108.744] GetProcessHeap () returned 0xd20000 [0108.744] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0108.744] GetProcessHeap () returned 0xd20000 [0108.744] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.744] GetProcessHeap () returned 0xd20000 [0108.744] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0108.744] WriteFile (in: hFile=0x230, lpBuffer=0xd4f460*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f460*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0108.749] GetProcessHeap () returned 0xd20000 [0108.749] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4f460, Size=0x30) returned 0xd4f460 [0108.749] GetProcessHeap () returned 0xd20000 [0108.750] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0108.750] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0108.750] GetProcessHeap () returned 0xd20000 [0108.750] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xedea) returned 0xd4f498 [0108.751] ReadFile (in: hFile=0x230, lpBuffer=0xd4f498, nNumberOfBytesToRead=0xedea, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4f498*, lpNumberOfBytesRead=0x299d7e8*=0xedea, lpOverlapped=0x0) returned 1 [0108.752] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0108.752] WriteFile (in: hFile=0x230, lpBuffer=0xd4f498*, nNumberOfBytesToWrite=0xedea, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4f498*, lpNumberOfBytesWritten=0x299d7e4*=0xedea, lpOverlapped=0x0) returned 1 [0108.755] GetProcessHeap () returned 0xd20000 [0108.755] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4f498 | out: hHeap=0xd20000) returned 1 [0108.756] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0108.756] WriteFile (in: hFile=0x230, lpBuffer=0xd4f460*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f460*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0108.757] CloseHandle (hObject=0x230) returned 1 [0108.765] GetProcessHeap () returned 0xd20000 [0108.765] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42490 | out: hHeap=0xd20000) returned 1 [0108.765] GetProcessHeap () returned 0xd20000 [0108.765] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bd28 | out: hHeap=0xd20000) returned 1 [0108.765] GetProcessHeap () returned 0xd20000 [0108.765] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0108.765] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\5mn-5rRd.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\5mn-5rRd.png") returned="C:\\Users\\FD1HVy\\Pictures\\5mn-5rRd.png" [0108.765] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\5mn-5rRd.png", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\5mn-5rRd.png.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Pictures\\5mn-5rRd.png.[ponce.lorena@aol.com]" [0108.765] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\5mn-5rRd.png" (normalized: "c:\\users\\fd1hvy\\pictures\\5mn-5rrd.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\5mn-5rRd.png.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\pictures\\5mn-5rrd.png.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0108.766] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\5mn-5rRd.png" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0108.766] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0108.766] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html" [0108.766] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_recover.html")) returned 0x20 [0108.766] GetProcessHeap () returned 0xd20000 [0108.766] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446a8 | out: hHeap=0xd20000) returned 1 [0108.767] FindNextFileW (in: hFindFile=0xd49120, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc924680, ftCreationTime.dwHighDateTime=0x1d4d136, ftLastAccessTime.dwLowDateTime=0xe99fba80, ftLastAccessTime.dwHighDateTime=0x1d4d30a, ftLastWriteTime.dwLowDateTime=0xe99fba80, ftLastWriteTime.dwHighDateTime=0x1d4d30a, nFileSizeHigh=0x0, nFileSizeLow=0xeec8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="6ePuVA3oz90AMsog.gif", cAlternateFileName="6EPUVA~1.GIF")) returned 1 [0108.767] lstrcmpiW (lpString1="6ePuVA3oz90AMsog.gif", lpString2=".") returned 1 [0108.767] lstrcmpiW (lpString1="6ePuVA3oz90AMsog.gif", lpString2="..") returned 1 [0108.767] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="6ePuVA3oz90AMsog.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\6ePuVA3oz90AMsog.gif") returned="C:\\Users\\FD1HVy\\Pictures\\6ePuVA3oz90AMsog.gif" [0108.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="6ePuVA3oz90AMsog.gif", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0108.767] GetProcessHeap () returned 0xd20000 [0108.767] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x15) returned 0xd36568 [0108.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="6ePuVA3oz90AMsog.gif", cchWideChar=-1, lpMultiByteStr=0xd36568, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6ePuVA3oz90AMsog.gif", lpUsedDefaultChar=0x0) returned 21 [0108.767] lstrlenA (lpString="6ePuVA3oz90AMsog.gif") returned 20 [0108.767] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0108.767] lstrlenA (lpString="6ePuVA3oz90AMsog.gif") returned 20 [0108.767] lstrlenA (lpString=".dll") returned 4 [0108.767] lstrlenA (lpString=".dll") returned 4 [0108.767] lstrlenA (lpString="6ePuVA3oz90AMsog.gif") returned 20 [0108.767] lstrcmpiA (lpString1=".gif", lpString2=".dll") returned 1 [0108.767] lstrlenA (lpString="6ePuVA3oz90AMsog.gif") returned 20 [0108.767] lstrlenA (lpString=".ini") returned 4 [0108.767] lstrlenA (lpString=".ini") returned 4 [0108.767] lstrlenA (lpString="6ePuVA3oz90AMsog.gif") returned 20 [0108.768] lstrcmpiA (lpString1=".gif", lpString2=".ini") returned -1 [0108.768] lstrlenA (lpString="6ePuVA3oz90AMsog.gif") returned 20 [0108.768] lstrlenA (lpString=".inc") returned 4 [0108.768] lstrlenA (lpString=".inc") returned 4 [0108.768] lstrlenA (lpString="6ePuVA3oz90AMsog.gif") returned 20 [0108.768] lstrcmpiA (lpString1=".gif", lpString2=".inc") returned -1 [0108.768] lstrcmpiW (lpString1="6ePuVA3oz90AMsog.gif", lpString2="HOW_RECOVER.html") returned -1 [0108.768] lstrcmpiW (lpString1="6ePuVA3oz90AMsog.gif", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0108.768] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0108.768] lstrcmpiW (lpString1="6ePuVA3oz90AMsog.gif", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0108.768] GetProcessHeap () returned 0xd20000 [0108.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd425a8 [0108.768] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\6ePuVA3oz90AMsog.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\6epuva3oz90amsog.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0108.768] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=61128) returned 1 [0108.768] GetProcessHeap () returned 0xd20000 [0108.768] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bcb0 [0108.769] GetProcessHeap () returned 0xd20000 [0108.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0108.769] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\6ePuVA3oz90AMsog.gif") returned 45 [0108.769] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0108.769] GetProcessHeap () returned 0xd20000 [0108.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0108.769] GetProcessHeap () returned 0xd20000 [0108.769] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4f498 [0108.769] lstrlenA (lpString="rsa_encrypt") returned 11 [0108.769] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0108.773] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0108.773] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0108.773] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0108.773] GetProcessHeap () returned 0xd20000 [0108.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0108.773] lstrlenA (lpString="010001") returned 6 [0108.773] GetProcessHeap () returned 0xd20000 [0108.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc18 [0108.773] GetProcessHeap () returned 0xd20000 [0108.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0108.773] GetProcessHeap () returned 0xd20000 [0108.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0108.773] GetProcessHeap () returned 0xd20000 [0108.773] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0108.773] GetProcessHeap () returned 0xd20000 [0108.773] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b7e8 [0108.774] GetProcessHeap () returned 0xd20000 [0108.774] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44fb0 [0108.774] GetProcessHeap () returned 0xd20000 [0108.774] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc48 [0108.774] GetProcessHeap () returned 0xd20000 [0108.774] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0108.774] GetProcessHeap () returned 0xd20000 [0108.774] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.774] GetProcessHeap () returned 0xd20000 [0108.775] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0108.775] GetProcessHeap () returned 0xd20000 [0108.775] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0108.775] GetProcessHeap () returned 0xd20000 [0108.775] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44c68 [0108.775] GetProcessHeap () returned 0xd20000 [0108.775] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.775] GetProcessHeap () returned 0xd20000 [0108.775] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44588 [0108.775] GetProcessHeap () returned 0xd20000 [0108.775] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ad38 [0108.775] GetProcessHeap () returned 0xd20000 [0108.775] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0108.775] GetProcessHeap () returned 0xd20000 [0108.775] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0108.775] GetProcessHeap () returned 0xd20000 [0108.775] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ad38 | out: hHeap=0xd20000) returned 1 [0108.775] GetProcessHeap () returned 0xd20000 [0108.775] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.775] GetProcessHeap () returned 0xd20000 [0108.776] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44678 [0108.776] GetProcessHeap () returned 0xd20000 [0108.776] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.776] GetProcessHeap () returned 0xd20000 [0108.776] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.776] GetProcessHeap () returned 0xd20000 [0108.776] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.776] GetProcessHeap () returned 0xd20000 [0108.776] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.776] GetProcessHeap () returned 0xd20000 [0108.776] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.776] GetProcessHeap () returned 0xd20000 [0108.776] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.776] GetProcessHeap () returned 0xd20000 [0108.776] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b128 [0108.776] GetProcessHeap () returned 0xd20000 [0108.776] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44678 | out: hHeap=0xd20000) returned 1 [0108.776] GetProcessHeap () returned 0xd20000 [0108.776] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0108.776] GetProcessHeap () returned 0xd20000 [0108.776] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b128 | out: hHeap=0xd20000) returned 1 [0108.777] GetProcessHeap () returned 0xd20000 [0108.777] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.777] GetProcessHeap () returned 0xd20000 [0108.777] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.777] GetProcessHeap () returned 0xd20000 [0108.777] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.777] GetProcessHeap () returned 0xd20000 [0108.777] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.777] GetProcessHeap () returned 0xd20000 [0108.777] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.777] GetProcessHeap () returned 0xd20000 [0108.777] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.777] GetProcessHeap () returned 0xd20000 [0108.777] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.777] GetProcessHeap () returned 0xd20000 [0108.777] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.777] GetProcessHeap () returned 0xd20000 [0108.777] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.777] GetProcessHeap () returned 0xd20000 [0108.777] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.778] GetProcessHeap () returned 0xd20000 [0108.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.778] GetProcessHeap () returned 0xd20000 [0108.778] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.778] GetProcessHeap () returned 0xd20000 [0108.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.778] GetProcessHeap () returned 0xd20000 [0108.778] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.778] GetProcessHeap () returned 0xd20000 [0108.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.778] GetProcessHeap () returned 0xd20000 [0108.778] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.778] GetProcessHeap () returned 0xd20000 [0108.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.778] GetProcessHeap () returned 0xd20000 [0108.778] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.778] GetProcessHeap () returned 0xd20000 [0108.778] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.778] GetProcessHeap () returned 0xd20000 [0108.778] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.779] GetProcessHeap () returned 0xd20000 [0108.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.779] GetProcessHeap () returned 0xd20000 [0108.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.779] GetProcessHeap () returned 0xd20000 [0108.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.779] GetProcessHeap () returned 0xd20000 [0108.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.779] GetProcessHeap () returned 0xd20000 [0108.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.779] GetProcessHeap () returned 0xd20000 [0108.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.779] GetProcessHeap () returned 0xd20000 [0108.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.779] GetProcessHeap () returned 0xd20000 [0108.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.779] GetProcessHeap () returned 0xd20000 [0108.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.779] GetProcessHeap () returned 0xd20000 [0108.779] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.779] GetProcessHeap () returned 0xd20000 [0108.779] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.780] GetProcessHeap () returned 0xd20000 [0108.780] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.780] GetProcessHeap () returned 0xd20000 [0108.780] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.780] GetProcessHeap () returned 0xd20000 [0108.780] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.780] GetProcessHeap () returned 0xd20000 [0108.780] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.780] GetProcessHeap () returned 0xd20000 [0108.780] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.780] GetProcessHeap () returned 0xd20000 [0108.780] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.780] GetProcessHeap () returned 0xd20000 [0108.780] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.780] GetProcessHeap () returned 0xd20000 [0108.780] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.780] GetProcessHeap () returned 0xd20000 [0108.780] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.780] GetProcessHeap () returned 0xd20000 [0108.780] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.780] GetProcessHeap () returned 0xd20000 [0108.781] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.781] GetProcessHeap () returned 0xd20000 [0108.781] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.781] GetProcessHeap () returned 0xd20000 [0108.781] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.781] GetProcessHeap () returned 0xd20000 [0108.781] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.781] GetProcessHeap () returned 0xd20000 [0108.781] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.781] GetProcessHeap () returned 0xd20000 [0108.781] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.781] GetProcessHeap () returned 0xd20000 [0108.781] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.781] GetProcessHeap () returned 0xd20000 [0108.781] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.781] GetProcessHeap () returned 0xd20000 [0108.781] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.781] GetProcessHeap () returned 0xd20000 [0108.781] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.781] GetProcessHeap () returned 0xd20000 [0108.781] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.782] GetProcessHeap () returned 0xd20000 [0108.782] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.782] GetProcessHeap () returned 0xd20000 [0108.782] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.782] GetProcessHeap () returned 0xd20000 [0108.782] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.782] GetProcessHeap () returned 0xd20000 [0108.782] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.782] GetProcessHeap () returned 0xd20000 [0108.782] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.782] GetProcessHeap () returned 0xd20000 [0108.782] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.782] GetProcessHeap () returned 0xd20000 [0108.782] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.782] GetProcessHeap () returned 0xd20000 [0108.782] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.782] GetProcessHeap () returned 0xd20000 [0108.782] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.782] GetProcessHeap () returned 0xd20000 [0108.782] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.783] GetProcessHeap () returned 0xd20000 [0108.783] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.783] GetProcessHeap () returned 0xd20000 [0108.783] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.783] GetProcessHeap () returned 0xd20000 [0108.783] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.783] GetProcessHeap () returned 0xd20000 [0108.783] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.783] GetProcessHeap () returned 0xd20000 [0108.783] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.783] GetProcessHeap () returned 0xd20000 [0108.783] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.783] GetProcessHeap () returned 0xd20000 [0108.783] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.783] GetProcessHeap () returned 0xd20000 [0108.783] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.783] GetProcessHeap () returned 0xd20000 [0108.783] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.783] GetProcessHeap () returned 0xd20000 [0108.783] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.784] GetProcessHeap () returned 0xd20000 [0108.784] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.784] GetProcessHeap () returned 0xd20000 [0108.784] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.784] GetProcessHeap () returned 0xd20000 [0108.784] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.784] GetProcessHeap () returned 0xd20000 [0108.784] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.784] GetProcessHeap () returned 0xd20000 [0108.784] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.784] GetProcessHeap () returned 0xd20000 [0108.784] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.784] GetProcessHeap () returned 0xd20000 [0108.784] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.784] GetProcessHeap () returned 0xd20000 [0108.784] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.784] GetProcessHeap () returned 0xd20000 [0108.784] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.784] GetProcessHeap () returned 0xd20000 [0108.784] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.784] GetProcessHeap () returned 0xd20000 [0108.785] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.785] GetProcessHeap () returned 0xd20000 [0108.785] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.785] GetProcessHeap () returned 0xd20000 [0108.785] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.785] GetProcessHeap () returned 0xd20000 [0108.785] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.785] GetProcessHeap () returned 0xd20000 [0108.785] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.785] GetProcessHeap () returned 0xd20000 [0108.785] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.785] GetProcessHeap () returned 0xd20000 [0108.785] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.785] GetProcessHeap () returned 0xd20000 [0108.785] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.785] GetProcessHeap () returned 0xd20000 [0108.785] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.785] GetProcessHeap () returned 0xd20000 [0108.785] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.785] GetProcessHeap () returned 0xd20000 [0108.785] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.786] GetProcessHeap () returned 0xd20000 [0108.786] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.786] GetProcessHeap () returned 0xd20000 [0108.786] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.786] GetProcessHeap () returned 0xd20000 [0108.786] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.786] GetProcessHeap () returned 0xd20000 [0108.786] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.786] GetProcessHeap () returned 0xd20000 [0108.786] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.786] GetProcessHeap () returned 0xd20000 [0108.786] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.786] GetProcessHeap () returned 0xd20000 [0108.786] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.786] GetProcessHeap () returned 0xd20000 [0108.786] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.786] GetProcessHeap () returned 0xd20000 [0108.786] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.786] GetProcessHeap () returned 0xd20000 [0108.787] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.787] GetProcessHeap () returned 0xd20000 [0108.787] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.787] GetProcessHeap () returned 0xd20000 [0108.787] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.787] GetProcessHeap () returned 0xd20000 [0108.787] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.787] GetProcessHeap () returned 0xd20000 [0108.787] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.787] GetProcessHeap () returned 0xd20000 [0108.787] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.787] GetProcessHeap () returned 0xd20000 [0108.787] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.787] GetProcessHeap () returned 0xd20000 [0108.787] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.787] GetProcessHeap () returned 0xd20000 [0108.787] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.787] GetProcessHeap () returned 0xd20000 [0108.787] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.787] GetProcessHeap () returned 0xd20000 [0108.787] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.788] GetProcessHeap () returned 0xd20000 [0108.788] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.788] GetProcessHeap () returned 0xd20000 [0108.788] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.788] GetProcessHeap () returned 0xd20000 [0108.788] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.788] GetProcessHeap () returned 0xd20000 [0108.788] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.788] GetProcessHeap () returned 0xd20000 [0108.788] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.788] GetProcessHeap () returned 0xd20000 [0108.788] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.788] GetProcessHeap () returned 0xd20000 [0108.788] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.788] GetProcessHeap () returned 0xd20000 [0108.788] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.788] GetProcessHeap () returned 0xd20000 [0108.788] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.788] GetProcessHeap () returned 0xd20000 [0108.788] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.789] GetProcessHeap () returned 0xd20000 [0108.789] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.789] GetProcessHeap () returned 0xd20000 [0108.789] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.789] GetProcessHeap () returned 0xd20000 [0108.789] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.789] GetProcessHeap () returned 0xd20000 [0108.789] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.789] GetProcessHeap () returned 0xd20000 [0108.789] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.790] GetProcessHeap () returned 0xd20000 [0108.790] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.790] GetProcessHeap () returned 0xd20000 [0108.790] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.790] GetProcessHeap () returned 0xd20000 [0108.790] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.790] GetProcessHeap () returned 0xd20000 [0108.790] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.790] GetProcessHeap () returned 0xd20000 [0108.790] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.790] GetProcessHeap () returned 0xd20000 [0108.790] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.790] GetProcessHeap () returned 0xd20000 [0108.790] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.790] GetProcessHeap () returned 0xd20000 [0108.790] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.791] GetProcessHeap () returned 0xd20000 [0108.791] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.791] GetProcessHeap () returned 0xd20000 [0108.791] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.791] GetProcessHeap () returned 0xd20000 [0108.791] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.791] GetProcessHeap () returned 0xd20000 [0108.791] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.791] GetProcessHeap () returned 0xd20000 [0108.791] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.791] GetProcessHeap () returned 0xd20000 [0108.791] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.791] GetProcessHeap () returned 0xd20000 [0108.791] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.791] GetProcessHeap () returned 0xd20000 [0108.791] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.791] GetProcessHeap () returned 0xd20000 [0108.791] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.791] GetProcessHeap () returned 0xd20000 [0108.791] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.791] GetProcessHeap () returned 0xd20000 [0108.792] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.792] GetProcessHeap () returned 0xd20000 [0108.792] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.792] GetProcessHeap () returned 0xd20000 [0108.792] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.792] GetProcessHeap () returned 0xd20000 [0108.792] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.792] GetProcessHeap () returned 0xd20000 [0108.792] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.792] GetProcessHeap () returned 0xd20000 [0108.792] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.792] GetProcessHeap () returned 0xd20000 [0108.792] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.792] GetProcessHeap () returned 0xd20000 [0108.792] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.792] GetProcessHeap () returned 0xd20000 [0108.792] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.792] GetProcessHeap () returned 0xd20000 [0108.792] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.792] GetProcessHeap () returned 0xd20000 [0108.793] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.793] GetProcessHeap () returned 0xd20000 [0108.793] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.793] GetProcessHeap () returned 0xd20000 [0108.793] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.793] GetProcessHeap () returned 0xd20000 [0108.793] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.793] GetProcessHeap () returned 0xd20000 [0108.793] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.793] GetProcessHeap () returned 0xd20000 [0108.793] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.793] GetProcessHeap () returned 0xd20000 [0108.793] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.793] GetProcessHeap () returned 0xd20000 [0108.793] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.793] GetProcessHeap () returned 0xd20000 [0108.793] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.793] GetProcessHeap () returned 0xd20000 [0108.793] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.793] GetProcessHeap () returned 0xd20000 [0108.794] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.794] GetProcessHeap () returned 0xd20000 [0108.794] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.794] GetProcessHeap () returned 0xd20000 [0108.794] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.794] GetProcessHeap () returned 0xd20000 [0108.794] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.794] GetProcessHeap () returned 0xd20000 [0108.794] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0108.794] GetProcessHeap () returned 0xd20000 [0108.794] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0108.794] GetProcessHeap () returned 0xd20000 [0108.794] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0108.794] GetProcessHeap () returned 0xd20000 [0108.794] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0108.794] GetProcessHeap () returned 0xd20000 [0108.794] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44588 | out: hHeap=0xd20000) returned 1 [0108.794] GetProcessHeap () returned 0xd20000 [0108.794] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0108.794] GetProcessHeap () returned 0xd20000 [0108.795] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0108.795] GetProcessHeap () returned 0xd20000 [0108.795] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0108.795] GetProcessHeap () returned 0xd20000 [0108.795] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0108.795] GetProcessHeap () returned 0xd20000 [0108.795] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.795] GetProcessHeap () returned 0xd20000 [0108.795] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0108.795] WriteFile (in: hFile=0x230, lpBuffer=0xd4f498*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f498*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0108.798] GetProcessHeap () returned 0xd20000 [0108.798] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4f498, Size=0x30) returned 0xd4f498 [0108.798] GetProcessHeap () returned 0xd20000 [0108.798] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0108.798] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0108.798] GetProcessHeap () returned 0xd20000 [0108.798] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xeec8) returned 0xd4f4d0 [0108.800] ReadFile (in: hFile=0x230, lpBuffer=0xd4f4d0, nNumberOfBytesToRead=0xeec8, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4f4d0*, lpNumberOfBytesRead=0x299d7e8*=0xeec8, lpOverlapped=0x0) returned 1 [0108.801] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0108.802] WriteFile (in: hFile=0x230, lpBuffer=0xd4f4d0*, nNumberOfBytesToWrite=0xeec8, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4f4d0*, lpNumberOfBytesWritten=0x299d7e4*=0xeec8, lpOverlapped=0x0) returned 1 [0108.804] GetProcessHeap () returned 0xd20000 [0108.804] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4f4d0 | out: hHeap=0xd20000) returned 1 [0108.804] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0108.804] WriteFile (in: hFile=0x230, lpBuffer=0xd4f498*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f498*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0108.806] CloseHandle (hObject=0x230) returned 1 [0108.809] GetProcessHeap () returned 0xd20000 [0108.809] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd425a8 | out: hHeap=0xd20000) returned 1 [0108.809] GetProcessHeap () returned 0xd20000 [0108.809] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bcb0 | out: hHeap=0xd20000) returned 1 [0108.810] GetProcessHeap () returned 0xd20000 [0108.810] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0108.810] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\6ePuVA3oz90AMsog.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\6ePuVA3oz90AMsog.gif") returned="C:\\Users\\FD1HVy\\Pictures\\6ePuVA3oz90AMsog.gif" [0108.810] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\6ePuVA3oz90AMsog.gif", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\6ePuVA3oz90AMsog.gif.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Pictures\\6ePuVA3oz90AMsog.gif.[ponce.lorena@aol.com]" [0108.810] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\6ePuVA3oz90AMsog.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\6epuva3oz90amsog.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\6ePuVA3oz90AMsog.gif.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\pictures\\6epuva3oz90amsog.gif.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0108.811] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\6ePuVA3oz90AMsog.gif" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0108.811] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0108.811] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html" [0108.811] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_recover.html")) returned 0x20 [0108.811] GetProcessHeap () returned 0xd20000 [0108.811] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36568 | out: hHeap=0xd20000) returned 1 [0108.811] FindNextFileW (in: hFindFile=0xd49120, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc92641b0, ftCreationTime.dwHighDateTime=0x1d4d3a1, ftLastAccessTime.dwLowDateTime=0xa9607880, ftLastAccessTime.dwHighDateTime=0x1d4cd95, ftLastWriteTime.dwLowDateTime=0xa9607880, ftLastWriteTime.dwHighDateTime=0x1d4cd95, nFileSizeHigh=0x0, nFileSizeLow=0x9581, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="865afvOF v-P.bmp", cAlternateFileName="865AFV~1.BMP")) returned 1 [0108.811] lstrcmpiW (lpString1="865afvOF v-P.bmp", lpString2=".") returned 1 [0108.811] lstrcmpiW (lpString1="865afvOF v-P.bmp", lpString2="..") returned 1 [0108.811] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="865afvOF v-P.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\865afvOF v-P.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\865afvOF v-P.bmp" [0108.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="865afvOF v-P.bmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0108.811] GetProcessHeap () returned 0xd20000 [0108.811] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x11) returned 0xd36568 [0108.811] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="865afvOF v-P.bmp", cchWideChar=-1, lpMultiByteStr=0xd36568, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="865afvOF v-P.bmp", lpUsedDefaultChar=0x0) returned 17 [0108.811] lstrlenA (lpString="865afvOF v-P.bmp") returned 16 [0108.811] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0108.811] lstrlenA (lpString="865afvOF v-P.bmp") returned 16 [0108.811] lstrlenA (lpString=".dll") returned 4 [0108.812] lstrlenA (lpString=".dll") returned 4 [0108.812] lstrlenA (lpString="865afvOF v-P.bmp") returned 16 [0108.812] lstrcmpiA (lpString1=".bmp", lpString2=".dll") returned -1 [0108.812] lstrlenA (lpString="865afvOF v-P.bmp") returned 16 [0108.812] lstrlenA (lpString=".ini") returned 4 [0108.812] lstrlenA (lpString=".ini") returned 4 [0108.812] lstrlenA (lpString="865afvOF v-P.bmp") returned 16 [0108.812] lstrcmpiA (lpString1=".bmp", lpString2=".ini") returned -1 [0108.812] lstrlenA (lpString="865afvOF v-P.bmp") returned 16 [0108.812] lstrlenA (lpString=".inc") returned 4 [0108.812] lstrlenA (lpString=".inc") returned 4 [0108.812] lstrlenA (lpString="865afvOF v-P.bmp") returned 16 [0108.812] lstrcmpiA (lpString1=".bmp", lpString2=".inc") returned -1 [0108.812] lstrcmpiW (lpString1="865afvOF v-P.bmp", lpString2="HOW_RECOVER.html") returned -1 [0108.812] lstrcmpiW (lpString1="865afvOF v-P.bmp", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0108.812] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0108.812] lstrcmpiW (lpString1="865afvOF v-P.bmp", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0108.812] GetProcessHeap () returned 0xd20000 [0108.812] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42530 [0108.812] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\865afvOF v-P.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\865afvof v-p.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0108.813] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=38273) returned 1 [0108.813] GetProcessHeap () returned 0xd20000 [0108.813] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c160 [0108.813] GetProcessHeap () returned 0xd20000 [0108.813] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0108.813] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\865afvOF v-P.bmp") returned 41 [0108.813] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0108.813] GetProcessHeap () returned 0xd20000 [0108.813] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0108.813] GetProcessHeap () returned 0xd20000 [0108.813] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x38f) returned 0xd4f4d0 [0108.813] lstrlenA (lpString="rsa_encrypt") returned 11 [0108.813] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0108.817] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0108.817] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0108.817] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0108.817] GetProcessHeap () returned 0xd20000 [0108.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0108.817] lstrlenA (lpString="010001") returned 6 [0108.817] GetProcessHeap () returned 0xd20000 [0108.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc18 [0108.817] GetProcessHeap () returned 0xd20000 [0108.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0108.817] GetProcessHeap () returned 0xd20000 [0108.817] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b638 [0108.818] GetProcessHeap () returned 0xd20000 [0108.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0108.818] GetProcessHeap () returned 0xd20000 [0108.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aee8 [0108.818] GetProcessHeap () returned 0xd20000 [0108.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44b50 [0108.818] GetProcessHeap () returned 0xd20000 [0108.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc48 [0108.818] GetProcessHeap () returned 0xd20000 [0108.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0108.818] GetProcessHeap () returned 0xd20000 [0108.818] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.818] GetProcessHeap () returned 0xd20000 [0108.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44808 [0108.818] GetProcessHeap () returned 0xd20000 [0108.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0108.818] GetProcessHeap () returned 0xd20000 [0108.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44fb0 [0108.818] GetProcessHeap () returned 0xd20000 [0108.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.818] GetProcessHeap () returned 0xd20000 [0108.818] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44618 [0108.819] GetProcessHeap () returned 0xd20000 [0108.819] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b2d8 [0108.819] GetProcessHeap () returned 0xd20000 [0108.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0108.819] GetProcessHeap () returned 0xd20000 [0108.819] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0108.819] GetProcessHeap () returned 0xd20000 [0108.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b2d8 | out: hHeap=0xd20000) returned 1 [0108.819] GetProcessHeap () returned 0xd20000 [0108.819] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.819] GetProcessHeap () returned 0xd20000 [0108.819] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44498 [0108.819] GetProcessHeap () returned 0xd20000 [0108.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.819] GetProcessHeap () returned 0xd20000 [0108.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.819] GetProcessHeap () returned 0xd20000 [0108.819] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.819] GetProcessHeap () returned 0xd20000 [0108.819] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.819] GetProcessHeap () returned 0xd20000 [0108.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.820] GetProcessHeap () returned 0xd20000 [0108.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.820] GetProcessHeap () returned 0xd20000 [0108.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b878 [0108.820] GetProcessHeap () returned 0xd20000 [0108.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44498 | out: hHeap=0xd20000) returned 1 [0108.820] GetProcessHeap () returned 0xd20000 [0108.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0108.820] GetProcessHeap () returned 0xd20000 [0108.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b878 | out: hHeap=0xd20000) returned 1 [0108.820] GetProcessHeap () returned 0xd20000 [0108.820] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.820] GetProcessHeap () returned 0xd20000 [0108.820] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.821] GetProcessHeap () returned 0xd20000 [0108.821] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.821] GetProcessHeap () returned 0xd20000 [0108.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.821] GetProcessHeap () returned 0xd20000 [0108.821] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.821] GetProcessHeap () returned 0xd20000 [0108.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.821] GetProcessHeap () returned 0xd20000 [0108.821] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.821] GetProcessHeap () returned 0xd20000 [0108.821] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.821] GetProcessHeap () returned 0xd20000 [0108.822] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.822] GetProcessHeap () returned 0xd20000 [0108.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.822] GetProcessHeap () returned 0xd20000 [0108.822] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.822] GetProcessHeap () returned 0xd20000 [0108.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.822] GetProcessHeap () returned 0xd20000 [0108.822] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.822] GetProcessHeap () returned 0xd20000 [0108.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.822] GetProcessHeap () returned 0xd20000 [0108.822] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.822] GetProcessHeap () returned 0xd20000 [0108.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.822] GetProcessHeap () returned 0xd20000 [0108.822] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.822] GetProcessHeap () returned 0xd20000 [0108.822] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.822] GetProcessHeap () returned 0xd20000 [0108.822] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.823] GetProcessHeap () returned 0xd20000 [0108.823] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.823] GetProcessHeap () returned 0xd20000 [0108.823] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.823] GetProcessHeap () returned 0xd20000 [0108.823] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.823] GetProcessHeap () returned 0xd20000 [0108.823] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.823] GetProcessHeap () returned 0xd20000 [0108.823] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.823] GetProcessHeap () returned 0xd20000 [0108.823] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.823] GetProcessHeap () returned 0xd20000 [0108.823] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.823] GetProcessHeap () returned 0xd20000 [0108.823] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.823] GetProcessHeap () returned 0xd20000 [0108.823] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.823] GetProcessHeap () returned 0xd20000 [0108.823] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.823] GetProcessHeap () returned 0xd20000 [0108.824] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.824] GetProcessHeap () returned 0xd20000 [0108.824] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.824] GetProcessHeap () returned 0xd20000 [0108.824] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.824] GetProcessHeap () returned 0xd20000 [0108.824] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.824] GetProcessHeap () returned 0xd20000 [0108.824] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.824] GetProcessHeap () returned 0xd20000 [0108.824] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.824] GetProcessHeap () returned 0xd20000 [0108.824] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.824] GetProcessHeap () returned 0xd20000 [0108.824] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.824] GetProcessHeap () returned 0xd20000 [0108.824] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.824] GetProcessHeap () returned 0xd20000 [0108.824] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.824] GetProcessHeap () returned 0xd20000 [0108.824] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.824] GetProcessHeap () returned 0xd20000 [0108.825] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.825] GetProcessHeap () returned 0xd20000 [0108.825] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.825] GetProcessHeap () returned 0xd20000 [0108.825] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.825] GetProcessHeap () returned 0xd20000 [0108.825] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.825] GetProcessHeap () returned 0xd20000 [0108.825] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.825] GetProcessHeap () returned 0xd20000 [0108.825] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.825] GetProcessHeap () returned 0xd20000 [0108.825] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.825] GetProcessHeap () returned 0xd20000 [0108.825] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.825] GetProcessHeap () returned 0xd20000 [0108.825] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.825] GetProcessHeap () returned 0xd20000 [0108.825] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.825] GetProcessHeap () returned 0xd20000 [0108.825] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.826] GetProcessHeap () returned 0xd20000 [0108.826] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.826] GetProcessHeap () returned 0xd20000 [0108.826] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.826] GetProcessHeap () returned 0xd20000 [0108.826] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.826] GetProcessHeap () returned 0xd20000 [0108.826] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.826] GetProcessHeap () returned 0xd20000 [0108.826] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.826] GetProcessHeap () returned 0xd20000 [0108.826] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.826] GetProcessHeap () returned 0xd20000 [0108.826] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.826] GetProcessHeap () returned 0xd20000 [0108.826] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.826] GetProcessHeap () returned 0xd20000 [0108.826] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.826] GetProcessHeap () returned 0xd20000 [0108.826] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.826] GetProcessHeap () returned 0xd20000 [0108.827] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.827] GetProcessHeap () returned 0xd20000 [0108.827] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.827] GetProcessHeap () returned 0xd20000 [0108.827] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.827] GetProcessHeap () returned 0xd20000 [0108.827] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.827] GetProcessHeap () returned 0xd20000 [0108.827] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.827] GetProcessHeap () returned 0xd20000 [0108.827] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.827] GetProcessHeap () returned 0xd20000 [0108.827] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.827] GetProcessHeap () returned 0xd20000 [0108.827] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.827] GetProcessHeap () returned 0xd20000 [0108.827] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.827] GetProcessHeap () returned 0xd20000 [0108.827] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.827] GetProcessHeap () returned 0xd20000 [0108.827] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.827] GetProcessHeap () returned 0xd20000 [0108.828] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.828] GetProcessHeap () returned 0xd20000 [0108.828] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.828] GetProcessHeap () returned 0xd20000 [0108.828] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.828] GetProcessHeap () returned 0xd20000 [0108.828] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.828] GetProcessHeap () returned 0xd20000 [0108.828] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.828] GetProcessHeap () returned 0xd20000 [0108.828] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.828] GetProcessHeap () returned 0xd20000 [0108.828] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.828] GetProcessHeap () returned 0xd20000 [0108.828] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.828] GetProcessHeap () returned 0xd20000 [0108.828] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.828] GetProcessHeap () returned 0xd20000 [0108.828] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.828] GetProcessHeap () returned 0xd20000 [0108.828] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.828] GetProcessHeap () returned 0xd20000 [0108.829] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.829] GetProcessHeap () returned 0xd20000 [0108.829] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.829] GetProcessHeap () returned 0xd20000 [0108.829] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.829] GetProcessHeap () returned 0xd20000 [0108.829] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.829] GetProcessHeap () returned 0xd20000 [0108.829] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.829] GetProcessHeap () returned 0xd20000 [0108.829] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.829] GetProcessHeap () returned 0xd20000 [0108.829] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.829] GetProcessHeap () returned 0xd20000 [0108.829] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.829] GetProcessHeap () returned 0xd20000 [0108.829] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.829] GetProcessHeap () returned 0xd20000 [0108.829] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.829] GetProcessHeap () returned 0xd20000 [0108.829] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.829] GetProcessHeap () returned 0xd20000 [0108.830] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.830] GetProcessHeap () returned 0xd20000 [0108.830] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.830] GetProcessHeap () returned 0xd20000 [0108.830] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.830] GetProcessHeap () returned 0xd20000 [0108.830] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.830] GetProcessHeap () returned 0xd20000 [0108.830] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.830] GetProcessHeap () returned 0xd20000 [0108.830] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.830] GetProcessHeap () returned 0xd20000 [0108.830] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.830] GetProcessHeap () returned 0xd20000 [0108.830] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.830] GetProcessHeap () returned 0xd20000 [0108.830] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.830] GetProcessHeap () returned 0xd20000 [0108.830] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.830] GetProcessHeap () returned 0xd20000 [0108.830] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.831] GetProcessHeap () returned 0xd20000 [0108.831] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.831] GetProcessHeap () returned 0xd20000 [0108.831] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.831] GetProcessHeap () returned 0xd20000 [0108.831] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.831] GetProcessHeap () returned 0xd20000 [0108.831] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.831] GetProcessHeap () returned 0xd20000 [0108.831] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.831] GetProcessHeap () returned 0xd20000 [0108.831] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.831] GetProcessHeap () returned 0xd20000 [0108.831] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.831] GetProcessHeap () returned 0xd20000 [0108.831] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.831] GetProcessHeap () returned 0xd20000 [0108.831] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.831] GetProcessHeap () returned 0xd20000 [0108.831] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.831] GetProcessHeap () returned 0xd20000 [0108.831] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.832] GetProcessHeap () returned 0xd20000 [0108.832] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.832] GetProcessHeap () returned 0xd20000 [0108.832] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.832] GetProcessHeap () returned 0xd20000 [0108.832] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.832] GetProcessHeap () returned 0xd20000 [0108.832] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.832] GetProcessHeap () returned 0xd20000 [0108.832] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.832] GetProcessHeap () returned 0xd20000 [0108.832] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.832] GetProcessHeap () returned 0xd20000 [0108.832] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.832] GetProcessHeap () returned 0xd20000 [0108.832] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.832] GetProcessHeap () returned 0xd20000 [0108.832] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.832] GetProcessHeap () returned 0xd20000 [0108.832] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.832] GetProcessHeap () returned 0xd20000 [0108.832] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.833] GetProcessHeap () returned 0xd20000 [0108.833] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.833] GetProcessHeap () returned 0xd20000 [0108.833] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.833] GetProcessHeap () returned 0xd20000 [0108.833] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.833] GetProcessHeap () returned 0xd20000 [0108.833] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.833] GetProcessHeap () returned 0xd20000 [0108.833] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.833] GetProcessHeap () returned 0xd20000 [0108.833] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.833] GetProcessHeap () returned 0xd20000 [0108.833] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.833] GetProcessHeap () returned 0xd20000 [0108.833] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.833] GetProcessHeap () returned 0xd20000 [0108.833] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.833] GetProcessHeap () returned 0xd20000 [0108.833] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.833] GetProcessHeap () returned 0xd20000 [0108.834] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.834] GetProcessHeap () returned 0xd20000 [0108.834] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.834] GetProcessHeap () returned 0xd20000 [0108.834] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.834] GetProcessHeap () returned 0xd20000 [0108.834] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.834] GetProcessHeap () returned 0xd20000 [0108.834] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.834] GetProcessHeap () returned 0xd20000 [0108.834] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.834] GetProcessHeap () returned 0xd20000 [0108.834] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.834] GetProcessHeap () returned 0xd20000 [0108.834] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.834] GetProcessHeap () returned 0xd20000 [0108.834] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.834] GetProcessHeap () returned 0xd20000 [0108.834] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.834] GetProcessHeap () returned 0xd20000 [0108.834] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.834] GetProcessHeap () returned 0xd20000 [0108.835] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.835] GetProcessHeap () returned 0xd20000 [0108.835] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.835] GetProcessHeap () returned 0xd20000 [0108.835] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.835] GetProcessHeap () returned 0xd20000 [0108.835] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.835] GetProcessHeap () returned 0xd20000 [0108.835] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.835] GetProcessHeap () returned 0xd20000 [0108.835] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.835] GetProcessHeap () returned 0xd20000 [0108.835] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.835] GetProcessHeap () returned 0xd20000 [0108.835] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.835] GetProcessHeap () returned 0xd20000 [0108.835] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.835] GetProcessHeap () returned 0xd20000 [0108.835] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.835] GetProcessHeap () returned 0xd20000 [0108.835] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.836] GetProcessHeap () returned 0xd20000 [0108.836] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.836] GetProcessHeap () returned 0xd20000 [0108.836] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.836] GetProcessHeap () returned 0xd20000 [0108.836] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.836] GetProcessHeap () returned 0xd20000 [0108.836] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.837] GetProcessHeap () returned 0xd20000 [0108.837] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.837] GetProcessHeap () returned 0xd20000 [0108.837] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.837] GetProcessHeap () returned 0xd20000 [0108.837] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.837] GetProcessHeap () returned 0xd20000 [0108.837] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.837] GetProcessHeap () returned 0xd20000 [0108.838] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.838] GetProcessHeap () returned 0xd20000 [0108.838] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.838] GetProcessHeap () returned 0xd20000 [0108.838] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.838] GetProcessHeap () returned 0xd20000 [0108.838] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0108.838] GetProcessHeap () returned 0xd20000 [0108.838] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0108.838] GetProcessHeap () returned 0xd20000 [0108.838] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0108.838] GetProcessHeap () returned 0xd20000 [0108.838] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0108.838] GetProcessHeap () returned 0xd20000 [0108.838] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44618 | out: hHeap=0xd20000) returned 1 [0108.838] GetProcessHeap () returned 0xd20000 [0108.838] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aee8 | out: hHeap=0xd20000) returned 1 [0108.838] GetProcessHeap () returned 0xd20000 [0108.838] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0108.838] GetProcessHeap () returned 0xd20000 [0108.838] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b638 | out: hHeap=0xd20000) returned 1 [0108.839] GetProcessHeap () returned 0xd20000 [0108.839] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0108.839] GetProcessHeap () returned 0xd20000 [0108.839] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.839] GetProcessHeap () returned 0xd20000 [0108.839] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0108.839] WriteFile (in: hFile=0x230, lpBuffer=0xd4f4d0*, nNumberOfBytesToWrite=0x38f, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f4d0*, lpNumberOfBytesWritten=0x299d864*=0x38f, lpOverlapped=0x0) returned 1 [0108.842] GetProcessHeap () returned 0xd20000 [0108.842] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4f4d0, Size=0x30) returned 0xd4f4d0 [0108.842] GetProcessHeap () returned 0xd20000 [0108.842] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0108.842] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0108.842] GetProcessHeap () returned 0xd20000 [0108.842] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x9590) returned 0xd4f508 [0108.842] ReadFile (in: hFile=0x230, lpBuffer=0xd4f508, nNumberOfBytesToRead=0x9590, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4f508*, lpNumberOfBytesRead=0x299d7e8*=0x9590, lpOverlapped=0x0) returned 1 [0108.843] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0108.843] WriteFile (in: hFile=0x230, lpBuffer=0xd4f508*, nNumberOfBytesToWrite=0x9590, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4f508*, lpNumberOfBytesWritten=0x299d7e4*=0x9590, lpOverlapped=0x0) returned 1 [0108.845] GetProcessHeap () returned 0xd20000 [0108.845] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4f508 | out: hHeap=0xd20000) returned 1 [0108.845] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0108.845] WriteFile (in: hFile=0x230, lpBuffer=0xd4f4d0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f4d0*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0108.846] CloseHandle (hObject=0x230) returned 1 [0108.849] GetProcessHeap () returned 0xd20000 [0108.849] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42530 | out: hHeap=0xd20000) returned 1 [0108.849] GetProcessHeap () returned 0xd20000 [0108.849] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c160 | out: hHeap=0xd20000) returned 1 [0108.849] GetProcessHeap () returned 0xd20000 [0108.849] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0108.849] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\865afvOF v-P.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\865afvOF v-P.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\865afvOF v-P.bmp" [0108.849] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\865afvOF v-P.bmp", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\865afvOF v-P.bmp.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Pictures\\865afvOF v-P.bmp.[ponce.lorena@aol.com]" [0108.850] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\865afvOF v-P.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\865afvof v-p.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\865afvOF v-P.bmp.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\pictures\\865afvof v-p.bmp.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0108.850] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\865afvOF v-P.bmp" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0108.850] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0108.850] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html" [0108.850] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_recover.html")) returned 0x20 [0108.851] GetProcessHeap () returned 0xd20000 [0108.851] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd36568 | out: hHeap=0xd20000) returned 1 [0108.851] FindNextFileW (in: hFindFile=0xd49120, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba5b6fa0, ftCreationTime.dwHighDateTime=0x1d4ca61, ftLastAccessTime.dwLowDateTime=0xca556e20, ftLastAccessTime.dwHighDateTime=0x1d4cbe6, ftLastWriteTime.dwLowDateTime=0xca556e20, ftLastWriteTime.dwHighDateTime=0x1d4cbe6, nFileSizeHigh=0x0, nFileSizeLow=0x5d87, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="a-ZoISjGYopr.jpg", cAlternateFileName="A-ZOIS~1.JPG")) returned 1 [0108.851] lstrcmpiW (lpString1="a-ZoISjGYopr.jpg", lpString2=".") returned 1 [0108.851] lstrcmpiW (lpString1="a-ZoISjGYopr.jpg", lpString2="..") returned 1 [0108.851] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="a-ZoISjGYopr.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\a-ZoISjGYopr.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\a-ZoISjGYopr.jpg" [0108.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="a-ZoISjGYopr.jpg", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0108.851] GetProcessHeap () returned 0xd20000 [0108.851] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x11) returned 0xd366c8 [0108.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="a-ZoISjGYopr.jpg", cchWideChar=-1, lpMultiByteStr=0xd366c8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="a-ZoISjGYopr.jpg", lpUsedDefaultChar=0x0) returned 17 [0108.851] lstrlenA (lpString="a-ZoISjGYopr.jpg") returned 16 [0108.851] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0108.851] lstrlenA (lpString="a-ZoISjGYopr.jpg") returned 16 [0108.851] lstrlenA (lpString=".dll") returned 4 [0108.851] lstrlenA (lpString=".dll") returned 4 [0108.851] lstrlenA (lpString="a-ZoISjGYopr.jpg") returned 16 [0108.851] lstrcmpiA (lpString1=".jpg", lpString2=".dll") returned 1 [0108.852] lstrlenA (lpString="a-ZoISjGYopr.jpg") returned 16 [0108.852] lstrlenA (lpString=".ini") returned 4 [0108.852] lstrlenA (lpString=".ini") returned 4 [0108.852] lstrlenA (lpString="a-ZoISjGYopr.jpg") returned 16 [0108.852] lstrcmpiA (lpString1=".jpg", lpString2=".ini") returned 1 [0108.852] lstrlenA (lpString="a-ZoISjGYopr.jpg") returned 16 [0108.852] lstrlenA (lpString=".inc") returned 4 [0108.852] lstrlenA (lpString=".inc") returned 4 [0108.852] lstrlenA (lpString="a-ZoISjGYopr.jpg") returned 16 [0108.852] lstrcmpiA (lpString1=".jpg", lpString2=".inc") returned 1 [0108.853] lstrcmpiW (lpString1="a-ZoISjGYopr.jpg", lpString2="HOW_RECOVER.html") returned -1 [0108.853] lstrcmpiW (lpString1="a-ZoISjGYopr.jpg", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0108.853] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0108.853] lstrcmpiW (lpString1="a-ZoISjGYopr.jpg", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0108.853] GetProcessHeap () returned 0xd20000 [0108.853] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd426c0 [0108.853] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\a-ZoISjGYopr.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\a-zoisjgyopr.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0108.853] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=23943) returned 1 [0108.853] GetProcessHeap () returned 0xd20000 [0108.853] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bf80 [0108.853] GetProcessHeap () returned 0xd20000 [0108.853] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0108.853] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\a-ZoISjGYopr.jpg") returned 41 [0108.853] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0108.854] GetProcessHeap () returned 0xd20000 [0108.854] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0108.854] GetProcessHeap () returned 0xd20000 [0108.854] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x389) returned 0xd4f508 [0108.854] lstrlenA (lpString="rsa_encrypt") returned 11 [0108.854] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0108.856] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0108.857] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0108.857] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0108.857] GetProcessHeap () returned 0xd20000 [0108.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0108.857] lstrlenA (lpString="010001") returned 6 [0108.857] GetProcessHeap () returned 0xd20000 [0108.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc48 [0108.857] GetProcessHeap () returned 0xd20000 [0108.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0108.857] GetProcessHeap () returned 0xd20000 [0108.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ad38 [0108.857] GetProcessHeap () returned 0xd20000 [0108.857] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0108.857] GetProcessHeap () returned 0xd20000 [0108.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b6c8 [0108.857] GetProcessHeap () returned 0xd20000 [0108.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd45410 [0108.857] GetProcessHeap () returned 0xd20000 [0108.857] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc18 [0108.858] GetProcessHeap () returned 0xd20000 [0108.858] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0108.858] GetProcessHeap () returned 0xd20000 [0108.858] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.858] GetProcessHeap () returned 0xd20000 [0108.858] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0108.858] GetProcessHeap () returned 0xd20000 [0108.858] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0108.858] GetProcessHeap () returned 0xd20000 [0108.858] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd451e0 [0108.858] GetProcessHeap () returned 0xd20000 [0108.858] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.858] GetProcessHeap () returned 0xd20000 [0108.858] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44588 [0108.858] GetProcessHeap () returned 0xd20000 [0108.858] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4adc8 [0108.858] GetProcessHeap () returned 0xd20000 [0108.858] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0108.858] GetProcessHeap () returned 0xd20000 [0108.858] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0108.858] GetProcessHeap () returned 0xd20000 [0108.859] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4adc8 | out: hHeap=0xd20000) returned 1 [0108.859] GetProcessHeap () returned 0xd20000 [0108.859] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.859] GetProcessHeap () returned 0xd20000 [0108.859] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44528 [0108.859] GetProcessHeap () returned 0xd20000 [0108.859] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.859] GetProcessHeap () returned 0xd20000 [0108.859] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.859] GetProcessHeap () returned 0xd20000 [0108.859] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.859] GetProcessHeap () returned 0xd20000 [0108.859] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.859] GetProcessHeap () returned 0xd20000 [0108.859] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.859] GetProcessHeap () returned 0xd20000 [0108.859] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.859] GetProcessHeap () returned 0xd20000 [0108.859] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4adc8 [0108.859] GetProcessHeap () returned 0xd20000 [0108.859] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44528 | out: hHeap=0xd20000) returned 1 [0108.860] GetProcessHeap () returned 0xd20000 [0108.860] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44b50 [0108.860] GetProcessHeap () returned 0xd20000 [0108.860] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4adc8 | out: hHeap=0xd20000) returned 1 [0108.860] GetProcessHeap () returned 0xd20000 [0108.860] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.860] GetProcessHeap () returned 0xd20000 [0108.860] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.860] GetProcessHeap () returned 0xd20000 [0108.860] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.860] GetProcessHeap () returned 0xd20000 [0108.860] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.860] GetProcessHeap () returned 0xd20000 [0108.860] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.860] GetProcessHeap () returned 0xd20000 [0108.860] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.860] GetProcessHeap () returned 0xd20000 [0108.860] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.860] GetProcessHeap () returned 0xd20000 [0108.860] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.861] GetProcessHeap () returned 0xd20000 [0108.861] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.861] GetProcessHeap () returned 0xd20000 [0108.861] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.861] GetProcessHeap () returned 0xd20000 [0108.861] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.861] GetProcessHeap () returned 0xd20000 [0108.861] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.861] GetProcessHeap () returned 0xd20000 [0108.861] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.861] GetProcessHeap () returned 0xd20000 [0108.861] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.861] GetProcessHeap () returned 0xd20000 [0108.861] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.861] GetProcessHeap () returned 0xd20000 [0108.861] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.861] GetProcessHeap () returned 0xd20000 [0108.861] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.861] GetProcessHeap () returned 0xd20000 [0108.861] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.861] GetProcessHeap () returned 0xd20000 [0108.861] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.862] GetProcessHeap () returned 0xd20000 [0108.862] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.862] GetProcessHeap () returned 0xd20000 [0108.862] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.862] GetProcessHeap () returned 0xd20000 [0108.862] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.862] GetProcessHeap () returned 0xd20000 [0108.862] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.862] GetProcessHeap () returned 0xd20000 [0108.862] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.862] GetProcessHeap () returned 0xd20000 [0108.862] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.862] GetProcessHeap () returned 0xd20000 [0108.862] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.862] GetProcessHeap () returned 0xd20000 [0108.862] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.862] GetProcessHeap () returned 0xd20000 [0108.862] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.862] GetProcessHeap () returned 0xd20000 [0108.862] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.863] GetProcessHeap () returned 0xd20000 [0108.863] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.863] GetProcessHeap () returned 0xd20000 [0108.863] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.863] GetProcessHeap () returned 0xd20000 [0108.863] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.863] GetProcessHeap () returned 0xd20000 [0108.863] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.863] GetProcessHeap () returned 0xd20000 [0108.863] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.863] GetProcessHeap () returned 0xd20000 [0108.863] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.863] GetProcessHeap () returned 0xd20000 [0108.863] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.863] GetProcessHeap () returned 0xd20000 [0108.863] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.863] GetProcessHeap () returned 0xd20000 [0108.863] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.863] GetProcessHeap () returned 0xd20000 [0108.863] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.864] GetProcessHeap () returned 0xd20000 [0108.864] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.864] GetProcessHeap () returned 0xd20000 [0108.864] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.864] GetProcessHeap () returned 0xd20000 [0108.864] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.864] GetProcessHeap () returned 0xd20000 [0108.864] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.864] GetProcessHeap () returned 0xd20000 [0108.864] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.864] GetProcessHeap () returned 0xd20000 [0108.864] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.864] GetProcessHeap () returned 0xd20000 [0108.864] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.864] GetProcessHeap () returned 0xd20000 [0108.864] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.864] GetProcessHeap () returned 0xd20000 [0108.864] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.864] GetProcessHeap () returned 0xd20000 [0108.864] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.865] GetProcessHeap () returned 0xd20000 [0108.865] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.865] GetProcessHeap () returned 0xd20000 [0108.865] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.865] GetProcessHeap () returned 0xd20000 [0108.865] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.865] GetProcessHeap () returned 0xd20000 [0108.865] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.865] GetProcessHeap () returned 0xd20000 [0108.865] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.865] GetProcessHeap () returned 0xd20000 [0108.865] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.865] GetProcessHeap () returned 0xd20000 [0108.865] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.865] GetProcessHeap () returned 0xd20000 [0108.865] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.865] GetProcessHeap () returned 0xd20000 [0108.865] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.865] GetProcessHeap () returned 0xd20000 [0108.865] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.865] GetProcessHeap () returned 0xd20000 [0108.866] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.866] GetProcessHeap () returned 0xd20000 [0108.866] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.866] GetProcessHeap () returned 0xd20000 [0108.866] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.866] GetProcessHeap () returned 0xd20000 [0108.866] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.866] GetProcessHeap () returned 0xd20000 [0108.866] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.866] GetProcessHeap () returned 0xd20000 [0108.866] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.866] GetProcessHeap () returned 0xd20000 [0108.866] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.866] GetProcessHeap () returned 0xd20000 [0108.866] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.866] GetProcessHeap () returned 0xd20000 [0108.866] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.866] GetProcessHeap () returned 0xd20000 [0108.866] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.866] GetProcessHeap () returned 0xd20000 [0108.866] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.867] GetProcessHeap () returned 0xd20000 [0108.867] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.867] GetProcessHeap () returned 0xd20000 [0108.867] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.867] GetProcessHeap () returned 0xd20000 [0108.867] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.867] GetProcessHeap () returned 0xd20000 [0108.867] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.867] GetProcessHeap () returned 0xd20000 [0108.867] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.867] GetProcessHeap () returned 0xd20000 [0108.867] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.868] GetProcessHeap () returned 0xd20000 [0108.868] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.868] GetProcessHeap () returned 0xd20000 [0108.868] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.868] GetProcessHeap () returned 0xd20000 [0108.868] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.868] GetProcessHeap () returned 0xd20000 [0108.868] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.868] GetProcessHeap () returned 0xd20000 [0108.868] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.868] GetProcessHeap () returned 0xd20000 [0108.868] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.868] GetProcessHeap () returned 0xd20000 [0108.868] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.868] GetProcessHeap () returned 0xd20000 [0108.868] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.868] GetProcessHeap () returned 0xd20000 [0108.868] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.868] GetProcessHeap () returned 0xd20000 [0108.868] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.869] GetProcessHeap () returned 0xd20000 [0108.869] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.869] GetProcessHeap () returned 0xd20000 [0108.869] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.869] GetProcessHeap () returned 0xd20000 [0108.869] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.869] GetProcessHeap () returned 0xd20000 [0108.869] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.869] GetProcessHeap () returned 0xd20000 [0108.869] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.869] GetProcessHeap () returned 0xd20000 [0108.869] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.869] GetProcessHeap () returned 0xd20000 [0108.869] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.869] GetProcessHeap () returned 0xd20000 [0108.869] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.869] GetProcessHeap () returned 0xd20000 [0108.869] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.869] GetProcessHeap () returned 0xd20000 [0108.869] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.870] GetProcessHeap () returned 0xd20000 [0108.870] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.870] GetProcessHeap () returned 0xd20000 [0108.870] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.870] GetProcessHeap () returned 0xd20000 [0108.870] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.870] GetProcessHeap () returned 0xd20000 [0108.870] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.870] GetProcessHeap () returned 0xd20000 [0108.870] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.870] GetProcessHeap () returned 0xd20000 [0108.870] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.870] GetProcessHeap () returned 0xd20000 [0108.870] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.870] GetProcessHeap () returned 0xd20000 [0108.870] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.870] GetProcessHeap () returned 0xd20000 [0108.870] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.870] GetProcessHeap () returned 0xd20000 [0108.870] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.871] GetProcessHeap () returned 0xd20000 [0108.871] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.871] GetProcessHeap () returned 0xd20000 [0108.871] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.871] GetProcessHeap () returned 0xd20000 [0108.871] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.871] GetProcessHeap () returned 0xd20000 [0108.871] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.871] GetProcessHeap () returned 0xd20000 [0108.871] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.871] GetProcessHeap () returned 0xd20000 [0108.871] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.871] GetProcessHeap () returned 0xd20000 [0108.871] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.871] GetProcessHeap () returned 0xd20000 [0108.871] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.871] GetProcessHeap () returned 0xd20000 [0108.871] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.871] GetProcessHeap () returned 0xd20000 [0108.871] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.872] GetProcessHeap () returned 0xd20000 [0108.872] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.872] GetProcessHeap () returned 0xd20000 [0108.872] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.872] GetProcessHeap () returned 0xd20000 [0108.872] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.872] GetProcessHeap () returned 0xd20000 [0108.872] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.872] GetProcessHeap () returned 0xd20000 [0108.872] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.872] GetProcessHeap () returned 0xd20000 [0108.872] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.872] GetProcessHeap () returned 0xd20000 [0108.872] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.872] GetProcessHeap () returned 0xd20000 [0108.872] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.872] GetProcessHeap () returned 0xd20000 [0108.872] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.872] GetProcessHeap () returned 0xd20000 [0108.872] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.872] GetProcessHeap () returned 0xd20000 [0108.873] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.873] GetProcessHeap () returned 0xd20000 [0108.873] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.873] GetProcessHeap () returned 0xd20000 [0108.873] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.873] GetProcessHeap () returned 0xd20000 [0108.873] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.873] GetProcessHeap () returned 0xd20000 [0108.873] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.873] GetProcessHeap () returned 0xd20000 [0108.873] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.873] GetProcessHeap () returned 0xd20000 [0108.873] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.873] GetProcessHeap () returned 0xd20000 [0108.873] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.873] GetProcessHeap () returned 0xd20000 [0108.873] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.873] GetProcessHeap () returned 0xd20000 [0108.873] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.873] GetProcessHeap () returned 0xd20000 [0108.874] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.874] GetProcessHeap () returned 0xd20000 [0108.874] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.874] GetProcessHeap () returned 0xd20000 [0108.874] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.874] GetProcessHeap () returned 0xd20000 [0108.874] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.874] GetProcessHeap () returned 0xd20000 [0108.874] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.874] GetProcessHeap () returned 0xd20000 [0108.874] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.874] GetProcessHeap () returned 0xd20000 [0108.874] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.874] GetProcessHeap () returned 0xd20000 [0108.874] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.874] GetProcessHeap () returned 0xd20000 [0108.874] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.874] GetProcessHeap () returned 0xd20000 [0108.874] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.874] GetProcessHeap () returned 0xd20000 [0108.874] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.875] GetProcessHeap () returned 0xd20000 [0108.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.875] GetProcessHeap () returned 0xd20000 [0108.875] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.875] GetProcessHeap () returned 0xd20000 [0108.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.875] GetProcessHeap () returned 0xd20000 [0108.875] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.875] GetProcessHeap () returned 0xd20000 [0108.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.875] GetProcessHeap () returned 0xd20000 [0108.875] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.875] GetProcessHeap () returned 0xd20000 [0108.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.875] GetProcessHeap () returned 0xd20000 [0108.875] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.875] GetProcessHeap () returned 0xd20000 [0108.875] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.875] GetProcessHeap () returned 0xd20000 [0108.875] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.876] GetProcessHeap () returned 0xd20000 [0108.876] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.876] GetProcessHeap () returned 0xd20000 [0108.876] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.876] GetProcessHeap () returned 0xd20000 [0108.876] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.876] GetProcessHeap () returned 0xd20000 [0108.876] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.876] GetProcessHeap () returned 0xd20000 [0108.876] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.876] GetProcessHeap () returned 0xd20000 [0108.876] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.876] GetProcessHeap () returned 0xd20000 [0108.876] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.876] GetProcessHeap () returned 0xd20000 [0108.876] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.876] GetProcessHeap () returned 0xd20000 [0108.876] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.876] GetProcessHeap () returned 0xd20000 [0108.877] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.877] GetProcessHeap () returned 0xd20000 [0108.877] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.877] GetProcessHeap () returned 0xd20000 [0108.877] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0108.877] GetProcessHeap () returned 0xd20000 [0108.877] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0108.877] GetProcessHeap () returned 0xd20000 [0108.877] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0108.877] GetProcessHeap () returned 0xd20000 [0108.877] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0108.877] GetProcessHeap () returned 0xd20000 [0108.877] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0108.877] GetProcessHeap () returned 0xd20000 [0108.877] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0108.877] GetProcessHeap () returned 0xd20000 [0108.877] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44588 | out: hHeap=0xd20000) returned 1 [0108.877] GetProcessHeap () returned 0xd20000 [0108.877] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b6c8 | out: hHeap=0xd20000) returned 1 [0108.877] GetProcessHeap () returned 0xd20000 [0108.878] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0108.878] GetProcessHeap () returned 0xd20000 [0108.878] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ad38 | out: hHeap=0xd20000) returned 1 [0108.878] GetProcessHeap () returned 0xd20000 [0108.878] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0108.878] GetProcessHeap () returned 0xd20000 [0108.878] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.878] GetProcessHeap () returned 0xd20000 [0108.878] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0108.878] WriteFile (in: hFile=0x230, lpBuffer=0xd4f508*, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f508*, lpNumberOfBytesWritten=0x299d864*=0x389, lpOverlapped=0x0) returned 1 [0108.882] GetProcessHeap () returned 0xd20000 [0108.882] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4f508, Size=0x30) returned 0xd4f508 [0108.882] GetProcessHeap () returned 0xd20000 [0108.882] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0108.882] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0108.882] GetProcessHeap () returned 0xd20000 [0108.882] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x5d90) returned 0xd4f540 [0108.883] ReadFile (in: hFile=0x230, lpBuffer=0xd4f540, nNumberOfBytesToRead=0x5d90, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4f540*, lpNumberOfBytesRead=0x299d7e8*=0x5d90, lpOverlapped=0x0) returned 1 [0108.884] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0108.884] WriteFile (in: hFile=0x230, lpBuffer=0xd4f540*, nNumberOfBytesToWrite=0x5d90, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4f540*, lpNumberOfBytesWritten=0x299d7e4*=0x5d90, lpOverlapped=0x0) returned 1 [0108.886] GetProcessHeap () returned 0xd20000 [0108.886] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4f540 | out: hHeap=0xd20000) returned 1 [0108.886] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0108.886] WriteFile (in: hFile=0x230, lpBuffer=0xd4f508*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f508*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0108.887] CloseHandle (hObject=0x230) returned 1 [0108.892] GetProcessHeap () returned 0xd20000 [0108.893] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd426c0 | out: hHeap=0xd20000) returned 1 [0108.893] GetProcessHeap () returned 0xd20000 [0108.893] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bf80 | out: hHeap=0xd20000) returned 1 [0108.893] GetProcessHeap () returned 0xd20000 [0108.893] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0108.893] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\a-ZoISjGYopr.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\a-ZoISjGYopr.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\a-ZoISjGYopr.jpg" [0108.893] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\a-ZoISjGYopr.jpg", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\a-ZoISjGYopr.jpg.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Pictures\\a-ZoISjGYopr.jpg.[ponce.lorena@aol.com]" [0108.893] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\a-ZoISjGYopr.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\a-zoisjgyopr.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\a-ZoISjGYopr.jpg.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\pictures\\a-zoisjgyopr.jpg.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0108.919] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\a-ZoISjGYopr.jpg" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0108.919] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0108.919] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html" [0108.919] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_recover.html")) returned 0x20 [0108.919] GetProcessHeap () returned 0xd20000 [0108.919] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd366c8 | out: hHeap=0xd20000) returned 1 [0108.919] FindNextFileW (in: hFindFile=0xd49120, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3623ebd0, ftCreationTime.dwHighDateTime=0x1d4c8fa, ftLastAccessTime.dwLowDateTime=0xff1bfa50, ftLastAccessTime.dwHighDateTime=0x1d4ce31, ftLastWriteTime.dwLowDateTime=0xff1bfa50, ftLastWriteTime.dwHighDateTime=0x1d4ce31, nFileSizeHigh=0x0, nFileSizeLow=0x8270, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="aTxWK7SpHJ.bmp", cAlternateFileName="ATXWK7~1.BMP")) returned 1 [0108.919] lstrcmpiW (lpString1="aTxWK7SpHJ.bmp", lpString2=".") returned 1 [0108.919] lstrcmpiW (lpString1="aTxWK7SpHJ.bmp", lpString2="..") returned 1 [0108.920] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="aTxWK7SpHJ.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\aTxWK7SpHJ.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\aTxWK7SpHJ.bmp" [0108.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aTxWK7SpHJ.bmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0108.920] GetProcessHeap () returned 0xd20000 [0108.920] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf) returned 0xd445a0 [0108.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="aTxWK7SpHJ.bmp", cchWideChar=-1, lpMultiByteStr=0xd445a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aTxWK7SpHJ.bmp", lpUsedDefaultChar=0x0) returned 15 [0108.920] lstrlenA (lpString="aTxWK7SpHJ.bmp") returned 14 [0108.920] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0108.920] lstrlenA (lpString="aTxWK7SpHJ.bmp") returned 14 [0108.920] lstrlenA (lpString=".dll") returned 4 [0108.920] lstrlenA (lpString=".dll") returned 4 [0108.920] lstrlenA (lpString="aTxWK7SpHJ.bmp") returned 14 [0108.920] lstrcmpiA (lpString1=".bmp", lpString2=".dll") returned -1 [0108.920] lstrlenA (lpString="aTxWK7SpHJ.bmp") returned 14 [0108.920] lstrlenA (lpString=".ini") returned 4 [0108.920] lstrlenA (lpString=".ini") returned 4 [0108.920] lstrlenA (lpString="aTxWK7SpHJ.bmp") returned 14 [0108.920] lstrcmpiA (lpString1=".bmp", lpString2=".ini") returned -1 [0108.920] lstrlenA (lpString="aTxWK7SpHJ.bmp") returned 14 [0108.920] lstrlenA (lpString=".inc") returned 4 [0108.921] lstrlenA (lpString=".inc") returned 4 [0108.921] lstrlenA (lpString="aTxWK7SpHJ.bmp") returned 14 [0108.921] lstrcmpiA (lpString1=".bmp", lpString2=".inc") returned -1 [0108.921] lstrcmpiW (lpString1="aTxWK7SpHJ.bmp", lpString2="HOW_RECOVER.html") returned -1 [0108.921] lstrcmpiW (lpString1="aTxWK7SpHJ.bmp", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0108.921] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0108.921] lstrcmpiW (lpString1="aTxWK7SpHJ.bmp", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0108.921] GetProcessHeap () returned 0xd20000 [0108.921] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42490 [0108.921] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\aTxWK7SpHJ.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\atxwk7sphj.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0108.921] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=33392) returned 1 [0108.921] GetProcessHeap () returned 0xd20000 [0108.921] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bc38 [0108.921] GetProcessHeap () returned 0xd20000 [0108.921] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0108.922] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\aTxWK7SpHJ.bmp") returned 39 [0108.922] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0108.922] GetProcessHeap () returned 0xd20000 [0108.922] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0108.922] GetProcessHeap () returned 0xd20000 [0108.922] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4f540 [0108.922] lstrlenA (lpString="rsa_encrypt") returned 11 [0108.922] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0108.924] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0108.924] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0108.924] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0108.924] GetProcessHeap () returned 0xd20000 [0108.924] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0108.924] lstrlenA (lpString="010001") returned 6 [0108.925] GetProcessHeap () returned 0xd20000 [0108.925] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc18 [0108.925] GetProcessHeap () returned 0xd20000 [0108.925] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0108.925] GetProcessHeap () returned 0xd20000 [0108.925] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4a948 [0108.925] GetProcessHeap () returned 0xd20000 [0108.925] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0108.925] GetProcessHeap () returned 0xd20000 [0108.925] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aca8 [0108.925] GetProcessHeap () returned 0xd20000 [0108.925] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44fb0 [0108.925] GetProcessHeap () returned 0xd20000 [0108.925] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd98 [0108.925] GetProcessHeap () returned 0xd20000 [0108.925] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0108.925] GetProcessHeap () returned 0xd20000 [0108.925] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.925] GetProcessHeap () returned 0xd20000 [0108.926] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0108.926] GetProcessHeap () returned 0xd20000 [0108.926] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0108.926] GetProcessHeap () returned 0xd20000 [0108.926] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44b50 [0108.926] GetProcessHeap () returned 0xd20000 [0108.926] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.926] GetProcessHeap () returned 0xd20000 [0108.926] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd444c8 [0108.926] GetProcessHeap () returned 0xd20000 [0108.926] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4adc8 [0108.926] GetProcessHeap () returned 0xd20000 [0108.926] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0108.926] GetProcessHeap () returned 0xd20000 [0108.926] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0108.926] GetProcessHeap () returned 0xd20000 [0108.926] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4adc8 | out: hHeap=0xd20000) returned 1 [0108.926] GetProcessHeap () returned 0xd20000 [0108.926] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.926] GetProcessHeap () returned 0xd20000 [0108.926] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445b8 [0108.927] GetProcessHeap () returned 0xd20000 [0108.927] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.927] GetProcessHeap () returned 0xd20000 [0108.927] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.927] GetProcessHeap () returned 0xd20000 [0108.927] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.927] GetProcessHeap () returned 0xd20000 [0108.927] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.927] GetProcessHeap () returned 0xd20000 [0108.927] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.927] GetProcessHeap () returned 0xd20000 [0108.927] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.927] GetProcessHeap () returned 0xd20000 [0108.927] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b008 [0108.927] GetProcessHeap () returned 0xd20000 [0108.927] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445b8 | out: hHeap=0xd20000) returned 1 [0108.927] GetProcessHeap () returned 0xd20000 [0108.927] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd450c8 [0108.927] GetProcessHeap () returned 0xd20000 [0108.927] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b008 | out: hHeap=0xd20000) returned 1 [0108.928] GetProcessHeap () returned 0xd20000 [0108.928] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.928] GetProcessHeap () returned 0xd20000 [0108.928] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.928] GetProcessHeap () returned 0xd20000 [0108.928] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.928] GetProcessHeap () returned 0xd20000 [0108.928] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.928] GetProcessHeap () returned 0xd20000 [0108.928] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.928] GetProcessHeap () returned 0xd20000 [0108.928] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.928] GetProcessHeap () returned 0xd20000 [0108.928] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0108.928] GetProcessHeap () returned 0xd20000 [0108.928] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0108.928] GetProcessHeap () returned 0xd20000 [0108.928] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.928] GetProcessHeap () returned 0xd20000 [0108.928] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.929] GetProcessHeap () returned 0xd20000 [0108.929] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.929] GetProcessHeap () returned 0xd20000 [0108.929] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.929] GetProcessHeap () returned 0xd20000 [0108.929] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.929] GetProcessHeap () returned 0xd20000 [0108.929] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.929] GetProcessHeap () returned 0xd20000 [0108.929] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.929] GetProcessHeap () returned 0xd20000 [0108.929] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.929] GetProcessHeap () returned 0xd20000 [0108.929] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.929] GetProcessHeap () returned 0xd20000 [0108.929] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.929] GetProcessHeap () returned 0xd20000 [0108.929] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.929] GetProcessHeap () returned 0xd20000 [0108.929] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.930] GetProcessHeap () returned 0xd20000 [0108.930] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.930] GetProcessHeap () returned 0xd20000 [0108.930] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.930] GetProcessHeap () returned 0xd20000 [0108.930] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.930] GetProcessHeap () returned 0xd20000 [0108.930] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.930] GetProcessHeap () returned 0xd20000 [0108.930] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.930] GetProcessHeap () returned 0xd20000 [0108.930] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.930] GetProcessHeap () returned 0xd20000 [0108.930] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0108.930] GetProcessHeap () returned 0xd20000 [0108.930] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0108.930] GetProcessHeap () returned 0xd20000 [0108.930] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.930] GetProcessHeap () returned 0xd20000 [0108.931] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.931] GetProcessHeap () returned 0xd20000 [0108.931] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.931] GetProcessHeap () returned 0xd20000 [0108.931] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.931] GetProcessHeap () returned 0xd20000 [0108.931] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.931] GetProcessHeap () returned 0xd20000 [0108.931] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0108.931] GetProcessHeap () returned 0xd20000 [0108.931] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0108.931] GetProcessHeap () returned 0xd20000 [0109.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.100] GetProcessHeap () returned 0xd20000 [0109.100] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.100] GetProcessHeap () returned 0xd20000 [0109.100] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.100] GetProcessHeap () returned 0xd20000 [0109.100] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.101] GetProcessHeap () returned 0xd20000 [0109.101] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.101] GetProcessHeap () returned 0xd20000 [0109.101] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.101] GetProcessHeap () returned 0xd20000 [0109.101] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.101] GetProcessHeap () returned 0xd20000 [0109.101] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.101] GetProcessHeap () returned 0xd20000 [0109.101] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.101] GetProcessHeap () returned 0xd20000 [0109.101] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.101] GetProcessHeap () returned 0xd20000 [0109.101] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.101] GetProcessHeap () returned 0xd20000 [0109.101] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.101] GetProcessHeap () returned 0xd20000 [0109.101] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.101] GetProcessHeap () returned 0xd20000 [0109.104] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.104] GetProcessHeap () returned 0xd20000 [0109.104] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.104] GetProcessHeap () returned 0xd20000 [0109.104] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.104] GetProcessHeap () returned 0xd20000 [0109.104] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.104] GetProcessHeap () returned 0xd20000 [0109.104] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.104] GetProcessHeap () returned 0xd20000 [0109.104] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.104] GetProcessHeap () returned 0xd20000 [0109.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.105] GetProcessHeap () returned 0xd20000 [0109.105] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.105] GetProcessHeap () returned 0xd20000 [0109.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.105] GetProcessHeap () returned 0xd20000 [0109.105] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.105] GetProcessHeap () returned 0xd20000 [0109.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.105] GetProcessHeap () returned 0xd20000 [0109.105] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.105] GetProcessHeap () returned 0xd20000 [0109.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.105] GetProcessHeap () returned 0xd20000 [0109.105] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.105] GetProcessHeap () returned 0xd20000 [0109.105] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.105] GetProcessHeap () returned 0xd20000 [0109.105] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.105] GetProcessHeap () returned 0xd20000 [0109.106] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.106] GetProcessHeap () returned 0xd20000 [0109.106] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.106] GetProcessHeap () returned 0xd20000 [0109.106] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.106] GetProcessHeap () returned 0xd20000 [0109.106] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.106] GetProcessHeap () returned 0xd20000 [0109.106] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.106] GetProcessHeap () returned 0xd20000 [0109.106] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.106] GetProcessHeap () returned 0xd20000 [0109.106] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.106] GetProcessHeap () returned 0xd20000 [0109.106] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.106] GetProcessHeap () returned 0xd20000 [0109.106] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.106] GetProcessHeap () returned 0xd20000 [0109.106] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.106] GetProcessHeap () returned 0xd20000 [0109.107] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.107] GetProcessHeap () returned 0xd20000 [0109.107] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.107] GetProcessHeap () returned 0xd20000 [0109.107] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.107] GetProcessHeap () returned 0xd20000 [0109.107] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.107] GetProcessHeap () returned 0xd20000 [0109.107] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.107] GetProcessHeap () returned 0xd20000 [0109.107] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.107] GetProcessHeap () returned 0xd20000 [0109.107] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.107] GetProcessHeap () returned 0xd20000 [0109.107] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.107] GetProcessHeap () returned 0xd20000 [0109.107] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.107] GetProcessHeap () returned 0xd20000 [0109.107] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.107] GetProcessHeap () returned 0xd20000 [0109.107] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.108] GetProcessHeap () returned 0xd20000 [0109.108] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.108] GetProcessHeap () returned 0xd20000 [0109.108] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.108] GetProcessHeap () returned 0xd20000 [0109.108] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.108] GetProcessHeap () returned 0xd20000 [0109.108] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.108] GetProcessHeap () returned 0xd20000 [0109.108] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.108] GetProcessHeap () returned 0xd20000 [0109.108] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.108] GetProcessHeap () returned 0xd20000 [0109.108] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.108] GetProcessHeap () returned 0xd20000 [0109.108] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.108] GetProcessHeap () returned 0xd20000 [0109.108] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.108] GetProcessHeap () returned 0xd20000 [0109.109] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.109] GetProcessHeap () returned 0xd20000 [0109.109] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.109] GetProcessHeap () returned 0xd20000 [0109.109] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.109] GetProcessHeap () returned 0xd20000 [0109.109] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.109] GetProcessHeap () returned 0xd20000 [0109.109] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.109] GetProcessHeap () returned 0xd20000 [0109.109] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.109] GetProcessHeap () returned 0xd20000 [0109.109] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.109] GetProcessHeap () returned 0xd20000 [0109.109] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.110] GetProcessHeap () returned 0xd20000 [0109.110] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.110] GetProcessHeap () returned 0xd20000 [0109.110] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.110] GetProcessHeap () returned 0xd20000 [0109.110] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.110] GetProcessHeap () returned 0xd20000 [0109.110] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.110] GetProcessHeap () returned 0xd20000 [0109.110] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.110] GetProcessHeap () returned 0xd20000 [0109.110] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.110] GetProcessHeap () returned 0xd20000 [0109.110] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.110] GetProcessHeap () returned 0xd20000 [0109.110] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.110] GetProcessHeap () returned 0xd20000 [0109.110] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.110] GetProcessHeap () returned 0xd20000 [0109.111] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.111] GetProcessHeap () returned 0xd20000 [0109.111] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.111] GetProcessHeap () returned 0xd20000 [0109.111] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.111] GetProcessHeap () returned 0xd20000 [0109.111] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0109.111] GetProcessHeap () returned 0xd20000 [0109.111] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0109.111] GetProcessHeap () returned 0xd20000 [0109.111] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.111] GetProcessHeap () returned 0xd20000 [0109.111] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.111] GetProcessHeap () returned 0xd20000 [0109.111] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.111] GetProcessHeap () returned 0xd20000 [0109.111] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.111] GetProcessHeap () returned 0xd20000 [0109.111] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.111] GetProcessHeap () returned 0xd20000 [0109.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.112] GetProcessHeap () returned 0xd20000 [0109.112] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.112] GetProcessHeap () returned 0xd20000 [0109.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.112] GetProcessHeap () returned 0xd20000 [0109.112] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.112] GetProcessHeap () returned 0xd20000 [0109.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.112] GetProcessHeap () returned 0xd20000 [0109.112] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.112] GetProcessHeap () returned 0xd20000 [0109.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.112] GetProcessHeap () returned 0xd20000 [0109.112] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.112] GetProcessHeap () returned 0xd20000 [0109.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.112] GetProcessHeap () returned 0xd20000 [0109.112] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.112] GetProcessHeap () returned 0xd20000 [0109.112] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.113] GetProcessHeap () returned 0xd20000 [0109.113] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.113] GetProcessHeap () returned 0xd20000 [0109.113] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.113] GetProcessHeap () returned 0xd20000 [0109.113] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.113] GetProcessHeap () returned 0xd20000 [0109.113] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.113] GetProcessHeap () returned 0xd20000 [0109.113] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.113] GetProcessHeap () returned 0xd20000 [0109.113] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.113] GetProcessHeap () returned 0xd20000 [0109.113] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.113] GetProcessHeap () returned 0xd20000 [0109.113] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.113] GetProcessHeap () returned 0xd20000 [0109.113] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.113] GetProcessHeap () returned 0xd20000 [0109.113] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.113] GetProcessHeap () returned 0xd20000 [0109.114] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.114] GetProcessHeap () returned 0xd20000 [0109.114] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.114] GetProcessHeap () returned 0xd20000 [0109.114] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.114] GetProcessHeap () returned 0xd20000 [0109.114] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.114] GetProcessHeap () returned 0xd20000 [0109.114] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.114] GetProcessHeap () returned 0xd20000 [0109.114] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.114] GetProcessHeap () returned 0xd20000 [0109.114] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.114] GetProcessHeap () returned 0xd20000 [0109.114] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.114] GetProcessHeap () returned 0xd20000 [0109.114] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.114] GetProcessHeap () returned 0xd20000 [0109.114] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.115] GetProcessHeap () returned 0xd20000 [0109.115] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.115] GetProcessHeap () returned 0xd20000 [0109.115] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.115] GetProcessHeap () returned 0xd20000 [0109.115] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.115] GetProcessHeap () returned 0xd20000 [0109.115] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.115] GetProcessHeap () returned 0xd20000 [0109.115] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.115] GetProcessHeap () returned 0xd20000 [0109.115] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.115] GetProcessHeap () returned 0xd20000 [0109.115] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.115] GetProcessHeap () returned 0xd20000 [0109.115] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.115] GetProcessHeap () returned 0xd20000 [0109.115] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.115] GetProcessHeap () returned 0xd20000 [0109.115] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.116] GetProcessHeap () returned 0xd20000 [0109.116] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.116] GetProcessHeap () returned 0xd20000 [0109.116] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.116] GetProcessHeap () returned 0xd20000 [0109.116] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cd98 [0109.116] GetProcessHeap () returned 0xd20000 [0109.116] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.116] GetProcessHeap () returned 0xd20000 [0109.116] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.116] GetProcessHeap () returned 0xd20000 [0109.116] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.116] GetProcessHeap () returned 0xd20000 [0109.116] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.116] GetProcessHeap () returned 0xd20000 [0109.116] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.116] GetProcessHeap () returned 0xd20000 [0109.116] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0109.116] GetProcessHeap () returned 0xd20000 [0109.116] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0109.117] GetProcessHeap () returned 0xd20000 [0109.117] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0109.117] GetProcessHeap () returned 0xd20000 [0109.117] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0109.117] GetProcessHeap () returned 0xd20000 [0109.117] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444c8 | out: hHeap=0xd20000) returned 1 [0109.117] GetProcessHeap () returned 0xd20000 [0109.117] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aca8 | out: hHeap=0xd20000) returned 1 [0109.117] GetProcessHeap () returned 0xd20000 [0109.118] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0109.118] GetProcessHeap () returned 0xd20000 [0109.118] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4a948 | out: hHeap=0xd20000) returned 1 [0109.118] GetProcessHeap () returned 0xd20000 [0109.118] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0109.118] GetProcessHeap () returned 0xd20000 [0109.118] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.118] GetProcessHeap () returned 0xd20000 [0109.118] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0109.118] WriteFile (in: hFile=0x230, lpBuffer=0xd4f540*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f540*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0109.123] GetProcessHeap () returned 0xd20000 [0109.123] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4f540, Size=0x30) returned 0xd4f540 [0109.123] GetProcessHeap () returned 0xd20000 [0109.123] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0109.123] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0109.124] GetProcessHeap () returned 0xd20000 [0109.124] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8270) returned 0xd4f578 [0109.124] ReadFile (in: hFile=0x230, lpBuffer=0xd4f578, nNumberOfBytesToRead=0x8270, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4f578*, lpNumberOfBytesRead=0x299d7e8*=0x8270, lpOverlapped=0x0) returned 1 [0109.125] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0109.125] WriteFile (in: hFile=0x230, lpBuffer=0xd4f578*, nNumberOfBytesToWrite=0x8270, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4f578*, lpNumberOfBytesWritten=0x299d7e4*=0x8270, lpOverlapped=0x0) returned 1 [0109.127] GetProcessHeap () returned 0xd20000 [0109.127] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4f578 | out: hHeap=0xd20000) returned 1 [0109.127] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0109.127] WriteFile (in: hFile=0x230, lpBuffer=0xd4f540*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f540*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0109.129] CloseHandle (hObject=0x230) returned 1 [0109.131] GetProcessHeap () returned 0xd20000 [0109.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42490 | out: hHeap=0xd20000) returned 1 [0109.132] GetProcessHeap () returned 0xd20000 [0109.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bc38 | out: hHeap=0xd20000) returned 1 [0109.132] GetProcessHeap () returned 0xd20000 [0109.132] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0109.132] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\aTxWK7SpHJ.bmp" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\aTxWK7SpHJ.bmp") returned="C:\\Users\\FD1HVy\\Pictures\\aTxWK7SpHJ.bmp" [0109.132] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\aTxWK7SpHJ.bmp", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\aTxWK7SpHJ.bmp.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Pictures\\aTxWK7SpHJ.bmp.[ponce.lorena@aol.com]" [0109.132] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\aTxWK7SpHJ.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\atxwk7sphj.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\aTxWK7SpHJ.bmp.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\pictures\\atxwk7sphj.bmp.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0109.134] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\aTxWK7SpHJ.bmp" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0109.134] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0109.134] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html" [0109.134] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_recover.html")) returned 0x20 [0109.134] GetProcessHeap () returned 0xd20000 [0109.134] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445a0 | out: hHeap=0xd20000) returned 1 [0109.134] FindNextFileW (in: hFindFile=0xd49120, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0ca0160, ftCreationTime.dwHighDateTime=0x1d4c8c6, ftLastAccessTime.dwLowDateTime=0x604f8420, ftLastAccessTime.dwHighDateTime=0x1d4c880, ftLastWriteTime.dwLowDateTime=0x604f8420, ftLastWriteTime.dwHighDateTime=0x1d4c880, nFileSizeHigh=0x0, nFileSizeLow=0x1364d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BJPAbR0r.png", cAlternateFileName="")) returned 1 [0109.134] lstrcmpiW (lpString1="BJPAbR0r.png", lpString2=".") returned 1 [0109.134] lstrcmpiW (lpString1="BJPAbR0r.png", lpString2="..") returned 1 [0109.134] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="BJPAbR0r.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\BJPAbR0r.png") returned="C:\\Users\\FD1HVy\\Pictures\\BJPAbR0r.png" [0109.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BJPAbR0r.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0109.134] GetProcessHeap () returned 0xd20000 [0109.134] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xd) returned 0xd444e0 [0109.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BJPAbR0r.png", cchWideChar=-1, lpMultiByteStr=0xd444e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BJPAbR0r.png", lpUsedDefaultChar=0x0) returned 13 [0109.135] lstrlenA (lpString="BJPAbR0r.png") returned 12 [0109.135] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0109.135] lstrlenA (lpString="BJPAbR0r.png") returned 12 [0109.135] lstrlenA (lpString=".dll") returned 4 [0109.135] lstrlenA (lpString=".dll") returned 4 [0109.135] lstrlenA (lpString="BJPAbR0r.png") returned 12 [0109.135] lstrcmpiA (lpString1=".png", lpString2=".dll") returned 1 [0109.135] lstrlenA (lpString="BJPAbR0r.png") returned 12 [0109.135] lstrlenA (lpString=".ini") returned 4 [0109.135] lstrlenA (lpString=".ini") returned 4 [0109.135] lstrlenA (lpString="BJPAbR0r.png") returned 12 [0109.135] lstrcmpiA (lpString1=".png", lpString2=".ini") returned 1 [0109.135] lstrlenA (lpString="BJPAbR0r.png") returned 12 [0109.135] lstrlenA (lpString=".inc") returned 4 [0109.135] lstrlenA (lpString=".inc") returned 4 [0109.135] lstrlenA (lpString="BJPAbR0r.png") returned 12 [0109.135] lstrcmpiA (lpString1=".png", lpString2=".inc") returned 1 [0109.135] lstrcmpiW (lpString1="BJPAbR0r.png", lpString2="HOW_RECOVER.html") returned -1 [0109.136] lstrcmpiW (lpString1="BJPAbR0r.png", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0109.136] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0109.136] lstrcmpiW (lpString1="BJPAbR0r.png", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0109.136] GetProcessHeap () returned 0xd20000 [0109.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd428a0 [0109.136] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\BJPAbR0r.png" (normalized: "c:\\users\\fd1hvy\\pictures\\bjpabr0r.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0109.136] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=79437) returned 1 [0109.136] GetProcessHeap () returned 0xd20000 [0109.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bda0 [0109.136] GetProcessHeap () returned 0xd20000 [0109.136] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0109.136] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\BJPAbR0r.png") returned 37 [0109.136] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0109.137] GetProcessHeap () returned 0xd20000 [0109.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0109.137] GetProcessHeap () returned 0xd20000 [0109.137] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4f578 [0109.137] lstrlenA (lpString="rsa_encrypt") returned 11 [0109.137] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0109.139] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0109.139] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0109.139] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0109.139] GetProcessHeap () returned 0xd20000 [0109.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0109.140] lstrlenA (lpString="010001") returned 6 [0109.140] GetProcessHeap () returned 0xd20000 [0109.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cd98 [0109.140] GetProcessHeap () returned 0xd20000 [0109.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0109.140] GetProcessHeap () returned 0xd20000 [0109.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b2d8 [0109.140] GetProcessHeap () returned 0xd20000 [0109.140] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0109.140] GetProcessHeap () returned 0xd20000 [0109.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aaf8 [0109.140] GetProcessHeap () returned 0xd20000 [0109.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44b50 [0109.140] GetProcessHeap () returned 0xd20000 [0109.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc48 [0109.140] GetProcessHeap () returned 0xd20000 [0109.140] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd452f8 [0109.141] GetProcessHeap () returned 0xd20000 [0109.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.141] GetProcessHeap () returned 0xd20000 [0109.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0109.141] GetProcessHeap () returned 0xd20000 [0109.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0109.141] GetProcessHeap () returned 0xd20000 [0109.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44808 [0109.141] GetProcessHeap () returned 0xd20000 [0109.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.141] GetProcessHeap () returned 0xd20000 [0109.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd446d8 [0109.141] GetProcessHeap () returned 0xd20000 [0109.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4ad38 [0109.141] GetProcessHeap () returned 0xd20000 [0109.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0109.141] GetProcessHeap () returned 0xd20000 [0109.141] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0109.141] GetProcessHeap () returned 0xd20000 [0109.141] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4ad38 | out: hHeap=0xd20000) returned 1 [0109.142] GetProcessHeap () returned 0xd20000 [0109.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.142] GetProcessHeap () returned 0xd20000 [0109.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd445d0 [0109.142] GetProcessHeap () returned 0xd20000 [0109.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.142] GetProcessHeap () returned 0xd20000 [0109.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.142] GetProcessHeap () returned 0xd20000 [0109.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.142] GetProcessHeap () returned 0xd20000 [0109.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.142] GetProcessHeap () returned 0xd20000 [0109.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.142] GetProcessHeap () returned 0xd20000 [0109.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.142] GetProcessHeap () returned 0xd20000 [0109.142] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b368 [0109.142] GetProcessHeap () returned 0xd20000 [0109.142] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd445d0 | out: hHeap=0xd20000) returned 1 [0109.142] GetProcessHeap () returned 0xd20000 [0109.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0109.143] GetProcessHeap () returned 0xd20000 [0109.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b368 | out: hHeap=0xd20000) returned 1 [0109.143] GetProcessHeap () returned 0xd20000 [0109.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.143] GetProcessHeap () returned 0xd20000 [0109.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.143] GetProcessHeap () returned 0xd20000 [0109.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.143] GetProcessHeap () returned 0xd20000 [0109.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.143] GetProcessHeap () returned 0xd20000 [0109.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.143] GetProcessHeap () returned 0xd20000 [0109.143] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.143] GetProcessHeap () returned 0xd20000 [0109.143] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.144] GetProcessHeap () returned 0xd20000 [0109.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.144] GetProcessHeap () returned 0xd20000 [0109.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.144] GetProcessHeap () returned 0xd20000 [0109.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.144] GetProcessHeap () returned 0xd20000 [0109.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.144] GetProcessHeap () returned 0xd20000 [0109.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.144] GetProcessHeap () returned 0xd20000 [0109.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.144] GetProcessHeap () returned 0xd20000 [0109.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.144] GetProcessHeap () returned 0xd20000 [0109.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.144] GetProcessHeap () returned 0xd20000 [0109.144] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.144] GetProcessHeap () returned 0xd20000 [0109.144] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.144] GetProcessHeap () returned 0xd20000 [0109.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.145] GetProcessHeap () returned 0xd20000 [0109.145] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.145] GetProcessHeap () returned 0xd20000 [0109.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.145] GetProcessHeap () returned 0xd20000 [0109.145] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.145] GetProcessHeap () returned 0xd20000 [0109.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.145] GetProcessHeap () returned 0xd20000 [0109.145] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.145] GetProcessHeap () returned 0xd20000 [0109.145] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.145] GetProcessHeap () returned 0xd20000 [0109.145] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.146] GetProcessHeap () returned 0xd20000 [0109.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.146] GetProcessHeap () returned 0xd20000 [0109.146] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.146] GetProcessHeap () returned 0xd20000 [0109.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.146] GetProcessHeap () returned 0xd20000 [0109.146] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.146] GetProcessHeap () returned 0xd20000 [0109.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.146] GetProcessHeap () returned 0xd20000 [0109.146] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.146] GetProcessHeap () returned 0xd20000 [0109.146] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.146] GetProcessHeap () returned 0xd20000 [0109.146] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.146] GetProcessHeap () returned 0xd20000 [0109.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.147] GetProcessHeap () returned 0xd20000 [0109.147] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.147] GetProcessHeap () returned 0xd20000 [0109.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.147] GetProcessHeap () returned 0xd20000 [0109.147] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.147] GetProcessHeap () returned 0xd20000 [0109.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.147] GetProcessHeap () returned 0xd20000 [0109.147] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.147] GetProcessHeap () returned 0xd20000 [0109.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.147] GetProcessHeap () returned 0xd20000 [0109.147] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.147] GetProcessHeap () returned 0xd20000 [0109.147] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.147] GetProcessHeap () returned 0xd20000 [0109.147] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.148] GetProcessHeap () returned 0xd20000 [0109.148] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.148] GetProcessHeap () returned 0xd20000 [0109.148] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.148] GetProcessHeap () returned 0xd20000 [0109.148] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.148] GetProcessHeap () returned 0xd20000 [0109.148] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.148] GetProcessHeap () returned 0xd20000 [0109.148] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.148] GetProcessHeap () returned 0xd20000 [0109.148] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.148] GetProcessHeap () returned 0xd20000 [0109.148] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.148] GetProcessHeap () returned 0xd20000 [0109.148] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.148] GetProcessHeap () returned 0xd20000 [0109.150] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.150] GetProcessHeap () returned 0xd20000 [0109.150] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.150] GetProcessHeap () returned 0xd20000 [0109.151] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.151] GetProcessHeap () returned 0xd20000 [0109.151] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.151] GetProcessHeap () returned 0xd20000 [0109.151] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.151] GetProcessHeap () returned 0xd20000 [0109.151] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.151] GetProcessHeap () returned 0xd20000 [0109.151] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.151] GetProcessHeap () returned 0xd20000 [0109.151] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.151] GetProcessHeap () returned 0xd20000 [0109.151] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.151] GetProcessHeap () returned 0xd20000 [0109.151] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.151] GetProcessHeap () returned 0xd20000 [0109.151] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.151] GetProcessHeap () returned 0xd20000 [0109.151] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.152] GetProcessHeap () returned 0xd20000 [0109.152] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.152] GetProcessHeap () returned 0xd20000 [0109.152] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.152] GetProcessHeap () returned 0xd20000 [0109.152] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.152] GetProcessHeap () returned 0xd20000 [0109.152] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.152] GetProcessHeap () returned 0xd20000 [0109.152] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.152] GetProcessHeap () returned 0xd20000 [0109.152] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.152] GetProcessHeap () returned 0xd20000 [0109.152] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.152] GetProcessHeap () returned 0xd20000 [0109.152] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.152] GetProcessHeap () returned 0xd20000 [0109.152] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.152] GetProcessHeap () returned 0xd20000 [0109.152] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.152] GetProcessHeap () returned 0xd20000 [0109.153] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.153] GetProcessHeap () returned 0xd20000 [0109.153] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.153] GetProcessHeap () returned 0xd20000 [0109.153] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.153] GetProcessHeap () returned 0xd20000 [0109.153] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.153] GetProcessHeap () returned 0xd20000 [0109.153] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.153] GetProcessHeap () returned 0xd20000 [0109.153] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.153] GetProcessHeap () returned 0xd20000 [0109.153] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.153] GetProcessHeap () returned 0xd20000 [0109.153] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.153] GetProcessHeap () returned 0xd20000 [0109.153] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.153] GetProcessHeap () returned 0xd20000 [0109.153] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.153] GetProcessHeap () returned 0xd20000 [0109.154] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.154] GetProcessHeap () returned 0xd20000 [0109.154] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.154] GetProcessHeap () returned 0xd20000 [0109.154] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.154] GetProcessHeap () returned 0xd20000 [0109.154] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.154] GetProcessHeap () returned 0xd20000 [0109.154] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.154] GetProcessHeap () returned 0xd20000 [0109.154] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.154] GetProcessHeap () returned 0xd20000 [0109.154] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.154] GetProcessHeap () returned 0xd20000 [0109.154] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.154] GetProcessHeap () returned 0xd20000 [0109.154] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.154] GetProcessHeap () returned 0xd20000 [0109.154] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.154] GetProcessHeap () returned 0xd20000 [0109.155] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.155] GetProcessHeap () returned 0xd20000 [0109.155] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.155] GetProcessHeap () returned 0xd20000 [0109.155] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.155] GetProcessHeap () returned 0xd20000 [0109.155] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.155] GetProcessHeap () returned 0xd20000 [0109.155] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.155] GetProcessHeap () returned 0xd20000 [0109.155] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.155] GetProcessHeap () returned 0xd20000 [0109.155] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.155] GetProcessHeap () returned 0xd20000 [0109.155] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.155] GetProcessHeap () returned 0xd20000 [0109.155] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.155] GetProcessHeap () returned 0xd20000 [0109.155] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.155] GetProcessHeap () returned 0xd20000 [0109.156] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.156] GetProcessHeap () returned 0xd20000 [0109.156] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.156] GetProcessHeap () returned 0xd20000 [0109.156] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.156] GetProcessHeap () returned 0xd20000 [0109.156] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.156] GetProcessHeap () returned 0xd20000 [0109.156] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.156] GetProcessHeap () returned 0xd20000 [0109.156] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.156] GetProcessHeap () returned 0xd20000 [0109.156] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.156] GetProcessHeap () returned 0xd20000 [0109.156] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.156] GetProcessHeap () returned 0xd20000 [0109.156] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.156] GetProcessHeap () returned 0xd20000 [0109.156] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.156] GetProcessHeap () returned 0xd20000 [0109.157] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.157] GetProcessHeap () returned 0xd20000 [0109.157] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0109.157] GetProcessHeap () returned 0xd20000 [0109.157] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0109.157] GetProcessHeap () returned 0xd20000 [0109.157] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0109.157] GetProcessHeap () returned 0xd20000 [0109.157] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0109.157] GetProcessHeap () returned 0xd20000 [0109.157] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.157] GetProcessHeap () returned 0xd20000 [0109.157] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.157] GetProcessHeap () returned 0xd20000 [0109.157] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.157] GetProcessHeap () returned 0xd20000 [0109.157] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.157] GetProcessHeap () returned 0xd20000 [0109.157] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.157] GetProcessHeap () returned 0xd20000 [0109.157] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.158] GetProcessHeap () returned 0xd20000 [0109.158] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.158] GetProcessHeap () returned 0xd20000 [0109.158] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.158] GetProcessHeap () returned 0xd20000 [0109.158] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.158] GetProcessHeap () returned 0xd20000 [0109.158] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.158] GetProcessHeap () returned 0xd20000 [0109.158] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.158] GetProcessHeap () returned 0xd20000 [0109.158] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.158] GetProcessHeap () returned 0xd20000 [0109.158] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.158] GetProcessHeap () returned 0xd20000 [0109.158] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.158] GetProcessHeap () returned 0xd20000 [0109.158] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.158] GetProcessHeap () returned 0xd20000 [0109.158] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.159] GetProcessHeap () returned 0xd20000 [0109.159] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.159] GetProcessHeap () returned 0xd20000 [0109.159] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.159] GetProcessHeap () returned 0xd20000 [0109.159] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.159] GetProcessHeap () returned 0xd20000 [0109.159] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.159] GetProcessHeap () returned 0xd20000 [0109.159] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.159] GetProcessHeap () returned 0xd20000 [0109.159] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.159] GetProcessHeap () returned 0xd20000 [0109.159] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.159] GetProcessHeap () returned 0xd20000 [0109.159] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.159] GetProcessHeap () returned 0xd20000 [0109.159] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.159] GetProcessHeap () returned 0xd20000 [0109.160] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.160] GetProcessHeap () returned 0xd20000 [0109.160] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0109.160] GetProcessHeap () returned 0xd20000 [0109.160] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0109.160] GetProcessHeap () returned 0xd20000 [0109.160] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.160] GetProcessHeap () returned 0xd20000 [0109.160] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.160] GetProcessHeap () returned 0xd20000 [0109.160] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.160] GetProcessHeap () returned 0xd20000 [0109.160] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.160] GetProcessHeap () returned 0xd20000 [0109.160] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.160] GetProcessHeap () returned 0xd20000 [0109.160] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.160] GetProcessHeap () returned 0xd20000 [0109.160] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.161] GetProcessHeap () returned 0xd20000 [0109.161] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.161] GetProcessHeap () returned 0xd20000 [0109.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.161] GetProcessHeap () returned 0xd20000 [0109.161] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.161] GetProcessHeap () returned 0xd20000 [0109.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.161] GetProcessHeap () returned 0xd20000 [0109.161] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.161] GetProcessHeap () returned 0xd20000 [0109.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.161] GetProcessHeap () returned 0xd20000 [0109.161] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.161] GetProcessHeap () returned 0xd20000 [0109.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.161] GetProcessHeap () returned 0xd20000 [0109.161] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.161] GetProcessHeap () returned 0xd20000 [0109.161] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.162] GetProcessHeap () returned 0xd20000 [0109.162] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.162] GetProcessHeap () returned 0xd20000 [0109.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.162] GetProcessHeap () returned 0xd20000 [0109.162] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.162] GetProcessHeap () returned 0xd20000 [0109.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.162] GetProcessHeap () returned 0xd20000 [0109.162] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.162] GetProcessHeap () returned 0xd20000 [0109.162] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc18 [0109.162] GetProcessHeap () returned 0xd20000 [0109.162] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.162] GetProcessHeap () returned 0xd20000 [0109.162] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0109.162] GetProcessHeap () returned 0xd20000 [0109.162] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0109.162] GetProcessHeap () returned 0xd20000 [0109.162] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0109.162] GetProcessHeap () returned 0xd20000 [0109.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0109.163] GetProcessHeap () returned 0xd20000 [0109.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd446d8 | out: hHeap=0xd20000) returned 1 [0109.163] GetProcessHeap () returned 0xd20000 [0109.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aaf8 | out: hHeap=0xd20000) returned 1 [0109.163] GetProcessHeap () returned 0xd20000 [0109.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44b50 | out: hHeap=0xd20000) returned 1 [0109.163] GetProcessHeap () returned 0xd20000 [0109.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b2d8 | out: hHeap=0xd20000) returned 1 [0109.163] GetProcessHeap () returned 0xd20000 [0109.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0109.163] GetProcessHeap () returned 0xd20000 [0109.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cd98 | out: hHeap=0xd20000) returned 1 [0109.163] GetProcessHeap () returned 0xd20000 [0109.163] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0109.163] WriteFile (in: hFile=0x230, lpBuffer=0xd4f578*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f578*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0109.167] GetProcessHeap () returned 0xd20000 [0109.167] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4f578, Size=0x30) returned 0xd4f578 [0109.167] GetProcessHeap () returned 0xd20000 [0109.167] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0109.167] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0109.167] GetProcessHeap () returned 0xd20000 [0109.168] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x1364d) returned 0xd4f5b0 [0109.170] ReadFile (in: hFile=0x230, lpBuffer=0xd4f5b0, nNumberOfBytesToRead=0x1364d, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4f5b0*, lpNumberOfBytesRead=0x299d7e8*=0x1364d, lpOverlapped=0x0) returned 1 [0109.172] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0109.172] WriteFile (in: hFile=0x230, lpBuffer=0xd4f5b0*, nNumberOfBytesToWrite=0x1364d, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4f5b0*, lpNumberOfBytesWritten=0x299d7e4*=0x1364d, lpOverlapped=0x0) returned 1 [0109.174] GetProcessHeap () returned 0xd20000 [0109.174] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4f5b0 | out: hHeap=0xd20000) returned 1 [0109.174] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0109.174] WriteFile (in: hFile=0x230, lpBuffer=0xd4f578*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f578*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0109.176] CloseHandle (hObject=0x230) returned 1 [0109.181] GetProcessHeap () returned 0xd20000 [0109.182] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd428a0 | out: hHeap=0xd20000) returned 1 [0109.182] GetProcessHeap () returned 0xd20000 [0109.182] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bda0 | out: hHeap=0xd20000) returned 1 [0109.182] GetProcessHeap () returned 0xd20000 [0109.182] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0109.182] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\BJPAbR0r.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\BJPAbR0r.png") returned="C:\\Users\\FD1HVy\\Pictures\\BJPAbR0r.png" [0109.182] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\BJPAbR0r.png", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\BJPAbR0r.png.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Pictures\\BJPAbR0r.png.[ponce.lorena@aol.com]" [0109.182] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\BJPAbR0r.png" (normalized: "c:\\users\\fd1hvy\\pictures\\bjpabr0r.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\BJPAbR0r.png.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\pictures\\bjpabr0r.png.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0109.183] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\BJPAbR0r.png" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0109.183] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0109.183] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html" [0109.183] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_recover.html")) returned 0x20 [0109.183] GetProcessHeap () returned 0xd20000 [0109.183] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444e0 | out: hHeap=0xd20000) returned 1 [0109.183] FindNextFileW (in: hFindFile=0xd49120, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0109.183] lstrcmpiW (lpString1="Camera Roll", lpString2=".") returned 1 [0109.183] lstrcmpiW (lpString1="Camera Roll", lpString2="..") returned 1 [0109.183] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="Camera Roll" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll" [0109.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Camera Roll", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0109.184] GetProcessHeap () returned 0xd20000 [0109.184] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd44498 [0109.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Camera Roll", cchWideChar=-1, lpMultiByteStr=0xd44498, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Camera Roll", lpUsedDefaultChar=0x0) returned 12 [0109.184] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows", cchCount2=-1) returned 1 [0109.184] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Microsoft", cchCount2=-1) returned 1 [0109.184] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Microsoft Help", cchCount2=-1) returned 1 [0109.184] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows App Certification Kit", cchCount2=-1) returned 1 [0109.184] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows Defender", cchCount2=-1) returned 1 [0109.184] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="ESET", cchCount2=-1) returned 1 [0109.184] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="COMODO", cchCount2=-1) returned 1 [0109.184] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows NT", cchCount2=-1) returned 1 [0109.184] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows Kits", cchCount2=-1) returned 1 [0109.184] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows Mail", cchCount2=-1) returned 1 [0109.184] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows Media Player", cchCount2=-1) returned 1 [0109.184] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows Multimedia Platform", cchCount2=-1) returned 1 [0109.184] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows Phone Kits", cchCount2=-1) returned 1 [0109.184] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows Phone Silverlight Kits", cchCount2=-1) returned 1 [0109.185] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows Photo Viewer", cchCount2=-1) returned 1 [0109.185] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows Portable Devices", cchCount2=-1) returned 1 [0109.185] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Windows Sidebar", cchCount2=-1) returned 1 [0109.185] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="WindowsPowerShell", cchCount2=-1) returned 1 [0109.185] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="NVIDIA Corporation", cchCount2=-1) returned 1 [0109.185] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Microsoft.NET", cchCount2=-1) returned 1 [0109.185] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Internet Explorer", cchCount2=-1) returned 1 [0109.185] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Kaspersky Lab", cchCount2=-1) returned 1 [0109.185] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="McAfee", cchCount2=-1) returned 1 [0109.185] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Avira", cchCount2=-1) returned 3 [0109.185] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="spytech software", cchCount2=-1) returned 1 [0109.185] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="sysconfig", cchCount2=-1) returned 1 [0109.185] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Avast", cchCount2=-1) returned 3 [0109.185] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Dr.Web", cchCount2=-1) returned 1 [0109.185] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Symantec", cchCount2=-1) returned 1 [0109.185] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Symantec_Client_Security", cchCount2=-1) returned 1 [0109.185] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="system volume information", cchCount2=-1) returned 1 [0109.185] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="AVG", cchCount2=-1) returned 3 [0109.186] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Microsoft Shared", cchCount2=-1) returned 1 [0109.186] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Common Files", cchCount2=-1) returned 1 [0109.186] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Outlook Express", cchCount2=-1) returned 1 [0109.186] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Movie Maker", cchCount2=-1) returned 1 [0109.186] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Chrome", cchCount2=-1) returned 1 [0109.186] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Mozilla Firefox", cchCount2=-1) returned 1 [0109.186] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Opera", cchCount2=-1) returned 1 [0109.186] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="YandexBrowser", cchCount2=-1) returned 1 [0109.186] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="ntldr", cchCount2=-1) returned 1 [0109.186] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="Wsus", cchCount2=-1) returned 1 [0109.186] CompareStringA (Locale=0x800, dwCmpFlags=0x1, lpString1="Camera Roll", cchCount1=-1, lpString2="ProgramData", cchCount2=-1) returned 1 [0109.186] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll", lpString2="\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\" [0109.186] GetProcessHeap () returned 0xd20000 [0109.186] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8) returned 0xd3cd98 [0109.186] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\") returned 37 [0109.186] GetProcessHeap () returned 0xd20000 [0109.186] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x4c) returned 0xd2e898 [0109.186] lstrcpyW (in: lpString1=0xd2e898, lpString2="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\") returned="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\" [0109.187] GetProcessHeap () returned 0xd20000 [0109.187] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44498 | out: hHeap=0xd20000) returned 1 [0109.187] FindNextFileW (in: hFindFile=0xd49120, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44053085, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44053085, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0109.187] lstrcmpiW (lpString1="desktop.ini", lpString2=".") returned 1 [0109.187] lstrcmpiW (lpString1="desktop.ini", lpString2="..") returned 1 [0109.187] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\desktop.ini") returned="C:\\Users\\FD1HVy\\Pictures\\desktop.ini" [0109.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0109.187] GetProcessHeap () returned 0xd20000 [0109.187] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd44648 [0109.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=-1, lpMultiByteStr=0xd44648, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.ini", lpUsedDefaultChar=0x0) returned 12 [0109.187] lstrlenA (lpString="desktop.ini") returned 11 [0109.187] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0109.187] lstrlenA (lpString="desktop.ini") returned 11 [0109.187] lstrlenA (lpString=".dll") returned 4 [0109.187] lstrlenA (lpString=".dll") returned 4 [0109.187] lstrlenA (lpString="desktop.ini") returned 11 [0109.187] lstrcmpiA (lpString1=".ini", lpString2=".dll") returned 1 [0109.187] lstrlenA (lpString="desktop.ini") returned 11 [0109.188] lstrlenA (lpString=".ini") returned 4 [0109.188] lstrlenA (lpString=".ini") returned 4 [0109.188] lstrlenA (lpString="desktop.ini") returned 11 [0109.188] lstrcmpiA (lpString1=".ini", lpString2=".ini") returned 0 [0109.188] GetProcessHeap () returned 0xd20000 [0109.188] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44648 | out: hHeap=0xd20000) returned 1 [0109.188] FindNextFileW (in: hFindFile=0xd49120, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x842e9980, ftCreationTime.dwHighDateTime=0x1d4ca83, ftLastAccessTime.dwLowDateTime=0xf492fcb0, ftLastAccessTime.dwHighDateTime=0x1d4cfde, ftLastWriteTime.dwLowDateTime=0xf492fcb0, ftLastWriteTime.dwHighDateTime=0x1d4cfde, nFileSizeHigh=0x0, nFileSizeLow=0x8cd8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dnr4puGJfqjJ0AWqTZ.jpg", cAlternateFileName="DNR4PU~1.JPG")) returned 1 [0109.188] lstrcmpiW (lpString1="dnr4puGJfqjJ0AWqTZ.jpg", lpString2=".") returned 1 [0109.188] lstrcmpiW (lpString1="dnr4puGJfqjJ0AWqTZ.jpg", lpString2="..") returned 1 [0109.188] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="dnr4puGJfqjJ0AWqTZ.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\dnr4puGJfqjJ0AWqTZ.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\dnr4puGJfqjJ0AWqTZ.jpg" [0109.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnr4puGJfqjJ0AWqTZ.jpg", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0109.188] GetProcessHeap () returned 0xd20000 [0109.188] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x17) returned 0xd364c8 [0109.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="dnr4puGJfqjJ0AWqTZ.jpg", cchWideChar=-1, lpMultiByteStr=0xd364c8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dnr4puGJfqjJ0AWqTZ.jpg", lpUsedDefaultChar=0x0) returned 23 [0109.188] lstrlenA (lpString="dnr4puGJfqjJ0AWqTZ.jpg") returned 22 [0109.188] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0109.188] lstrlenA (lpString="dnr4puGJfqjJ0AWqTZ.jpg") returned 22 [0109.188] lstrlenA (lpString=".dll") returned 4 [0109.188] lstrlenA (lpString=".dll") returned 4 [0109.188] lstrlenA (lpString="dnr4puGJfqjJ0AWqTZ.jpg") returned 22 [0109.189] lstrcmpiA (lpString1=".jpg", lpString2=".dll") returned 1 [0109.189] lstrlenA (lpString="dnr4puGJfqjJ0AWqTZ.jpg") returned 22 [0109.189] lstrlenA (lpString=".ini") returned 4 [0109.189] lstrlenA (lpString=".ini") returned 4 [0109.189] lstrlenA (lpString="dnr4puGJfqjJ0AWqTZ.jpg") returned 22 [0109.189] lstrcmpiA (lpString1=".jpg", lpString2=".ini") returned 1 [0109.189] lstrlenA (lpString="dnr4puGJfqjJ0AWqTZ.jpg") returned 22 [0109.189] lstrlenA (lpString=".inc") returned 4 [0109.189] lstrlenA (lpString=".inc") returned 4 [0109.189] lstrlenA (lpString="dnr4puGJfqjJ0AWqTZ.jpg") returned 22 [0109.189] lstrcmpiA (lpString1=".jpg", lpString2=".inc") returned 1 [0109.189] lstrcmpiW (lpString1="dnr4puGJfqjJ0AWqTZ.jpg", lpString2="HOW_RECOVER.html") returned -1 [0109.189] lstrcmpiW (lpString1="dnr4puGJfqjJ0AWqTZ.jpg", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0109.189] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0109.189] lstrcmpiW (lpString1="dnr4puGJfqjJ0AWqTZ.jpg", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0109.189] GetProcessHeap () returned 0xd20000 [0109.189] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd428c8 [0109.189] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\dnr4puGJfqjJ0AWqTZ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\dnr4pugjfqjj0awqtz.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0109.190] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=36056) returned 1 [0109.190] GetProcessHeap () returned 0xd20000 [0109.190] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4bda0 [0109.190] GetProcessHeap () returned 0xd20000 [0109.190] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0109.190] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\dnr4puGJfqjJ0AWqTZ.jpg") returned 47 [0109.190] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0109.190] GetProcessHeap () returned 0xd20000 [0109.190] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0109.190] GetProcessHeap () returned 0xd20000 [0109.190] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x388) returned 0xd4f5b0 [0109.190] lstrlenA (lpString="rsa_encrypt") returned 11 [0109.190] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0109.193] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0109.193] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0109.193] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0109.193] GetProcessHeap () returned 0xd20000 [0109.193] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0109.193] lstrlenA (lpString="010001") returned 6 [0109.193] GetProcessHeap () returned 0xd20000 [0109.193] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc18 [0109.193] GetProcessHeap () returned 0xd20000 [0109.193] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0109.193] GetProcessHeap () returned 0xd20000 [0109.194] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b758 [0109.194] GetProcessHeap () returned 0xd20000 [0109.194] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0109.194] GetProcessHeap () returned 0xd20000 [0109.194] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b638 [0109.194] GetProcessHeap () returned 0xd20000 [0109.194] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44c68 [0109.194] GetProcessHeap () returned 0xd20000 [0109.194] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc48 [0109.194] GetProcessHeap () returned 0xd20000 [0109.194] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0109.194] GetProcessHeap () returned 0xd20000 [0109.194] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.194] GetProcessHeap () returned 0xd20000 [0109.194] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0109.194] GetProcessHeap () returned 0xd20000 [0109.194] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0109.194] GetProcessHeap () returned 0xd20000 [0109.194] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44e98 [0109.194] GetProcessHeap () returned 0xd20000 [0109.195] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.195] GetProcessHeap () returned 0xd20000 [0109.195] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44540 [0109.195] GetProcessHeap () returned 0xd20000 [0109.195] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b128 [0109.195] GetProcessHeap () returned 0xd20000 [0109.195] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0109.195] GetProcessHeap () returned 0xd20000 [0109.195] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45528 [0109.195] GetProcessHeap () returned 0xd20000 [0109.195] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b128 | out: hHeap=0xd20000) returned 1 [0109.195] GetProcessHeap () returned 0xd20000 [0109.195] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0109.195] GetProcessHeap () returned 0xd20000 [0109.195] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44468 [0109.196] GetProcessHeap () returned 0xd20000 [0109.196] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.196] GetProcessHeap () returned 0xd20000 [0109.196] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0109.196] GetProcessHeap () returned 0xd20000 [0109.196] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.196] GetProcessHeap () returned 0xd20000 [0109.196] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.196] GetProcessHeap () returned 0xd20000 [0109.196] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.197] GetProcessHeap () returned 0xd20000 [0109.197] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.197] GetProcessHeap () returned 0xd20000 [0109.197] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b248 [0109.197] GetProcessHeap () returned 0xd20000 [0109.197] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44468 | out: hHeap=0xd20000) returned 1 [0109.197] GetProcessHeap () returned 0xd20000 [0109.197] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0109.197] GetProcessHeap () returned 0xd20000 [0109.197] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b248 | out: hHeap=0xd20000) returned 1 [0109.197] GetProcessHeap () returned 0xd20000 [0109.197] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.197] GetProcessHeap () returned 0xd20000 [0109.197] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.197] GetProcessHeap () returned 0xd20000 [0109.197] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.197] GetProcessHeap () returned 0xd20000 [0109.197] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.197] GetProcessHeap () returned 0xd20000 [0109.197] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.198] GetProcessHeap () returned 0xd20000 [0109.198] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.198] GetProcessHeap () returned 0xd20000 [0109.198] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.198] GetProcessHeap () returned 0xd20000 [0109.198] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.198] GetProcessHeap () returned 0xd20000 [0109.198] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.198] GetProcessHeap () returned 0xd20000 [0109.198] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.198] GetProcessHeap () returned 0xd20000 [0109.198] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.198] GetProcessHeap () returned 0xd20000 [0109.198] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.198] GetProcessHeap () returned 0xd20000 [0109.198] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.198] GetProcessHeap () returned 0xd20000 [0109.198] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.198] GetProcessHeap () returned 0xd20000 [0109.198] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.199] GetProcessHeap () returned 0xd20000 [0109.199] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.199] GetProcessHeap () returned 0xd20000 [0109.199] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.199] GetProcessHeap () returned 0xd20000 [0109.199] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.199] GetProcessHeap () returned 0xd20000 [0109.199] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.199] GetProcessHeap () returned 0xd20000 [0109.199] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.199] GetProcessHeap () returned 0xd20000 [0109.199] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.199] GetProcessHeap () returned 0xd20000 [0109.199] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.199] GetProcessHeap () returned 0xd20000 [0109.199] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.199] GetProcessHeap () returned 0xd20000 [0109.199] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.199] GetProcessHeap () returned 0xd20000 [0109.199] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.200] GetProcessHeap () returned 0xd20000 [0109.200] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.200] GetProcessHeap () returned 0xd20000 [0109.200] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.200] GetProcessHeap () returned 0xd20000 [0109.200] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.200] GetProcessHeap () returned 0xd20000 [0109.200] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.200] GetProcessHeap () returned 0xd20000 [0109.200] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.200] GetProcessHeap () returned 0xd20000 [0109.200] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.200] GetProcessHeap () returned 0xd20000 [0109.200] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.200] GetProcessHeap () returned 0xd20000 [0109.200] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.200] GetProcessHeap () returned 0xd20000 [0109.200] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.200] GetProcessHeap () returned 0xd20000 [0109.200] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.201] GetProcessHeap () returned 0xd20000 [0109.201] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.201] GetProcessHeap () returned 0xd20000 [0109.201] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.201] GetProcessHeap () returned 0xd20000 [0109.201] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.201] GetProcessHeap () returned 0xd20000 [0109.201] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.201] GetProcessHeap () returned 0xd20000 [0109.201] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.201] GetProcessHeap () returned 0xd20000 [0109.201] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.201] GetProcessHeap () returned 0xd20000 [0109.201] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.201] GetProcessHeap () returned 0xd20000 [0109.201] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.201] GetProcessHeap () returned 0xd20000 [0109.201] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.201] GetProcessHeap () returned 0xd20000 [0109.201] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.201] GetProcessHeap () returned 0xd20000 [0109.202] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.202] GetProcessHeap () returned 0xd20000 [0109.202] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.202] GetProcessHeap () returned 0xd20000 [0109.202] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.202] GetProcessHeap () returned 0xd20000 [0109.202] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.202] GetProcessHeap () returned 0xd20000 [0109.202] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.202] GetProcessHeap () returned 0xd20000 [0109.202] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.202] GetProcessHeap () returned 0xd20000 [0109.202] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.202] GetProcessHeap () returned 0xd20000 [0109.202] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.202] GetProcessHeap () returned 0xd20000 [0109.202] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.202] GetProcessHeap () returned 0xd20000 [0109.202] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.202] GetProcessHeap () returned 0xd20000 [0109.203] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.203] GetProcessHeap () returned 0xd20000 [0109.203] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.203] GetProcessHeap () returned 0xd20000 [0109.203] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.203] GetProcessHeap () returned 0xd20000 [0109.203] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.203] GetProcessHeap () returned 0xd20000 [0109.203] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.203] GetProcessHeap () returned 0xd20000 [0109.203] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.203] GetProcessHeap () returned 0xd20000 [0109.203] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.203] GetProcessHeap () returned 0xd20000 [0109.203] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.203] GetProcessHeap () returned 0xd20000 [0109.203] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.203] GetProcessHeap () returned 0xd20000 [0109.203] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.204] GetProcessHeap () returned 0xd20000 [0109.204] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.204] GetProcessHeap () returned 0xd20000 [0109.204] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.204] GetProcessHeap () returned 0xd20000 [0109.204] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.204] GetProcessHeap () returned 0xd20000 [0109.204] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.204] GetProcessHeap () returned 0xd20000 [0109.204] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.204] GetProcessHeap () returned 0xd20000 [0109.204] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.204] GetProcessHeap () returned 0xd20000 [0109.204] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.204] GetProcessHeap () returned 0xd20000 [0109.204] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.204] GetProcessHeap () returned 0xd20000 [0109.204] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.204] GetProcessHeap () returned 0xd20000 [0109.204] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.205] GetProcessHeap () returned 0xd20000 [0109.205] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.205] GetProcessHeap () returned 0xd20000 [0109.205] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.205] GetProcessHeap () returned 0xd20000 [0109.205] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.205] GetProcessHeap () returned 0xd20000 [0109.205] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0109.205] GetProcessHeap () returned 0xd20000 [0109.205] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0109.205] GetProcessHeap () returned 0xd20000 [0109.205] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.205] GetProcessHeap () returned 0xd20000 [0109.205] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.205] GetProcessHeap () returned 0xd20000 [0109.205] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.205] GetProcessHeap () returned 0xd20000 [0109.205] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.205] GetProcessHeap () returned 0xd20000 [0109.206] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.206] GetProcessHeap () returned 0xd20000 [0109.206] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.206] GetProcessHeap () returned 0xd20000 [0109.206] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.206] GetProcessHeap () returned 0xd20000 [0109.206] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.206] GetProcessHeap () returned 0xd20000 [0109.206] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.206] GetProcessHeap () returned 0xd20000 [0109.206] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.206] GetProcessHeap () returned 0xd20000 [0109.206] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.206] GetProcessHeap () returned 0xd20000 [0109.206] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.206] GetProcessHeap () returned 0xd20000 [0109.206] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.206] GetProcessHeap () returned 0xd20000 [0109.206] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.207] GetProcessHeap () returned 0xd20000 [0109.207] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.207] GetProcessHeap () returned 0xd20000 [0109.207] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.207] GetProcessHeap () returned 0xd20000 [0109.207] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.207] GetProcessHeap () returned 0xd20000 [0109.207] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.207] GetProcessHeap () returned 0xd20000 [0109.207] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.207] GetProcessHeap () returned 0xd20000 [0109.207] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.207] GetProcessHeap () returned 0xd20000 [0109.207] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.207] GetProcessHeap () returned 0xd20000 [0109.207] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.207] GetProcessHeap () returned 0xd20000 [0109.207] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.207] GetProcessHeap () returned 0xd20000 [0109.208] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.208] GetProcessHeap () returned 0xd20000 [0109.208] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.208] GetProcessHeap () returned 0xd20000 [0109.208] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.208] GetProcessHeap () returned 0xd20000 [0109.208] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.208] GetProcessHeap () returned 0xd20000 [0109.208] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.208] GetProcessHeap () returned 0xd20000 [0109.208] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.208] GetProcessHeap () returned 0xd20000 [0109.208] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.208] GetProcessHeap () returned 0xd20000 [0109.208] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.208] GetProcessHeap () returned 0xd20000 [0109.208] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.208] GetProcessHeap () returned 0xd20000 [0109.208] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.209] GetProcessHeap () returned 0xd20000 [0109.209] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.209] GetProcessHeap () returned 0xd20000 [0109.209] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.209] GetProcessHeap () returned 0xd20000 [0109.209] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.209] GetProcessHeap () returned 0xd20000 [0109.209] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.209] GetProcessHeap () returned 0xd20000 [0109.209] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.209] GetProcessHeap () returned 0xd20000 [0109.209] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.209] GetProcessHeap () returned 0xd20000 [0109.209] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.209] GetProcessHeap () returned 0xd20000 [0109.209] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.209] GetProcessHeap () returned 0xd20000 [0109.209] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.209] GetProcessHeap () returned 0xd20000 [0109.209] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.210] GetProcessHeap () returned 0xd20000 [0109.210] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.210] GetProcessHeap () returned 0xd20000 [0109.210] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.210] GetProcessHeap () returned 0xd20000 [0109.210] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.210] GetProcessHeap () returned 0xd20000 [0109.210] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.210] GetProcessHeap () returned 0xd20000 [0109.210] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.210] GetProcessHeap () returned 0xd20000 [0109.210] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.210] GetProcessHeap () returned 0xd20000 [0109.210] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.210] GetProcessHeap () returned 0xd20000 [0109.210] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.210] GetProcessHeap () returned 0xd20000 [0109.210] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.210] GetProcessHeap () returned 0xd20000 [0109.210] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.211] GetProcessHeap () returned 0xd20000 [0109.211] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.211] GetProcessHeap () returned 0xd20000 [0109.211] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.211] GetProcessHeap () returned 0xd20000 [0109.211] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.211] GetProcessHeap () returned 0xd20000 [0109.260] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.260] GetProcessHeap () returned 0xd20000 [0109.260] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.260] GetProcessHeap () returned 0xd20000 [0109.260] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0109.260] GetProcessHeap () returned 0xd20000 [0109.260] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0109.260] GetProcessHeap () returned 0xd20000 [0109.260] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.260] GetProcessHeap () returned 0xd20000 [0109.260] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.260] GetProcessHeap () returned 0xd20000 [0109.260] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.260] GetProcessHeap () returned 0xd20000 [0109.260] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.260] GetProcessHeap () returned 0xd20000 [0109.261] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.261] GetProcessHeap () returned 0xd20000 [0109.261] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.261] GetProcessHeap () returned 0xd20000 [0109.261] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.261] GetProcessHeap () returned 0xd20000 [0109.261] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.261] GetProcessHeap () returned 0xd20000 [0109.261] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.261] GetProcessHeap () returned 0xd20000 [0109.261] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.261] GetProcessHeap () returned 0xd20000 [0109.261] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.261] GetProcessHeap () returned 0xd20000 [0109.261] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.261] GetProcessHeap () returned 0xd20000 [0109.261] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.261] GetProcessHeap () returned 0xd20000 [0109.261] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.261] GetProcessHeap () returned 0xd20000 [0109.261] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.261] GetProcessHeap () returned 0xd20000 [0109.261] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.262] GetProcessHeap () returned 0xd20000 [0109.262] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.262] GetProcessHeap () returned 0xd20000 [0109.262] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.262] GetProcessHeap () returned 0xd20000 [0109.262] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.262] GetProcessHeap () returned 0xd20000 [0109.262] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.262] GetProcessHeap () returned 0xd20000 [0109.262] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.262] GetProcessHeap () returned 0xd20000 [0109.262] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.262] GetProcessHeap () returned 0xd20000 [0109.262] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.262] GetProcessHeap () returned 0xd20000 [0109.262] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.262] GetProcessHeap () returned 0xd20000 [0109.262] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.262] GetProcessHeap () returned 0xd20000 [0109.262] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.262] GetProcessHeap () returned 0xd20000 [0109.262] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.262] GetProcessHeap () returned 0xd20000 [0109.263] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.263] GetProcessHeap () returned 0xd20000 [0109.263] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.263] GetProcessHeap () returned 0xd20000 [0109.263] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.263] GetProcessHeap () returned 0xd20000 [0109.263] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0109.263] GetProcessHeap () returned 0xd20000 [0109.263] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45528 | out: hHeap=0xd20000) returned 1 [0109.263] GetProcessHeap () returned 0xd20000 [0109.263] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0109.263] GetProcessHeap () returned 0xd20000 [0109.263] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0109.263] GetProcessHeap () returned 0xd20000 [0109.263] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44540 | out: hHeap=0xd20000) returned 1 [0109.263] GetProcessHeap () returned 0xd20000 [0109.263] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b638 | out: hHeap=0xd20000) returned 1 [0109.263] GetProcessHeap () returned 0xd20000 [0109.263] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44c68 | out: hHeap=0xd20000) returned 1 [0109.263] GetProcessHeap () returned 0xd20000 [0109.263] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b758 | out: hHeap=0xd20000) returned 1 [0109.263] GetProcessHeap () returned 0xd20000 [0109.264] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0109.264] GetProcessHeap () returned 0xd20000 [0109.264] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.264] GetProcessHeap () returned 0xd20000 [0109.264] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0109.264] WriteFile (in: hFile=0x230, lpBuffer=0xd4f5b0*, nNumberOfBytesToWrite=0x388, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f5b0*, lpNumberOfBytesWritten=0x299d864*=0x388, lpOverlapped=0x0) returned 1 [0109.267] GetProcessHeap () returned 0xd20000 [0109.267] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4f5b0, Size=0x30) returned 0xd4f5b0 [0109.267] GetProcessHeap () returned 0xd20000 [0109.267] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0109.267] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0109.267] GetProcessHeap () returned 0xd20000 [0109.267] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x8ce0) returned 0xd4f5e8 [0109.267] ReadFile (in: hFile=0x230, lpBuffer=0xd4f5e8, nNumberOfBytesToRead=0x8ce0, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4f5e8*, lpNumberOfBytesRead=0x299d7e8*=0x8ce0, lpOverlapped=0x0) returned 1 [0109.268] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0109.268] WriteFile (in: hFile=0x230, lpBuffer=0xd4f5e8*, nNumberOfBytesToWrite=0x8ce0, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4f5e8*, lpNumberOfBytesWritten=0x299d7e4*=0x8ce0, lpOverlapped=0x0) returned 1 [0109.270] GetProcessHeap () returned 0xd20000 [0109.270] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4f5e8 | out: hHeap=0xd20000) returned 1 [0109.270] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0109.270] WriteFile (in: hFile=0x230, lpBuffer=0xd4f5b0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f5b0*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0109.272] CloseHandle (hObject=0x230) returned 1 [0109.275] GetProcessHeap () returned 0xd20000 [0109.275] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd428c8 | out: hHeap=0xd20000) returned 1 [0109.275] GetProcessHeap () returned 0xd20000 [0109.275] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4bda0 | out: hHeap=0xd20000) returned 1 [0109.275] GetProcessHeap () returned 0xd20000 [0109.275] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0109.275] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\dnr4puGJfqjJ0AWqTZ.jpg" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\dnr4puGJfqjJ0AWqTZ.jpg") returned="C:\\Users\\FD1HVy\\Pictures\\dnr4puGJfqjJ0AWqTZ.jpg" [0109.275] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\dnr4puGJfqjJ0AWqTZ.jpg", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\dnr4puGJfqjJ0AWqTZ.jpg.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Pictures\\dnr4puGJfqjJ0AWqTZ.jpg.[ponce.lorena@aol.com]" [0109.275] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\dnr4puGJfqjJ0AWqTZ.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\dnr4pugjfqjj0awqtz.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\dnr4puGJfqjJ0AWqTZ.jpg.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\pictures\\dnr4pugjfqjj0awqtz.jpg.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0109.276] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\dnr4puGJfqjJ0AWqTZ.jpg" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0109.276] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0109.276] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html" [0109.276] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_recover.html")) returned 0x20 [0109.276] GetProcessHeap () returned 0xd20000 [0109.276] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd364c8 | out: hHeap=0xd20000) returned 1 [0109.276] FindNextFileW (in: hFindFile=0xd49120, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c719e70, ftCreationTime.dwHighDateTime=0x1d4ce58, ftLastAccessTime.dwLowDateTime=0xa8494390, ftLastAccessTime.dwHighDateTime=0x1d4c7ec, ftLastWriteTime.dwLowDateTime=0xa8494390, ftLastWriteTime.dwHighDateTime=0x1d4c7ec, nFileSizeHigh=0x0, nFileSizeLow=0xf9cd, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DQNMDmJ.png", cAlternateFileName="")) returned 1 [0109.276] lstrcmpiW (lpString1="DQNMDmJ.png", lpString2=".") returned 1 [0109.276] lstrcmpiW (lpString1="DQNMDmJ.png", lpString2="..") returned 1 [0109.276] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="DQNMDmJ.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\DQNMDmJ.png") returned="C:\\Users\\FD1HVy\\Pictures\\DQNMDmJ.png" [0109.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DQNMDmJ.png", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0109.276] GetProcessHeap () returned 0xd20000 [0109.276] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xc) returned 0xd444c8 [0109.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DQNMDmJ.png", cchWideChar=-1, lpMultiByteStr=0xd444c8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DQNMDmJ.png", lpUsedDefaultChar=0x0) returned 12 [0109.277] lstrlenA (lpString="DQNMDmJ.png") returned 11 [0109.277] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0109.277] lstrlenA (lpString="DQNMDmJ.png") returned 11 [0109.277] lstrlenA (lpString=".dll") returned 4 [0109.277] lstrlenA (lpString=".dll") returned 4 [0109.277] lstrlenA (lpString="DQNMDmJ.png") returned 11 [0109.277] lstrcmpiA (lpString1=".png", lpString2=".dll") returned 1 [0109.277] lstrlenA (lpString="DQNMDmJ.png") returned 11 [0109.277] lstrlenA (lpString=".ini") returned 4 [0109.277] lstrlenA (lpString=".ini") returned 4 [0109.277] lstrlenA (lpString="DQNMDmJ.png") returned 11 [0109.277] lstrcmpiA (lpString1=".png", lpString2=".ini") returned 1 [0109.277] lstrlenA (lpString="DQNMDmJ.png") returned 11 [0109.277] lstrlenA (lpString=".inc") returned 4 [0109.277] lstrlenA (lpString=".inc") returned 4 [0109.277] lstrlenA (lpString="DQNMDmJ.png") returned 11 [0109.277] lstrcmpiA (lpString1=".png", lpString2=".inc") returned 1 [0109.277] lstrcmpiW (lpString1="DQNMDmJ.png", lpString2="HOW_RECOVER.html") returned -1 [0109.277] lstrcmpiW (lpString1="DQNMDmJ.png", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned -1 [0109.277] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0109.278] lstrcmpiW (lpString1="DQNMDmJ.png", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0109.278] GetProcessHeap () returned 0xd20000 [0109.278] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd42828 [0109.278] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\DQNMDmJ.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dqnmdmj.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0109.278] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=63949) returned 1 [0109.278] GetProcessHeap () returned 0xd20000 [0109.278] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c250 [0109.278] GetProcessHeap () returned 0xd20000 [0109.278] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0109.278] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\DQNMDmJ.png") returned 36 [0109.278] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0109.278] GetProcessHeap () returned 0xd20000 [0109.278] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0109.278] GetProcessHeap () returned 0xd20000 [0109.278] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x380) returned 0xd4f5e8 [0109.279] lstrlenA (lpString="rsa_encrypt") returned 11 [0109.279] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0109.281] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0109.281] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0109.281] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0109.281] GetProcessHeap () returned 0xd20000 [0109.281] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0109.281] lstrlenA (lpString="010001") returned 6 [0109.281] GetProcessHeap () returned 0xd20000 [0109.281] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc18 [0109.281] GetProcessHeap () returned 0xd20000 [0109.281] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0109.281] GetProcessHeap () returned 0xd20000 [0109.281] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b5a8 [0109.281] GetProcessHeap () returned 0xd20000 [0109.281] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0109.281] GetProcessHeap () returned 0xd20000 [0109.281] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b368 [0109.281] GetProcessHeap () returned 0xd20000 [0109.281] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd44808 [0109.281] GetProcessHeap () returned 0xd20000 [0109.281] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc48 [0109.282] GetProcessHeap () returned 0xd20000 [0109.282] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44a38 [0109.282] GetProcessHeap () returned 0xd20000 [0109.282] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.282] GetProcessHeap () returned 0xd20000 [0109.282] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45410 [0109.282] GetProcessHeap () returned 0xd20000 [0109.282] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0109.282] GetProcessHeap () returned 0xd20000 [0109.282] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd452f8 [0109.282] GetProcessHeap () returned 0xd20000 [0109.282] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.282] GetProcessHeap () returned 0xd20000 [0109.282] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44498 [0109.282] GetProcessHeap () returned 0xd20000 [0109.282] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0109.282] GetProcessHeap () returned 0xd20000 [0109.282] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0109.282] GetProcessHeap () returned 0xd20000 [0109.282] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44e98 [0109.283] GetProcessHeap () returned 0xd20000 [0109.283] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0109.283] GetProcessHeap () returned 0xd20000 [0109.283] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0109.283] GetProcessHeap () returned 0xd20000 [0109.283] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44558 [0109.283] GetProcessHeap () returned 0xd20000 [0109.283] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.283] GetProcessHeap () returned 0xd20000 [0109.283] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0109.283] GetProcessHeap () returned 0xd20000 [0109.283] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.283] GetProcessHeap () returned 0xd20000 [0109.283] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.283] GetProcessHeap () returned 0xd20000 [0109.283] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.283] GetProcessHeap () returned 0xd20000 [0109.283] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.283] GetProcessHeap () returned 0xd20000 [0109.283] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b7e8 [0109.283] GetProcessHeap () returned 0xd20000 [0109.284] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44558 | out: hHeap=0xd20000) returned 1 [0109.284] GetProcessHeap () returned 0xd20000 [0109.284] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd45640 [0109.284] GetProcessHeap () returned 0xd20000 [0109.284] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b7e8 | out: hHeap=0xd20000) returned 1 [0109.284] GetProcessHeap () returned 0xd20000 [0109.284] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.284] GetProcessHeap () returned 0xd20000 [0109.284] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.284] GetProcessHeap () returned 0xd20000 [0109.284] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.284] GetProcessHeap () returned 0xd20000 [0109.284] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.284] GetProcessHeap () returned 0xd20000 [0109.284] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.284] GetProcessHeap () returned 0xd20000 [0109.284] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.284] GetProcessHeap () returned 0xd20000 [0109.284] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.284] GetProcessHeap () returned 0xd20000 [0109.284] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.285] GetProcessHeap () returned 0xd20000 [0109.285] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.285] GetProcessHeap () returned 0xd20000 [0109.285] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.285] GetProcessHeap () returned 0xd20000 [0109.285] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.285] GetProcessHeap () returned 0xd20000 [0109.285] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.285] GetProcessHeap () returned 0xd20000 [0109.285] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.285] GetProcessHeap () returned 0xd20000 [0109.285] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.285] GetProcessHeap () returned 0xd20000 [0109.285] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.285] GetProcessHeap () returned 0xd20000 [0109.285] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.285] GetProcessHeap () returned 0xd20000 [0109.285] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.285] GetProcessHeap () returned 0xd20000 [0109.285] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.285] GetProcessHeap () returned 0xd20000 [0109.286] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.286] GetProcessHeap () returned 0xd20000 [0109.286] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.286] GetProcessHeap () returned 0xd20000 [0109.286] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.286] GetProcessHeap () returned 0xd20000 [0109.286] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.286] GetProcessHeap () returned 0xd20000 [0109.286] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.286] GetProcessHeap () returned 0xd20000 [0109.286] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.286] GetProcessHeap () returned 0xd20000 [0109.286] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.286] GetProcessHeap () returned 0xd20000 [0109.286] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.286] GetProcessHeap () returned 0xd20000 [0109.286] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.286] GetProcessHeap () returned 0xd20000 [0109.286] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.287] GetProcessHeap () returned 0xd20000 [0109.287] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.287] GetProcessHeap () returned 0xd20000 [0109.287] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.287] GetProcessHeap () returned 0xd20000 [0109.287] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.287] GetProcessHeap () returned 0xd20000 [0109.287] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.287] GetProcessHeap () returned 0xd20000 [0109.287] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.287] GetProcessHeap () returned 0xd20000 [0109.287] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.287] GetProcessHeap () returned 0xd20000 [0109.287] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.287] GetProcessHeap () returned 0xd20000 [0109.287] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.287] GetProcessHeap () returned 0xd20000 [0109.287] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.287] GetProcessHeap () returned 0xd20000 [0109.287] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.287] GetProcessHeap () returned 0xd20000 [0109.288] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.288] GetProcessHeap () returned 0xd20000 [0109.288] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.288] GetProcessHeap () returned 0xd20000 [0109.288] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.288] GetProcessHeap () returned 0xd20000 [0109.288] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.288] GetProcessHeap () returned 0xd20000 [0109.288] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.288] GetProcessHeap () returned 0xd20000 [0109.288] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.288] GetProcessHeap () returned 0xd20000 [0109.288] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.288] GetProcessHeap () returned 0xd20000 [0109.288] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.288] GetProcessHeap () returned 0xd20000 [0109.288] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.288] GetProcessHeap () returned 0xd20000 [0109.288] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.288] GetProcessHeap () returned 0xd20000 [0109.288] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.288] GetProcessHeap () returned 0xd20000 [0109.289] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.289] GetProcessHeap () returned 0xd20000 [0109.289] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.289] GetProcessHeap () returned 0xd20000 [0109.289] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.289] GetProcessHeap () returned 0xd20000 [0109.289] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.289] GetProcessHeap () returned 0xd20000 [0109.289] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.289] GetProcessHeap () returned 0xd20000 [0109.289] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.290] GetProcessHeap () returned 0xd20000 [0109.290] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.290] GetProcessHeap () returned 0xd20000 [0109.290] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.290] GetProcessHeap () returned 0xd20000 [0109.290] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.290] GetProcessHeap () returned 0xd20000 [0109.290] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.290] GetProcessHeap () returned 0xd20000 [0109.290] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.290] GetProcessHeap () returned 0xd20000 [0109.290] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.290] GetProcessHeap () returned 0xd20000 [0109.290] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.290] GetProcessHeap () returned 0xd20000 [0109.290] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.290] GetProcessHeap () returned 0xd20000 [0109.290] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.291] GetProcessHeap () returned 0xd20000 [0109.291] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.291] GetProcessHeap () returned 0xd20000 [0109.291] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.291] GetProcessHeap () returned 0xd20000 [0109.291] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.291] GetProcessHeap () returned 0xd20000 [0109.291] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.291] GetProcessHeap () returned 0xd20000 [0109.291] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.291] GetProcessHeap () returned 0xd20000 [0109.291] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.291] GetProcessHeap () returned 0xd20000 [0109.291] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.291] GetProcessHeap () returned 0xd20000 [0109.291] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.291] GetProcessHeap () returned 0xd20000 [0109.291] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.291] GetProcessHeap () returned 0xd20000 [0109.291] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.292] GetProcessHeap () returned 0xd20000 [0109.292] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.292] GetProcessHeap () returned 0xd20000 [0109.292] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.292] GetProcessHeap () returned 0xd20000 [0109.292] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.292] GetProcessHeap () returned 0xd20000 [0109.292] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.292] GetProcessHeap () returned 0xd20000 [0109.292] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0109.292] GetProcessHeap () returned 0xd20000 [0109.292] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0109.292] GetProcessHeap () returned 0xd20000 [0109.292] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0109.292] GetProcessHeap () returned 0xd20000 [0109.292] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0109.292] GetProcessHeap () returned 0xd20000 [0109.292] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.292] GetProcessHeap () returned 0xd20000 [0109.292] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.293] GetProcessHeap () returned 0xd20000 [0109.293] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.293] GetProcessHeap () returned 0xd20000 [0109.293] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.293] GetProcessHeap () returned 0xd20000 [0109.293] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.293] GetProcessHeap () returned 0xd20000 [0109.293] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.293] GetProcessHeap () returned 0xd20000 [0109.293] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.293] GetProcessHeap () returned 0xd20000 [0109.293] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.293] GetProcessHeap () returned 0xd20000 [0109.293] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.293] GetProcessHeap () returned 0xd20000 [0109.293] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.293] GetProcessHeap () returned 0xd20000 [0109.293] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.293] GetProcessHeap () returned 0xd20000 [0109.293] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.294] GetProcessHeap () returned 0xd20000 [0109.294] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.294] GetProcessHeap () returned 0xd20000 [0109.294] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.294] GetProcessHeap () returned 0xd20000 [0109.294] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.294] GetProcessHeap () returned 0xd20000 [0109.294] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.294] GetProcessHeap () returned 0xd20000 [0109.294] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.294] GetProcessHeap () returned 0xd20000 [0109.294] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.294] GetProcessHeap () returned 0xd20000 [0109.294] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.294] GetProcessHeap () returned 0xd20000 [0109.294] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.294] GetProcessHeap () returned 0xd20000 [0109.294] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.294] GetProcessHeap () returned 0xd20000 [0109.294] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.295] GetProcessHeap () returned 0xd20000 [0109.295] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.295] GetProcessHeap () returned 0xd20000 [0109.295] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.295] GetProcessHeap () returned 0xd20000 [0109.295] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.295] GetProcessHeap () returned 0xd20000 [0109.295] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.295] GetProcessHeap () returned 0xd20000 [0109.295] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0109.295] GetProcessHeap () returned 0xd20000 [0109.295] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0109.295] GetProcessHeap () returned 0xd20000 [0109.295] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.295] GetProcessHeap () returned 0xd20000 [0109.295] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.295] GetProcessHeap () returned 0xd20000 [0109.295] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.295] GetProcessHeap () returned 0xd20000 [0109.295] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.295] GetProcessHeap () returned 0xd20000 [0109.296] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.296] GetProcessHeap () returned 0xd20000 [0109.296] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.296] GetProcessHeap () returned 0xd20000 [0109.296] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.296] GetProcessHeap () returned 0xd20000 [0109.296] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.296] GetProcessHeap () returned 0xd20000 [0109.296] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.296] GetProcessHeap () returned 0xd20000 [0109.296] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.296] GetProcessHeap () returned 0xd20000 [0109.296] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.296] GetProcessHeap () returned 0xd20000 [0109.296] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.296] GetProcessHeap () returned 0xd20000 [0109.296] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.296] GetProcessHeap () returned 0xd20000 [0109.296] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.296] GetProcessHeap () returned 0xd20000 [0109.297] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.297] GetProcessHeap () returned 0xd20000 [0109.297] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.297] GetProcessHeap () returned 0xd20000 [0109.297] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.297] GetProcessHeap () returned 0xd20000 [0109.297] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.297] GetProcessHeap () returned 0xd20000 [0109.297] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.297] GetProcessHeap () returned 0xd20000 [0109.297] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.297] GetProcessHeap () returned 0xd20000 [0109.297] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.297] GetProcessHeap () returned 0xd20000 [0109.297] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.297] GetProcessHeap () returned 0xd20000 [0109.297] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.297] GetProcessHeap () returned 0xd20000 [0109.297] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.297] GetProcessHeap () returned 0xd20000 [0109.297] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.297] GetProcessHeap () returned 0xd20000 [0109.298] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.298] GetProcessHeap () returned 0xd20000 [0109.298] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.298] GetProcessHeap () returned 0xd20000 [0109.298] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.298] GetProcessHeap () returned 0xd20000 [0109.298] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.298] GetProcessHeap () returned 0xd20000 [0109.298] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.298] GetProcessHeap () returned 0xd20000 [0109.298] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.298] GetProcessHeap () returned 0xd20000 [0109.298] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.298] GetProcessHeap () returned 0xd20000 [0109.298] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.298] GetProcessHeap () returned 0xd20000 [0109.298] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.298] GetProcessHeap () returned 0xd20000 [0109.298] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.298] GetProcessHeap () returned 0xd20000 [0109.298] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.299] GetProcessHeap () returned 0xd20000 [0109.299] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.299] GetProcessHeap () returned 0xd20000 [0109.299] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.299] GetProcessHeap () returned 0xd20000 [0109.299] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.299] GetProcessHeap () returned 0xd20000 [0109.299] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.299] GetProcessHeap () returned 0xd20000 [0109.299] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.299] GetProcessHeap () returned 0xd20000 [0109.299] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.299] GetProcessHeap () returned 0xd20000 [0109.299] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.299] GetProcessHeap () returned 0xd20000 [0109.299] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.299] GetProcessHeap () returned 0xd20000 [0109.299] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.299] GetProcessHeap () returned 0xd20000 [0109.299] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.299] GetProcessHeap () returned 0xd20000 [0109.300] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.300] GetProcessHeap () returned 0xd20000 [0109.300] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.300] GetProcessHeap () returned 0xd20000 [0109.300] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.300] GetProcessHeap () returned 0xd20000 [0109.300] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.300] GetProcessHeap () returned 0xd20000 [0109.300] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.300] GetProcessHeap () returned 0xd20000 [0109.300] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.300] GetProcessHeap () returned 0xd20000 [0109.300] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.300] GetProcessHeap () returned 0xd20000 [0109.300] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.300] GetProcessHeap () returned 0xd20000 [0109.300] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.300] GetProcessHeap () returned 0xd20000 [0109.300] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.300] GetProcessHeap () returned 0xd20000 [0109.301] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.301] GetProcessHeap () returned 0xd20000 [0109.301] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.301] GetProcessHeap () returned 0xd20000 [0109.301] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.301] GetProcessHeap () returned 0xd20000 [0109.301] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.301] GetProcessHeap () returned 0xd20000 [0109.301] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45410 | out: hHeap=0xd20000) returned 1 [0109.301] GetProcessHeap () returned 0xd20000 [0109.301] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44e98 | out: hHeap=0xd20000) returned 1 [0109.301] GetProcessHeap () returned 0xd20000 [0109.301] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd452f8 | out: hHeap=0xd20000) returned 1 [0109.301] GetProcessHeap () returned 0xd20000 [0109.301] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd45640 | out: hHeap=0xd20000) returned 1 [0109.301] GetProcessHeap () returned 0xd20000 [0109.301] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44498 | out: hHeap=0xd20000) returned 1 [0109.301] GetProcessHeap () returned 0xd20000 [0109.301] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b368 | out: hHeap=0xd20000) returned 1 [0109.301] GetProcessHeap () returned 0xd20000 [0109.302] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0109.302] GetProcessHeap () returned 0xd20000 [0109.302] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b5a8 | out: hHeap=0xd20000) returned 1 [0109.302] GetProcessHeap () returned 0xd20000 [0109.302] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44a38 | out: hHeap=0xd20000) returned 1 [0109.302] GetProcessHeap () returned 0xd20000 [0109.302] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.302] GetProcessHeap () returned 0xd20000 [0109.302] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0109.302] WriteFile (in: hFile=0x230, lpBuffer=0xd4f5e8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f5e8*, lpNumberOfBytesWritten=0x299d864*=0x380, lpOverlapped=0x0) returned 1 [0109.304] GetProcessHeap () returned 0xd20000 [0109.304] RtlReAllocateHeap (Heap=0xd20000, Flags=0x0, Ptr=0xd4f5e8, Size=0x30) returned 0xd4f5e8 [0109.305] GetProcessHeap () returned 0xd20000 [0109.305] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd479b8 | out: hHeap=0xd20000) returned 1 [0109.305] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0109.305] GetProcessHeap () returned 0xd20000 [0109.305] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xf9cd) returned 0xd4f620 [0109.305] ReadFile (in: hFile=0x230, lpBuffer=0xd4f620, nNumberOfBytesToRead=0xf9cd, lpNumberOfBytesRead=0x299d7e8, lpOverlapped=0x0 | out: lpBuffer=0xd4f620*, lpNumberOfBytesRead=0x299d7e8*=0xf9cd, lpOverlapped=0x0) returned 1 [0109.307] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d7b8 | out: lpNewFilePointer=0x0) returned 1 [0109.307] WriteFile (in: hFile=0x230, lpBuffer=0xd4f620*, nNumberOfBytesToWrite=0xf9cd, lpNumberOfBytesWritten=0x299d7e4, lpOverlapped=0x0 | out: lpBuffer=0xd4f620*, lpNumberOfBytesWritten=0x299d7e4*=0xf9cd, lpOverlapped=0x0) returned 1 [0109.309] GetProcessHeap () returned 0xd20000 [0109.309] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4f620 | out: hHeap=0xd20000) returned 1 [0109.309] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0109.309] WriteFile (in: hFile=0x230, lpBuffer=0xd4f5e8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0 | out: lpBuffer=0xd4f5e8*, lpNumberOfBytesWritten=0x299d864*=0x30, lpOverlapped=0x0) returned 1 [0109.310] CloseHandle (hObject=0x230) returned 1 [0109.314] GetProcessHeap () returned 0xd20000 [0109.314] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd42828 | out: hHeap=0xd20000) returned 1 [0109.314] GetProcessHeap () returned 0xd20000 [0109.315] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4c250 | out: hHeap=0xd20000) returned 1 [0109.315] GetProcessHeap () returned 0xd20000 [0109.315] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd26760 | out: hHeap=0xd20000) returned 1 [0109.315] lstrcpyW (in: lpString1=0x299ef84, lpString2="C:\\Users\\FD1HVy\\Pictures\\DQNMDmJ.png" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\DQNMDmJ.png") returned="C:\\Users\\FD1HVy\\Pictures\\DQNMDmJ.png" [0109.315] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\DQNMDmJ.png", lpString2=".[ponce.lorena@aol.com]" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\DQNMDmJ.png.[ponce.lorena@aol.com]") returned="C:\\Users\\FD1HVy\\Pictures\\DQNMDmJ.png.[ponce.lorena@aol.com]" [0109.315] MoveFileExW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\DQNMDmJ.png" (normalized: "c:\\users\\fd1hvy\\pictures\\dqnmdmj.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\DQNMDmJ.png.[ponce.lorena@aol.com]" (normalized: "c:\\users\\fd1hvy\\pictures\\dqnmdmj.png.[ponce.lorena@aol.com]"), dwFlags=0x1) returned 1 [0109.316] PathRemoveFileSpecW (in: pszPath="C:\\Users\\FD1HVy\\Pictures\\DQNMDmJ.png" | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0109.316] PathAddBackslashW (in: pszPath="C:\\Users\\FD1HVy\\Pictures" | out: pszPath="C:\\Users\\FD1HVy\\Pictures\\") returned="" [0109.316] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="HOW_RECOVER.html" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html") returned="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html" [0109.316] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\HOW_RECOVER.html" (normalized: "c:\\users\\fd1hvy\\pictures\\how_recover.html")) returned 0x20 [0109.316] GetProcessHeap () returned 0xd20000 [0109.316] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd444c8 | out: hHeap=0xd20000) returned 1 [0109.316] FindNextFileW (in: hFindFile=0xd49120, lpFindFileData=0x299d9f4 | out: lpFindFileData=0x299d9f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb893ca50, ftCreationTime.dwHighDateTime=0x1d4d2f9, ftLastAccessTime.dwLowDateTime=0x824bdb00, ftLastAccessTime.dwHighDateTime=0x1d4c96b, ftLastWriteTime.dwLowDateTime=0x824bdb00, ftLastWriteTime.dwHighDateTime=0x1d4c96b, nFileSizeHigh=0x0, nFileSizeLow=0x18c57, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FqXWoi.gif", cAlternateFileName="")) returned 1 [0109.316] lstrcmpiW (lpString1="FqXWoi.gif", lpString2=".") returned 1 [0109.316] lstrcmpiW (lpString1="FqXWoi.gif", lpString2="..") returned 1 [0109.316] lstrcatW (in: lpString1="C:\\Users\\FD1HVy\\Pictures\\", lpString2="FqXWoi.gif" | out: lpString1="C:\\Users\\FD1HVy\\Pictures\\FqXWoi.gif") returned="C:\\Users\\FD1HVy\\Pictures\\FqXWoi.gif" [0109.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FqXWoi.gif", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0109.317] GetProcessHeap () returned 0xd20000 [0109.317] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0xb) returned 0xd44498 [0109.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="FqXWoi.gif", cchWideChar=-1, lpMultiByteStr=0xd44498, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FqXWoi.gif", lpUsedDefaultChar=0x0) returned 11 [0109.317] lstrlenA (lpString="FqXWoi.gif") returned 10 [0109.317] lstrlenA (lpString=".[ponce.lorena@aol.com]") returned 23 [0109.317] lstrlenA (lpString="FqXWoi.gif") returned 10 [0109.317] lstrlenA (lpString=".dll") returned 4 [0109.317] lstrlenA (lpString=".dll") returned 4 [0109.317] lstrlenA (lpString="FqXWoi.gif") returned 10 [0109.317] lstrcmpiA (lpString1=".gif", lpString2=".dll") returned 1 [0109.317] lstrlenA (lpString="FqXWoi.gif") returned 10 [0109.317] lstrlenA (lpString=".ini") returned 4 [0109.317] lstrlenA (lpString=".ini") returned 4 [0109.317] lstrlenA (lpString="FqXWoi.gif") returned 10 [0109.317] lstrcmpiA (lpString1=".gif", lpString2=".ini") returned -1 [0109.317] lstrlenA (lpString="FqXWoi.gif") returned 10 [0109.317] lstrlenA (lpString=".inc") returned 4 [0109.317] lstrlenA (lpString=".inc") returned 4 [0109.317] lstrlenA (lpString="FqXWoi.gif") returned 10 [0109.317] lstrcmpiA (lpString1=".gif", lpString2=".inc") returned -1 [0109.318] lstrcmpiW (lpString1="FqXWoi.gif", lpString2="HOW_RECOVER.html") returned -1 [0109.318] lstrcmpiW (lpString1="FqXWoi.gif", lpString2="F4B9E43E8B778FBD0715CCE57F573AE11F3E1BA40B1CA4265C360A3997B1A474") returned 1 [0109.318] PathFindFileNameW (pszPath="C:\\Users\\FD1HVy\\Desktop\\%LOCALAPPDATA%SAMPLE.EXE.exe") returned="%LOCALAPPDATA%SAMPLE.EXE.exe" [0109.318] lstrcmpiW (lpString1="FqXWoi.gif", lpString2="%LOCALAPPDATA%SAMPLE.EXE.exe") returned 1 [0109.318] GetProcessHeap () returned 0xd20000 [0109.318] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x20) returned 0xd426c0 [0109.318] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\FqXWoi.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\fqxwoi.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x230 [0109.318] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x299d83c | out: lpFileSize=0x299d83c*=101463) returned 1 [0109.318] GetProcessHeap () returned 0xd20000 [0109.318] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x6c) returned 0xd4c070 [0109.318] GetProcessHeap () returned 0xd20000 [0109.318] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd26760 [0109.318] lstrlenW (lpString="C:\\Users\\FD1HVy\\Pictures\\FqXWoi.gif") returned 35 [0109.319] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x299d800 | out: lpNewFilePointer=0x0) returned 1 [0109.319] GetProcessHeap () returned 0xd20000 [0109.319] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x200) returned 0xd479b8 [0109.319] GetProcessHeap () returned 0xd20000 [0109.319] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x0, Size=0x389) returned 0xd4f620 [0109.319] lstrlenA (lpString="rsa_encrypt") returned 11 [0109.319] CryptAcquireContextW (in: phProv=0x299cd30, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x299cd30*=0xd3ba60) returned 1 [0109.322] CryptGenRandom (in: hProv=0xd3ba60, dwLen=0x80, pbBuffer=0x299cd48 | out: pbBuffer=0x299cd48) returned 1 [0109.322] CryptReleaseContext (hProv=0xd3ba60, dwFlags=0x0) returned 1 [0109.322] lstrlenA (lpString="9CC89E01EB7BF37D3A252CD1254228373DBFB7172D7418BB84943E64C43BA3852A8481B0987253586F8C40F0E4B1899C17F689AEEBE5CCAEA892395EEFA86BAD6712F5249B9E2624F33C637F71E0349B508A9CB3BB439DAC0C90381B081C5D816E2EB7A62E436D595422DC2EEFD48E22A656EEF851D8A41B97193AC1DF21CCB3") returned 256 [0109.322] GetProcessHeap () returned 0xd20000 [0109.322] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd3ba60 [0109.323] lstrlenA (lpString="010001") returned 6 [0109.323] GetProcessHeap () returned 0xd20000 [0109.323] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc18 [0109.323] GetProcessHeap () returned 0xd20000 [0109.323] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0109.323] GetProcessHeap () returned 0xd20000 [0109.323] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4aee8 [0109.323] GetProcessHeap () returned 0xd20000 [0109.323] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0109.323] GetProcessHeap () returned 0xd20000 [0109.323] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b1b8 [0109.323] GetProcessHeap () returned 0xd20000 [0109.323] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x108) returned 0xd450c8 [0109.323] GetProcessHeap () returned 0xd20000 [0109.323] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x4) returned 0xd3cc48 [0109.323] GetProcessHeap () returned 0xd20000 [0109.323] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44fb0 [0109.323] GetProcessHeap () returned 0xd20000 [0109.324] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.324] GetProcessHeap () returned 0xd20000 [0109.324] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44d80 [0109.324] GetProcessHeap () returned 0xd20000 [0109.324] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x80) returned 0xd2f820 [0109.324] GetProcessHeap () returned 0xd20000 [0109.324] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x10c) returned 0xd44808 [0109.324] GetProcessHeap () returned 0xd20000 [0109.324] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.324] GetProcessHeap () returned 0xd20000 [0109.324] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44690 [0109.324] GetProcessHeap () returned 0xd20000 [0109.324] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x84) returned 0xd4b518 [0109.324] GetProcessHeap () returned 0xd20000 [0109.324] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd2f820 | out: hHeap=0xd20000) returned 1 [0109.324] GetProcessHeap () returned 0xd20000 [0109.324] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd44920 [0109.324] GetProcessHeap () returned 0xd20000 [0109.324] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b518 | out: hHeap=0xd20000) returned 1 [0109.324] GetProcessHeap () returned 0xd20000 [0109.324] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0109.325] GetProcessHeap () returned 0xd20000 [0109.325] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0xc) returned 0xd44528 [0109.325] GetProcessHeap () returned 0xd20000 [0109.325] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.325] GetProcessHeap () returned 0xd20000 [0109.325] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0109.325] GetProcessHeap () returned 0xd20000 [0109.325] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.325] GetProcessHeap () returned 0xd20000 [0109.325] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.325] GetProcessHeap () returned 0xd20000 [0109.325] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.325] GetProcessHeap () returned 0xd20000 [0109.325] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.325] GetProcessHeap () returned 0xd20000 [0109.325] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x88) returned 0xd4b878 [0109.325] GetProcessHeap () returned 0xd20000 [0109.325] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44528 | out: hHeap=0xd20000) returned 1 [0109.325] GetProcessHeap () returned 0xd20000 [0109.325] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x104) returned 0xd451e0 [0109.325] GetProcessHeap () returned 0xd20000 [0109.326] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b878 | out: hHeap=0xd20000) returned 1 [0109.326] GetProcessHeap () returned 0xd20000 [0109.326] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.326] GetProcessHeap () returned 0xd20000 [0109.326] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.326] GetProcessHeap () returned 0xd20000 [0109.326] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.326] GetProcessHeap () returned 0xd20000 [0109.326] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.326] GetProcessHeap () returned 0xd20000 [0109.326] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.326] GetProcessHeap () returned 0xd20000 [0109.326] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.326] GetProcessHeap () returned 0xd20000 [0109.326] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.326] GetProcessHeap () returned 0xd20000 [0109.326] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.326] GetProcessHeap () returned 0xd20000 [0109.326] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.326] GetProcessHeap () returned 0xd20000 [0109.327] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.327] GetProcessHeap () returned 0xd20000 [0109.327] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.327] GetProcessHeap () returned 0xd20000 [0109.327] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.327] GetProcessHeap () returned 0xd20000 [0109.327] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.327] GetProcessHeap () returned 0xd20000 [0109.327] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.327] GetProcessHeap () returned 0xd20000 [0109.327] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.327] GetProcessHeap () returned 0xd20000 [0109.327] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.327] GetProcessHeap () returned 0xd20000 [0109.327] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.327] GetProcessHeap () returned 0xd20000 [0109.327] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.327] GetProcessHeap () returned 0xd20000 [0109.327] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.327] GetProcessHeap () returned 0xd20000 [0109.328] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.328] GetProcessHeap () returned 0xd20000 [0109.328] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.328] GetProcessHeap () returned 0xd20000 [0109.328] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.328] GetProcessHeap () returned 0xd20000 [0109.328] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.328] GetProcessHeap () returned 0xd20000 [0109.328] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.328] GetProcessHeap () returned 0xd20000 [0109.328] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.328] GetProcessHeap () returned 0xd20000 [0109.328] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.328] GetProcessHeap () returned 0xd20000 [0109.328] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.329] GetProcessHeap () returned 0xd20000 [0109.329] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.329] GetProcessHeap () returned 0xd20000 [0109.329] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.329] GetProcessHeap () returned 0xd20000 [0109.329] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.329] GetProcessHeap () returned 0xd20000 [0109.329] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.329] GetProcessHeap () returned 0xd20000 [0109.329] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.329] GetProcessHeap () returned 0xd20000 [0109.329] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.329] GetProcessHeap () returned 0xd20000 [0109.329] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.329] GetProcessHeap () returned 0xd20000 [0109.330] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.330] GetProcessHeap () returned 0xd20000 [0109.330] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.330] GetProcessHeap () returned 0xd20000 [0109.330] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.330] GetProcessHeap () returned 0xd20000 [0109.330] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.330] GetProcessHeap () returned 0xd20000 [0109.330] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.330] GetProcessHeap () returned 0xd20000 [0109.330] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.330] GetProcessHeap () returned 0xd20000 [0109.330] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.330] GetProcessHeap () returned 0xd20000 [0109.330] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.330] GetProcessHeap () returned 0xd20000 [0109.330] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.331] GetProcessHeap () returned 0xd20000 [0109.331] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.331] GetProcessHeap () returned 0xd20000 [0109.331] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.331] GetProcessHeap () returned 0xd20000 [0109.331] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.331] GetProcessHeap () returned 0xd20000 [0109.331] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.331] GetProcessHeap () returned 0xd20000 [0109.331] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.331] GetProcessHeap () returned 0xd20000 [0109.331] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.331] GetProcessHeap () returned 0xd20000 [0109.331] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.331] GetProcessHeap () returned 0xd20000 [0109.331] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.331] GetProcessHeap () returned 0xd20000 [0109.332] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.332] GetProcessHeap () returned 0xd20000 [0109.332] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0109.332] GetProcessHeap () returned 0xd20000 [0109.332] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0109.332] GetProcessHeap () returned 0xd20000 [0109.332] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.332] GetProcessHeap () returned 0xd20000 [0109.332] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.332] GetProcessHeap () returned 0xd20000 [0109.332] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.332] GetProcessHeap () returned 0xd20000 [0109.332] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.332] GetProcessHeap () returned 0xd20000 [0109.332] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.333] GetProcessHeap () returned 0xd20000 [0109.333] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.333] GetProcessHeap () returned 0xd20000 [0109.333] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.333] GetProcessHeap () returned 0xd20000 [0109.333] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.333] GetProcessHeap () returned 0xd20000 [0109.333] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.333] GetProcessHeap () returned 0xd20000 [0109.333] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.333] GetProcessHeap () returned 0xd20000 [0109.333] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.333] GetProcessHeap () returned 0xd20000 [0109.333] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.334] GetProcessHeap () returned 0xd20000 [0109.334] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.334] GetProcessHeap () returned 0xd20000 [0109.334] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.334] GetProcessHeap () returned 0xd20000 [0109.334] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.334] GetProcessHeap () returned 0xd20000 [0109.334] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.334] GetProcessHeap () returned 0xd20000 [0109.334] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.334] GetProcessHeap () returned 0xd20000 [0109.334] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.334] GetProcessHeap () returned 0xd20000 [0109.334] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.334] GetProcessHeap () returned 0xd20000 [0109.334] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.334] GetProcessHeap () returned 0xd20000 [0109.334] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.334] GetProcessHeap () returned 0xd20000 [0109.334] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.335] GetProcessHeap () returned 0xd20000 [0109.335] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.335] GetProcessHeap () returned 0xd20000 [0109.335] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.335] GetProcessHeap () returned 0xd20000 [0109.335] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.335] GetProcessHeap () returned 0xd20000 [0109.335] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.335] GetProcessHeap () returned 0xd20000 [0109.335] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.335] GetProcessHeap () returned 0xd20000 [0109.335] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.335] GetProcessHeap () returned 0xd20000 [0109.335] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.335] GetProcessHeap () returned 0xd20000 [0109.335] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.335] GetProcessHeap () returned 0xd20000 [0109.335] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.335] GetProcessHeap () returned 0xd20000 [0109.335] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.335] GetProcessHeap () returned 0xd20000 [0109.336] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.336] GetProcessHeap () returned 0xd20000 [0109.336] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.336] GetProcessHeap () returned 0xd20000 [0109.336] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.336] GetProcessHeap () returned 0xd20000 [0109.336] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.337] GetProcessHeap () returned 0xd20000 [0109.337] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.338] GetProcessHeap () returned 0xd20000 [0109.338] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.338] GetProcessHeap () returned 0xd20000 [0109.338] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.338] GetProcessHeap () returned 0xd20000 [0109.338] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.338] GetProcessHeap () returned 0xd20000 [0109.338] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.338] GetProcessHeap () returned 0xd20000 [0109.338] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.338] GetProcessHeap () returned 0xd20000 [0109.338] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.338] GetProcessHeap () returned 0xd20000 [0109.338] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.338] GetProcessHeap () returned 0xd20000 [0109.338] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.338] GetProcessHeap () returned 0xd20000 [0109.338] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.338] GetProcessHeap () returned 0xd20000 [0109.338] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.339] GetProcessHeap () returned 0xd20000 [0109.339] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.339] GetProcessHeap () returned 0xd20000 [0109.339] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.339] GetProcessHeap () returned 0xd20000 [0109.339] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.339] GetProcessHeap () returned 0xd20000 [0109.339] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.339] GetProcessHeap () returned 0xd20000 [0109.339] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.339] GetProcessHeap () returned 0xd20000 [0109.339] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.339] GetProcessHeap () returned 0xd20000 [0109.339] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.339] GetProcessHeap () returned 0xd20000 [0109.339] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.339] GetProcessHeap () returned 0xd20000 [0109.339] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.339] GetProcessHeap () returned 0xd20000 [0109.339] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.340] GetProcessHeap () returned 0xd20000 [0109.340] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.340] GetProcessHeap () returned 0xd20000 [0109.340] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0109.340] GetProcessHeap () returned 0xd20000 [0109.340] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0109.340] GetProcessHeap () returned 0xd20000 [0109.340] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.340] GetProcessHeap () returned 0xd20000 [0109.340] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.340] GetProcessHeap () returned 0xd20000 [0109.340] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.340] GetProcessHeap () returned 0xd20000 [0109.340] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.340] GetProcessHeap () returned 0xd20000 [0109.340] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.340] GetProcessHeap () returned 0xd20000 [0109.340] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.340] GetProcessHeap () returned 0xd20000 [0109.340] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.341] GetProcessHeap () returned 0xd20000 [0109.341] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.341] GetProcessHeap () returned 0xd20000 [0109.341] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.341] GetProcessHeap () returned 0xd20000 [0109.341] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.341] GetProcessHeap () returned 0xd20000 [0109.341] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.341] GetProcessHeap () returned 0xd20000 [0109.341] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.341] GetProcessHeap () returned 0xd20000 [0109.341] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.341] GetProcessHeap () returned 0xd20000 [0109.341] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.341] GetProcessHeap () returned 0xd20000 [0109.341] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.341] GetProcessHeap () returned 0xd20000 [0109.341] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.341] GetProcessHeap () returned 0xd20000 [0109.341] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.341] GetProcessHeap () returned 0xd20000 [0109.342] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.342] GetProcessHeap () returned 0xd20000 [0109.342] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.342] GetProcessHeap () returned 0xd20000 [0109.342] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.342] GetProcessHeap () returned 0xd20000 [0109.342] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.342] GetProcessHeap () returned 0xd20000 [0109.342] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.342] GetProcessHeap () returned 0xd20000 [0109.342] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.342] GetProcessHeap () returned 0xd20000 [0109.342] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.342] GetProcessHeap () returned 0xd20000 [0109.342] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.342] GetProcessHeap () returned 0xd20000 [0109.342] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.342] GetProcessHeap () returned 0xd20000 [0109.342] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.342] GetProcessHeap () returned 0xd20000 [0109.342] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.343] GetProcessHeap () returned 0xd20000 [0109.343] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.343] GetProcessHeap () returned 0xd20000 [0109.343] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.343] GetProcessHeap () returned 0xd20000 [0109.343] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.343] GetProcessHeap () returned 0xd20000 [0109.343] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.343] GetProcessHeap () returned 0xd20000 [0109.343] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.343] GetProcessHeap () returned 0xd20000 [0109.343] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.343] GetProcessHeap () returned 0xd20000 [0109.343] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.343] GetProcessHeap () returned 0xd20000 [0109.343] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.343] GetProcessHeap () returned 0xd20000 [0109.343] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.343] GetProcessHeap () returned 0xd20000 [0109.343] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.344] GetProcessHeap () returned 0xd20000 [0109.344] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.344] GetProcessHeap () returned 0xd20000 [0109.344] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.344] GetProcessHeap () returned 0xd20000 [0109.344] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.344] GetProcessHeap () returned 0xd20000 [0109.344] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.344] GetProcessHeap () returned 0xd20000 [0109.344] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.344] GetProcessHeap () returned 0xd20000 [0109.344] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.344] GetProcessHeap () returned 0xd20000 [0109.344] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.344] GetProcessHeap () returned 0xd20000 [0109.344] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.344] GetProcessHeap () returned 0xd20000 [0109.344] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.344] GetProcessHeap () returned 0xd20000 [0109.344] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.344] GetProcessHeap () returned 0xd20000 [0109.344] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0109.345] GetProcessHeap () returned 0xd20000 [0109.345] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0109.345] GetProcessHeap () returned 0xd20000 [0109.345] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.345] GetProcessHeap () returned 0xd20000 [0109.345] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.345] GetProcessHeap () returned 0xd20000 [0109.345] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc58 [0109.345] GetProcessHeap () returned 0xd20000 [0109.345] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc58 | out: hHeap=0xd20000) returned 1 [0109.345] GetProcessHeap () returned 0xd20000 [0109.345] RtlAllocateHeap (HeapHandle=0xd20000, Flags=0x8, Size=0x8) returned 0xd3cc48 [0109.345] GetProcessHeap () returned 0xd20000 [0109.345] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc48 | out: hHeap=0xd20000) returned 1 [0109.345] GetProcessHeap () returned 0xd20000 [0109.345] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44d80 | out: hHeap=0xd20000) returned 1 [0109.345] GetProcessHeap () returned 0xd20000 [0109.345] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44920 | out: hHeap=0xd20000) returned 1 [0109.345] GetProcessHeap () returned 0xd20000 [0109.345] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44808 | out: hHeap=0xd20000) returned 1 [0109.345] GetProcessHeap () returned 0xd20000 [0109.345] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd451e0 | out: hHeap=0xd20000) returned 1 [0109.345] GetProcessHeap () returned 0xd20000 [0109.346] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44690 | out: hHeap=0xd20000) returned 1 [0109.346] GetProcessHeap () returned 0xd20000 [0109.346] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4b1b8 | out: hHeap=0xd20000) returned 1 [0109.346] GetProcessHeap () returned 0xd20000 [0109.346] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd450c8 | out: hHeap=0xd20000) returned 1 [0109.346] GetProcessHeap () returned 0xd20000 [0109.346] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd4aee8 | out: hHeap=0xd20000) returned 1 [0109.346] GetProcessHeap () returned 0xd20000 [0109.346] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd44fb0 | out: hHeap=0xd20000) returned 1 [0109.346] GetProcessHeap () returned 0xd20000 [0109.346] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3cc18 | out: hHeap=0xd20000) returned 1 [0109.346] GetProcessHeap () returned 0xd20000 [0109.346] HeapFree (in: hHeap=0xd20000, dwFlags=0x0, lpMem=0xd3ba60 | out: hHeap=0xd20000) returned 1 [0109.346] WriteFile (hFile=0x230, lpBuffer=0xd4f620, nNumberOfBytesToWrite=0x389, lpNumberOfBytesWritten=0x299d864, lpOverlapped=0x0)